CLOSE X
RSS Feed LinkedIn Twitter Facebook
Search:
FMG Law Blog Line

Archive for September, 2016

FTC Finds Data Security Practices Unreasonable, Even Without Evidence of Unauthorized Access

Posted on: September 30th, 2016

By: Matt Foree

Recently, the Federal Trade Commission (“FTC”) issued a significant decision in which it held that LabMD, a former clinical laboratory, engaged in “unfair” practices in violation of Section 5 of the FTC Act because it failed to provide reasonable and appropriate security for personal information stored on its computer network.  The FTC held that LabMD’s “failures resulted in the installation of file-sharing software that exposed the medical and other sensitive personal information of 9,300 consumers on a peer-to-peer network accessible by millions of users.”  The FTC also found that LabMD left the data “freely available, for 11 months, leading to the unauthorized disclosure of the information.”  Significantly, the FTC reached its decision even though there was no evidence that consumer information was accessed by unauthorized persons.

The case centered on an analysis of whether LabMD’s practices were likely to cause substantial injury to consumers. The FTC stated that, “[i]n determining whether a practice is ‘likely to cause a substantial injury,’ we look to the likelihood or probability of the injury occurring and the magnitude or seriousness of the injury if it does occur.”  In issuing its decision, the FTC also restated its position on reasonableness:  “The touchstone of the FTC’s approach to data security is reasonableness: a company’s data security measures must be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.”

Applying these principles, the FTC found that “LabMD’s security practices were unreasonable, lacking even basic precautions to protect the sensitive consumer information maintained on its computer system.”  Specifically, “it failed to use an intrusion detection system or file integrity monitoring; neglected to monitor traffic coming across its firewalls; provided essentially no data security training to its employees; and never deleted any of the consumer data it had collected.” The FTC concluded that “the privacy harm resulting from the unauthorized disclosure of sensitive health or medical information is in and of itself a substantial injury under Section 5(n)” such that disclosure of data caused substantial injury.

LabMD has filed a Motion to Stay the effective date of the FTC Order pending review by a United States Court of Appeals, which is currently pending before the FTC.

The FTC’s decision sets forth an interesting precedent for violations under Section 5 of the FTC Act.  The decision expands the FTC’s ability to find violations of Section 5 without the need for evidence of access by unauthorized persons, which portends that the number of enforcement actions taken by the FTC will increase.

Georgia Utility Update – September 2016

Posted on: September 30th, 2016

By Robert B. Baker

PSC Approves An Additional 1,600 Megawatts (“MW”) of Renewable Energy by 2021

The Georgia Public Service Commission’s recent Integrated Resource Plan (“IRP”) decision provides for the development of an additional 1,600 MW of renewable energy in Georgia.  Requests for proposals will be issued in 2017 for 525 MW and 2019 for 525 MW.  The 1,600 MW or renewable generation will be composed of 1,050 MW of utility scale generation, 150 MW of distributed generation, 200 MW of self-build capacity for Georgia Power and 200 MW for a commercial and industrial program.  Costs to implement and administer the renewable energy program will be recovered through Georgia Power’s fuel charge.

No more than 75MW of  Georgia Power’s 200 MW self-build development may be with non-military customer projects.  All of the projects must be at or below the Company’s avoided cost.  Additionally, the Company shall consider the development of a 200 MW renewable Commercial and Industrial Program that will be reviewed by the Commission.

The IRP also provided for the retirement of several old coal plants – Plant Mitchell Units 3, 4A and 4B, Plant Kraft Unit 1 CT and Intercession City CT – to be completed by 2018.  The Company’s reserve margin was raised from 15% to 16.25%.  Additionally, the coal ash pond solar demonstration project and High Wind Study were   approved.

As part of  the IRP Georgia Power requested $175 million for licensing and study costs associated with new nuclear units to be located on the Chattahoochee River in Stewart County, the Commission approved $99 million until the next IRP in 2019.  PSC Staff analysis indicated that the initial request for $175 million did not include financing costs that would increase the actual costs for licensing to over $330 million.  Georgia Power claims it may need the additional nuclear generation capacity by the 2030s.

 

Vogtle Units 3 and 4 Prudency Review Report to the Commission Due October 19

On January 21, 2016, Georgia Power Company filed a request with the Commission to recover $350 million in litigation settlement costs it paid to its contractor for Vogtle Units 3 and 4.  At the January 28th Energy Committee meeting Commissioner Wise made a motion to review all of the Vogtle Project costs incurred-to-date, including the litigation settlement costs.  On February 2, 2016, the Commission approved the Vogtle prudency review for all costs of the Project.

Georgia Power is seeking certification that all of its costs up to December 31, 2015, or $3,509 billion are prudent and reasonable.  Costs certified as “prudent and reasonable” are not subject to any future review or disallowance.  Certified costs are included in the Company’s rate base for recovery from ratepayers.

This is the first prudency by the Public Service Commission since the Vogtle Units 1 and 2 prudency reviews conducted in 1987 and 1989.  While the Vogtle 1 and 2 prudency reviews had several weeks of public hearings, testimony from the Company’s senior officers and consultants and cross-examination of those witnesses, the prudency review for Vogtle 3 and 4 provides for no extended public hearings, no testimony from any witnesses and no cross-examination.

The Public Service Commission Staff is conducting a limited review of the Vogtle 3 and 4 expenses and is scheduled to report to the Commission its findings or possible settlement proposal on October 19, 2016.  Certification of all the Vogtle 3 and 4 costs as prudent and reasonable face several challenges, such as, the Project currently being 39 months behind schedule, persistent problems with the module and sub-module fabrication from the beginning of the Project, no complete Integrated Project Schedule until 2016, the inability to test equipment and systems until they are complete and the possible inclusion of costs that should be allocated to Vogtle Units 1 and 2.

 

Atlanta Gas Light Company Submits Its 2017 Facilities Expansion Plan for $24 Million

Atlanta Gas Light Company (“AGLC”) recently submitted its 2017 facilities expansion plan that will target Appling, Macon and Schley Counties.  Estimated total costs for the three projects are $9.5 million for Appling County, $2.5 million for Macon County and $12.4 million for Schley County.  Of particular interest is the Schley County project which has no projected customers and no projected revenue through 2021.  The AGLC filing in Docket 40714 indicates that the project will install approximately 26,000 feet of six inch steel pipe along Highway 271 to US Highway 19 to provide natural gas service to customers in Ellaville.

Let’s Go to the Replay: Effective Use of Video Footage to Defend Constitutional Claims

Posted on: September 27th, 2016

Police CameraBy: Andrew Treese and Kevin Stone

The 1989 premier of COPS, and more significantly the Rodney King incident in 1991, marked the beginning of a new era in law enforcement: the era of “policing on video.”  Technological advances, combined with lower prices and the availability of state and federal grants, spurred law enforcement agencies across the country to equip patrol cars with dash-cam systems.  More recently, the advent of portable digital recorders has prompted departments across the country to deploy body-cams — and in at least one case, the FBI obtained drone-mounted footage of a law-enforcement shooting incident.  Occasionally our clients ask whether this trend is helpful to the defense of civil claims.  The answer?  Yes.  Here’s why:

Our goal in defending excessive force claims is not only to obtain a win for the defense, but to do so as quickly as possible – preferably on a motion to dismiss or for summary judgment.  Without video, excessive force claims often boil down to a “he said / she said” dispute between police officers and suspects. Unfortunately, the presence of conflicting testimony can bar summary judgment, even where the plaintiff’s testimony seems to lack facial credibility, so long as the testimony creates a “genuine dispute” as to material facts in the case.

Fortunately, not all disputes are genuine.  Several years ago, our law partners Phil Savrin and Sun Choy won Scott v. Harris in the United States Supreme Court.  Scott is the principal case addressing the constitutionality of the use of force in police pursuits.  Equally as important, however, is the portion of the opinion that addressed summary judgment in cases involving incidents recorded on video. In no uncertain terms, the Court explained, “At the summary judgment stage, facts must be viewed in the light most favorable to the nonmoving party only if there is a ‘genuine’ dispute as to those facts. … When opposing parties tell two different stories, one of which is blatantly contradicted by the record, so that no reasonable jury could believe it, a court should not adopt that version of the facts for purposes of ruling on a motion for summary judgment. … Respondent’s version of events is so utterly discredited by the record that no reasonable jury could have believed him. The Court of Appeals should not have relied on such visible fiction; it should have viewed the facts in the light depicted by the videotape.”

Since it was issued, Scott has been cited for this principle nearly 2,500 times.  The result is that dash-cam, body-cam, surveillance, and bystander video footage, which are becoming increasingly more prevalent, may provide defendants with a pathway to summary judgment that would not have been available otherwise.  Notably, video is not always a “silver bullet” to obtaining summary judgment.  Key events may take place out of the frame of the camera, audio tracks might not capture key statements or comments, or a court could simply decide that summary judgment is inappropriate based on the facts as depicted in the video.  Dashcam video may also fail to fairly show what the defendant officer would have seen from his position.  Even body-cam video may not fairly depict the officer’s perspective if the video is slowed, paused, and/or viewed numerous times.  Officers, after all, get one chance to watch events unfold at full speed.  Video footage can, however, eliminate disputes about what happened, allowing the court to focus on the legal analysis, rather than parse through each party’s version of the event.

The importance of securing relevant video footage as soon as possible after an incident occurs cannot be understated – not only to permit early case evaluation and avoid spoliation arguments, but to maximize the odds of obtaining summary judgment if suit is filed.  To this end, some states — including Georgia — have begun implementing mandatory retention periods for police video recordings, a topic we will address in a future blog.

U.S. DOT Issues Guidelines for Self-Driving Vehicles

Posted on: September 27th, 2016

Red Sport carBy: Wes Jackson

On Tuesday, the U.S. Department of Transportation ushered in the long-anticipated future of transportation with guidelines for “autonomous vehicles,” or self-driving cars (available here). The policy guidance focuses primarily on “highly automated vehicles,” (“HAVs”) or those that have automated systems that actually monitor the driving environment as opposed to merely conducting some part of the driving task (such as a cruise control function). The DOT’s executive summary of the policy states that the policy “sets out an ambitious approach to accelerate the HAV revolution.”

One of the main takeaways from the guidelines is the “15 Point Safety Assessment” for manufacturers, which covers traditional automobile safety considerations like “Crashworthiness” along with new considerations unique to driverless or highly automated vehicles, such as “Object and Event Detection and Response” and “Post-Crash Behavior.” The Safety Assessment also includes an “Ethical Considerations” assessment, which will address the ethical implications that arise from programming a vehicle to make choices, for example, between the safety of its occupants or another car’s occupants. Aside from these safety guidelines, the policy also introduces a Model State Policy which, if widely adopted by the states, will lead to uniform nation-wide regulations of HAVs and avoid state-level regulatory inconsistencies that could delay widespread utilization of new automated vehicle technology.

It may go without saying, but the promise of driverless vehicles will be the biggest change in personal transportation since the invention of the motor carriage itself. But the new technology will not only change how (or if) we drive—it will also transform the existing legal framework for assigning liability when accidents occur. While it may be years before driverless cars hit the road, auto insurers, commercial carriers, and other industry participants should begin assessing how HAVs will impact the industry and steer their businesses accordingly.

The Foundation to Deny Coverage May Have Cracks

Posted on: September 26th, 2016

Building constructionBy: Bart Gary and Brian Lake

In Cypress Point Condo. Ass’n, Inc. v. Adria Towers, L.L.C., 226 N.J. 403 (2016), decided August 4, 2016, the Supreme Court of New Jersey affirmed a Court of Appeals decision that a condominium developer general contractor’s Commercial General Liability (CGL) policies provide coverage for consequential damages stemming from its subcontractor’s allegedly defective work. The underlying dispute arose after several residents of a condominium complex began to experience roof leaks and water seepage in their units. The condominium association brought suit against the developer, who also served as the general contractor, alleging negligent construction by the developer’s subcontractors, and sought declarations that its claims were covered under the developer’s CGL policies. The trial court, relying on Weedo v. Stone-E-Brick, 81 N.J. 233 (1979), granted summary judgment to the insurers, finding that there was no “property damage” or “occurrence,” as defined by the policies to trigger coverage. The Supreme Court, however, held that the alleged consequential damage caused by the subcontractors’ defective work constitutes “property damage,” because it is “physical injury to tangible property,” as well as an “occurrence” because it is an unexpected or unintended “continuous or repeated exposure to substantially the same general harmful conditions.”

The Cypress Point decision signals a departure from long-standing New Jersey case law allowing insurers to disclaim coverage for consequential damages in negligent construction cases. In distinguishing the 1979 Weedo case, one of the leading decisions on the issue, the New Jersey Supreme Court noted that the policies at issue in Cypress Point were based on the 1986 ISO standard CGL form, while Weedo interpreted the earlier 1973 ISO standard form. The 1973 version defined “occurrence” as “an accident . . . which results in . . . property damage neither expected nor intended from the standpoint of the insured.” In contrast, the 1986 form defines “occurrence” as “an accident, including continuous or repeated exposure to substantially the same general harmful conditions.” Giving the undefined term “accident” its plain meaning, the New Jersey Supreme Court held that the an “occurrence” contemplates unintended and unexpected harms caused by negligent conduct, such as the consequential damages caused by the developer’s subcontractor’s allegedly defective work. Additionally, the 1986 form also includes a “subcontractor’s work” exception to the business risk exclusions. The New Jersey Supreme Court pointed out that the inclusion of the subcontractor exception signified the insurer’s intent to cover damages caused by the insured’s subcontractor’s negligent work. Otherwise, the exception would be meaningless.

With this decision, the New Jersey Supreme Court joins the recent trend of courts interpreting the terms of standard CGL policies, specifically those defining “occurrence” and “property damage” in accordance with the 1986 ISO standard form, to provide coverage for consequential damages resulting from a subcontractor’s negligent work. The Georgia Court of Appeals has fast adopted the majority view in Weedo to hold that a contractor’s general liability policy was not implicated where the damage was to the contractor’s work itself, as opposed to the consequential damages resulting from the poor workmanship. Gary L. Shaw Builders, Inc. v. State Automotive Mut. Ins. Company, 355 S.E.2d 220 (1987). For nearly thirty years the Georgia courts have slavishly followed this rule despite changes in the industry-wide policies during that time. With the court that decided Weedo modifying its ruling, Georgia Courts may be forced to look at the newer policy provisions as well and expand coverage for defective construction works.

As always, please contact the attorneys and Freeman, Mathis & Gary, LLP to address any further questions you may have regarding these issues.