Morrison Foerster’s Class Dismissed blog provides insights, recommendations, and timely reports on the latest defense news, developments, and trends in the most current class actions lawsuits and product liability issues that affect consumer-facing companies. Through Class Dismissed, attorneys from our nationally recognized Consumer Class Action and Products Liability practices offer a real-time assessment of the developments in matters that are shaping the industry. This blog examines the full spectrum of consumer-related class action and product liability lawsuits ranging from false advertising, privacy, consumer product safety, ADA, food misbranding, TCPA, environment, retail, and government actions as well as nationwide and multidistrict litigation class actions.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

Editors

park_julie_blog_150x150.png

park_julie_common_640x280.jpg

park_julie_heroretina_2700x1160.jpg

park_julie_mobileretina_750x1040.jpg

park_julie_social_600x600.jpg

Partner

Julie Park protects her clients’ products no matter what kind of product issue they face—whether it is planning for new product development, recalling an existing product, or defending clients against product liability or consumer class actions. Drawing on her deep technical and legal expertise, Julie counsels clients on consumer product safety regulation and pharmaceutical and medical device preemption while also managing complex and multijurisdictional litigation both in state and federal court.

Julie Y. Park

<div class="videoWrapper"><iframe frameborder="0" class="sticky-video" allowfullscreen="1" title="Meet Penny Preovolos, Litigation Partner" src="https://www.youtube-nocookie.com/embed/hv7hYn-Bl7c?rel=0&showinfo=0;vq=hd1080" title="iframe"></iframe></div>Penelope has served as lead counsel in major consumer class actions and antitrust cases for more than 35 years, successfully representing high-profile defendants in antitrust, consumer fraud, and product defect matters. Her clients span a range of industries, including consumer electronics, technology, retail, publishing, food and beverage, cosmetics, and household products. According to Chambers USA, Penelope has a “great reputation for antitrust and product liability work” and is a “superb all-around antitrust lawyer.”Penelope was named the 2019 Antitrust Lawyer of the Year by the Antitrust, UCL, and Privacy Section of the California Lawyers Association. She was co-chair of MoFo’s antitrust practice for 14 years. She has served as chair of the Antitrust and Trade Regulation Section of the State Bar of California and as a member of the Ninth Circuit Advisory Committee on Local Rules and Operations. She is an editor of and frequent contributor to Morrison & Foerster’s <a href="https://classdismissed.mofo.com/">Class Dismissed blog</a>, as well as a frequent speaker about class action and antitrust issues.More About PenelopePenelope clerked for the Honorable Charles M. Merrill, United States Court of Appeals for the Ninth Circuit. She graduated cum laude from Harvard Law School, where she was executive editor of the Harvard Civil Rights – Civil Liberties Law Review. Penelope was a member of Phi Beta Kappa at the University of California, Berkeley. She was awarded the University Medal, the highest undergraduate honor at the university, as well as the English Departmental Citation (awarded to the outstanding graduate in that department).

preovolos_penelope_blog_150x150.png

preovolos_penelope_common_640x280.jpg

preovolos_penelope_heroretina_2700x1160.jpg

preovolos_penelope_mobileretina_750x1040.jpg

preovolos_penelope_social_600x600.jpg

Senior Counsel

Penelope has served as lead counsel in major consumer class actions and antitrust cases for more than 35 years, successfully representing high-profile defendants in antitrust, consumer fraud, and product defect matters. Her clients span a range of industries, including consumer electronics, technology, retail, publishing, food and beverage, cosmetics, and household products.

Penelope A. Preovolos

Claudia focuses her practice on the defense of consumer class actions and on complex commercial litigation, including unfair business competition, false advertising, product liability, and privacy matters. She is currently representing numerous consumer goods manufacturers and retailers in false advertising and mislabeling class action lawsuits. Claudia also regularly counsels clients in the food, cosmetics, retail, and technology industries. She represents companies in false advertising disputes before the National Advertising Division (NAD) of the Council of Better Business Bureaus, Inc.<h5>More about Claudia</h5>Claudia is active in MoFo’s pro bono efforts, and recently traveled to El Paso, Texas, to work with families separated and detained at the border. She is also supervising a pro bono collaboration with Equal Rights Advocates, a nonprofit fighting for gender justice in work places and schools across the country. The initiative will help students who have been victims of sexual assault, attempted assault, or harassment find support and seek justice. Claudia is also a board member of Bay Area Legal Aid and a former board member of Equal Rights Advocates. Claudia is an editor and frequent contributor to MoFo’s <a href="https://classdismissed.mofo.com/">Class Dismissed</a> blog, which provides reports about the latest defense news, developments, and trends in class action lawsuits and product liability issues that affect consumer-facing companies. Her perspectives are also respected in the larger legal community: Claudia has published articles about class action and false advertising issues, and is a co-author of Chapter 7 — “Unfair Competition in California Business Litigation 2016” — of The Recorder. She also regularly speaks at conferences on class action and advertising trends. Claudia is currently serving as a Lawyer Representative for the Northern District of California. She received her J.D. degree in 2004 from Berkeley Law (Boalt Hall School of Law), where she was an associate editor of the Berkeley Technology Law Journal.

vetesi_claudia_blog_150x150.png

vetesi_claudia_common_640x280.jpg

vetesi_claudia_heroretina_2700x1160.jpg

vetesi_claudia_mobileretina_750x1040.jpg

vetesi_claudia_social_600x600.jpg

Claudia focuses her practice on the defense of consumer class actions and on complex commercial litigation, including unfair business competition, false advertising, product liability, and privacy matters. She is currently representing numerous consumer goods manufacturers and retailers in false advertising and mislabeling class actions.

Claudia M. Vetesi

Alexandra Barlow is a partner in the Litigation Department of Morrison Foerster’s San Diego office.Alexandra litigates product liability matters involving medical devices, pharmaceuticals, consumer products, automobiles, and AI. Alexandra's litigation expertise spans the entire case life cycle in both state and federal courts. She handles all phases of discovery, including fact investigation and expert discovery. Alexandra has taken over twenty-five depositions, including experts, plaintiffs, treating physicians, and third-party witnesses. She drafts and argues motions of all types, including motions for summary judgment, motions to quash, and motions for preliminary injunction.Alexandra has significant trial experience. She has first-chaired a one-week jury trial and second-chaired a five‑week jury trial, both involving multiple claims and witnesses. She also has extensive experience in alternative dispute resolution, representing clients at mediations, mandatory settlement conferences, and early neutral evaluations.Alexandra enjoys tracking developments and keeping her clients updated on product liability and personal injury claims, frequently writing or presenting on emerging areas such as autonomous vehicles and smart devices. Alexandra’s experience also extends to professional liability, warranty claims, eminent domain, and construction law.Alexandra earned her J.D. from the University of San Diego School of Law. While in law school, the San Diego Law Review published her comment on the recovery of damages by plaintiffs in a persistent vegetative state, and she also served as a comment editor. She received her B.A. from the University of California, Los Angeles, where she majored in Political Science and minored in Spanish. A San Diego native, she attended a Spanish immersion school through the eighth grade. Alexandra is active in the San Diego community, advising students at a local college. She is also a member of several legal organizations in San Diego, including Lawyer’s Club, the Association of Business Trial Lawyers, and Wallace Inn of Court.

preece_alex_blog_150x150.png

preece_alex_common_640x280.jpg

preece_alex_heroretina_2700x1160.jpg

preece_alex_mobileretina_750x1040.jpg

preece_alex_social_600x600.jpg

Alexandra Barlow is a partner in the Litigation Department of Morrison Foerster’s San Diego office. Alexandra litigates product liability matters involving medical devices, pharmaceuticals, consumer products, automobiles, and AI. Alexandra’s litigation expertise spans the entire case life cycle in both state and federal courts. She handles all phases of discovery, including fact investigation and expert discovery. Alexandra has taken over twenty-five depositions, including experts, plaintiffs, treating physicians, and third-party witnesses. She drafts and argues motions of all types, including motions for summary judgment, motions to quash, and motions for preliminary injunction.

Alexandra Barlow is a partner in the Litigation Department of Morrison Foerster’s San Diego office. Alexandra litigates product liability matters involving medical devices, pharmaceuticals, automobiles, AI, and robotics. Alexandra's litigation expertise spans the entire case life cycle in both state and federal courts. She handles all phases of discovery, including fact investigation and expert discovery. Alexandra has taken over twenty-five depositions, including experts, plaintiffs, treating physicians, and third-party witnesses. She drafts and argues motions of all types, including motions for summary judgment, motions to quash, and motions for preliminary injunction.

Alexandra Barlow

Adam J. Hunt is a partner in the Litigation Department of Morrison Foerster’s New York office. His practice focuses on complex litigation, with an emphasis on class action and commercial litigation.Mr. Hunt has extensive experience representing consumer products companies, financial institutions, and technology firms in class action cases and complex commercial disputes before state and federal trial courts, as well as in arbitrations. Clients seek Mr. Hunt’s counsel for his creative, strategic thinking in high-stakes, high-profile matters. He has represented clients facing claims under false advertising, antitrust, and privacy laws throughout the country, securing wins at the pleading stage, summary judgment, and trial, in addition to negotiating favorable settlements, often early in the case. Representative experience includes successfully securing rulings dismissing two putative false advertising class action cases against one of the best-known consumer electronics companies in the world; obtaining a complete win on summary judgment for a major shipping and logistics company in a multimillion-dollar commercial dispute; appearing as counsel at trial for a leading financial institution in a $100 million commercial dispute, winning a bench trial verdict; and prevailing on motions to dismiss false advertising class actions against a leading Greek yogurt company.Mr. Hunt is also an editor of the firm’s <a href="https://classdismissed.mofo.com/" target="_self">Class Dismissed blog</a>, which provides insights, recommendations, and timely reports on the latest defense news, developments, and trends in the most current class action lawsuits that affect consumer-facing companies.Mr. Hunt maintains an active pro bono practice and is the recipient of the New York State Bar Association’s 2017 President’s Pro Bono Service Award for the First Judicial Department, the 2018 Public Service Award from New York University School of Law, and Morrison Foerster’s Kathi Pugh Award for Pro Bono Services.Mr. Hunt received his B.A. with honors from Swarthmore College and his J.D. cum laude from New York University.

hunt_adam_blog_150x150.png

hunt_adam_common_640x280.jpg

hunt_adam_heroretina_2700x1160.jpg

hunt_adam_mobileretina_750x1040.jpg

hunt_adam_social_600x600.jpg

Adam Hunt is a partner in the Litigation Department of Morrison Foerster’s New York office. His practice focuses on complex litigation, with an emphasis on class action and commercial litigation.

Adam Hunt

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Morrison Foerster’s Class Dismissed blog provides insights and reports on the latest news, developments, and trends that affect consumer-facing companies. Subscribe to receive the latest updates by attorneys from our nationally recognized Consumer Class Action and Product Liability practices.

Welcome to Class Dismissed

class-dismissed-welcome-image.jpeg

class-dismissed-welcome-image

Morrison Foerster’s Class Dismissed blog provides insights and reports on the latest news, developments, and trends that affect consumer-facing companies. 

Class Action

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

Stay on top of emerging issues and stay informed of developments related to the law and business of social media.

Socially Aware

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

The latest news and insights from the nationally recognized Consumer Class Action and Product Liability practices of Morrison & Foerster.

Class Dismissed

  Linkedin

MoFo LinkedIN

Class Dismissed Blog - RSS

Stay Connected

By submitting your data to subscribe to this blog, you approved Morrison & Foerster LLP to email you future information about MoFo news and events. You may opt-out at any time by sending a request to <a href="mailto:mofonews@mofo.com">mofonews@mofo.com</a>. To learn more about how Morrison & Foerster LLP uses and protects your personal data, please view our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a> at <a href="https://www.mofo.com/">www.mofo.com</a>.

Never miss a post from Class Dismissed. Enter your email below to stay up-to-date.

Subscribe

Class Action and Product Insights for Your Business

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

TCPA

Announcements & Press

Antitrust

Appellate & Supreme Court

Arbitration

Autonomous Vehicles & Robotics

Aviation & Drones

Class Certification

Consumer Products

Coronavirus (COVID-19)

CPSC

Drug & Medical Device

Emergency Use Authorization (EUA)

Environmental Law

False Advertising

FCRA

Food Misbranding

Government Actions

Internet of Things

Mass Torts

Pharmaceutical & Medical Devices

Privacy

Product Liability

Public Readiness and Emergency Preparedness Act (PREP Act)

Retail

Trials

Topics

Blog - Editors

Blog - About

About

Blog - Subscribe

More

Alexandra Preece Barlow

Adam J. Hunt

The Future of Section 230: Protection Against Product Liability Claims?

New Wave of PFAS Legislation Aimed at Consumer Products

CPSC Releases Annual Report on Deaths and Injuries Involving Nursery Products

CPSC Proposes New Safety Rules for Infant Rockers

CPSC Commissioners Abstain from Retracting Infant Sleep Product Statements

LinkedIN

The Consumer Product Safety Commission (CPSC) announced today that on May 16, 2018, it will hold a public hearing on “potential safety issues and hazards associated with internet-connected consumer products.”<a href="#_ftn1" name="_ftnref1">[1]</a>  The Commission will hear testimony from interested stakeholders on potential safety hazards created by network-connected devices, the types of hazards arising from their use or foreseeable misuse, current standards development, industry best practices, and the proper role of CPSC in addressing potential safety hazards with IoT devices.CPSC’s goal with this hearing is to gather information from regulators, standards organizations, and business and consumer advocates, to “inform future Commission risk management work.” How CPSC interprets the information received at this hearing could significantly shape the predictably unpredictable regulatory environment that IoT-focused consumer companies are asked to navigate.Regulatory Scrutiny Follows the IoT Explosion CPSC’s intensified focus on the Internet of Things (IoT) is no surprise to industry followers given the recent explosion of IoT devices in the consumer products space. And companies can expect the focus to continue because the IoT train isn’t slowing down.  By some estimates, the global IoT market is projected in the next five years to grow from roughly $170 billion to $561 billion—a compound growth rate of 26.9%.<a href="#_ftn2" name="_ftnref2">[2]</a>CPSC’s Focus Will Be on IoT Devices’ Potential Physical HazardsWhile recognizing this trend and its “promise of many benefits for consumers,” CPSC is still cautious about the ways “internet connectivity is also capable of introducing a potential for harm (a hazard) where none existed before.” Still, CPSC’s focus remains where it has always been: on product hazards that cause physical injury or property damage, including “[f]ire, burn, shock, tripping or falling, laceration, contusion, and chemical exposure.”As a framework for analyzing IoT-related risks, CPSC has grouped product safety challenges posed by IoT products into two broad categories:<ol><li>Hazards Inherent in the Product Design. These hazards specifically include the “high-risk remote operation” of devices or network-enabled control of product features. One example is a “cooktop that might be remotely controlled” and could start a fire.</li><li>Hazards Arising Post-Connection.  CPSC calls these “incidents of hazardization,” meaning situations in which the product was safe when the consumer obtained it, but later became hazardous when “connected to a network through malicious, incorrect, or careless changes to operational code.”  One example is a “robotic vacuum cleaner that suddenly begins operating much faster than expected” upon connection to the network or after experiencing a network interference. Another would be the loss of a safety function due to a glitch in the network connection. For example, an integrated home security system could be set by default to deactivate if the system failed to download a software update properly, disabling the smoke alarms without the consumer’s knowledge. CPSC acknowledges that managing these kinds of hazards “may lead industry and regulators to examine policies related to code encryption and security, authorized access to programming, and defensive measures (and countermeasures) for device software.” But CPSC is quick to emphasize that “[t]his is a non-traditional area of product safety activity for the consumer product industry and for the CPSC.”</li></ol>Data Security and Privacy Issues Won’t Be Considered (Yet)Although hot-button privacy and data security risks unique to IoT devices are at the forefront of public debate, CPSC plans to steer clear of these issues at its upcoming hearing. As we pointed out in the wake of the Google Home Mini privacy glitch revelation, privacy groups have recently called on CPSC to scoop up data security and privacy issues into its jurisdiction, which has traditionally focused only on physical injury and property damage.<a href="#_ftn3" name="_ftnref3">[3]</a>  Today’s notice suggests those calls will go unanswered—at least in the short run.  CPSC reiterated that the agency will stick to its traditional wheelhouse of physical safety hazards and “will not address personal data security or privacy implications of IoT devices.”Although CPSC has declined to address these privacy issues now, it is acutely aware of these risks. As the IoT industry grows and new information about IoT-related product risks comes to light, we may yet see CPSC chart new jurisdictional territory in its quest to preserve consumer safety.Hearing Details<ul><li>Date/Time: May 16, 2018, 10:00 a.m.</li><li>Place: Hearing Room, 4th Floor of the Bethesda Towers Building, 4330 East-West Highway, Bethesda, MD 20814</li><li>Simultaneous Webcast: The hearing will also be available through a webcast, but viewers will not be able to interact with the panels and presenters through the webcast.</li><li>Oral Presentations: Requests to make oral presentations and the written text of any oral presentations must be received by the Office of the Secretary no later than 5:00 pm on May 2, 2018.</li><li>Written Comments: Written comments may be submitted (identified by Docket No. CPSC-2018-0007) <ul><li>Electronically – through the Federal eRulemaking Portal at <a href="http://www.regulations.gov/">www.regulations.gov</a>, or</li><li>By Mail/Hand Delivery/Courier – to the Office of the Secretary, Consumer Product Safety Commission, Room 820, 4330 East-West Highway, Bethesda, MD 20814; telephone (301) 504-7923. CPSC will accept written comments through June 15, 2018.</li></ul></li></ul><a href="#_ftnref1" name="_ftn1">[1]</a> The Internet of Things and Consumer Product Hazards, 83 Fed. Reg. 13,122 (March 27, 2018), available at <a href="https://www.federalregister.gov/documents/2018/03/27/2018-06067/the-internet-of-things-and-consumer-product-hazards">https://www.federalregister.gov/documents/2018/03/27/2018-06067/the-internet-of-things-and-consumer-product-hazards</a>.<a href="#_ftnref2" name="_ftn2">[2]</a> See <a href="https://www.reportlinker.com/p03782621/Internet-of-Things-Market-by-Software-Solution-Platform-Service-Application-Domain-and-Region-Global-Forecast-to.html">https://www.reportlinker.com/p03782621/Internet-of-Things-Market-by-Software-Solution-Platform-Service-Application-Domain-and-Region-Global-Forecast-to.html</a>.<a href="#_ftnref3" name="_ftn3">[3]</a> Erin Bosman, Julie Park, and Benjamin Kagel, Connected Devices Bring New Product Liability Challenges, Class Dismissed (Jan. 10, 2018),  <a href="https://classdismissed.mofo.com/consumer-products/connected-devices-bring-new-product-liability-challenges/">https://classdismissed.mofo.com/consumer-products/connected-devices-bring-new-product-liability-challenges/</a>.

An orthopedic implant company

A children&rsquo;s monthly subscription service product

A fertility company

A major technology company

A smart fitness equipment company

Fitbit

Julie Park provides analytic and strategic counsel for issues in product life cycle, product liability and defective products, consumer class actions, and more.

Julie Park

Julie Park | Product Liability Lawyer

shutterstock_744456904_small_thumbnail.jpg

CPSC Will Sharpen Its Focus on IoT in Upcoming Public Hearing About Internet-Connected Devices

CPSC Will Sharpen Its Focus on IoT in Upcoming Public Hearing About Internet-Connected Devices

shutterstock_744456904_small_image.jpg

The Consumer Product Safety Commission (CPSC) announced today that on May 16, 2018, it will hold a public hearing on “potential safety issues and hazards associ

“My Google Home Mini was inadvertently spying on me 24/7 due to a hardware flaw,” wrote a tech blogger who purchased Google Inc.’s latest internet of things (IoT) device. Following the incident, a pact of consumer advocacy groups insisted the U.S. Consumer Product Safety Commission recall the Google smart speaker due to privacy concerns arising when the device recorded all audio without voice command prompts.The CPSC is charged with protecting consumers from products that pose potential hazards. Traditionally, this has meant hazards that may cause physical injury or property damage. But as internet-connected household products continue to proliferate, issues like the “always-on” Google Home Mini raise an important question: Where does cybersecurity of consumer IoT devices fit within the current legal framework governing consumer products?Please see our full article as published on <a href="https://media2.mofo.com/v3/assets/blt5775cc69c999c255/blta6b29dc043b75540/6273154ea1a1dd2aa9f6c96e/180105-connected-devices-liability-changes.pdf" target="_blank" rel="noopener">Law360</a>.

Fertility Center Litigation

MicroPort

Leading Healthcare, Pharmaceutical, and Medical Device Company

Lethal Injection Matters – Major Pharmaceutical Company

Pain Pump Matters – Large Pharmaceutical Company

Major Technology Company

Leading Chemical Company

Security Device Company

In re Air Crash Near Peixoto de Azevedo, Brazil

bosman_erin_blog_150x150.png

bosman_erin_common_640x280.jpg

bosman_erin_heroretina_2700x1160.jpg

bosman_erin_mobileretina_750x1040.jpg

bosman_erin_social_600x600.jpg

Erin Bosman is chair of MoFo’s Class Actions and Mass Torts Practice Group and is a founder and co-head of the Artificial Intelligence Group. Clients value her business strategy, seeking her comprehensive counsel throughout the product life cycle, especially in high-stakes litigation and product recalls.

Erin M. Bosman

Erin Bosman is chair of MoFo’s Class Actions and Mass Torts Practice Group and is a founder and co-head of the Artificial Intelligence Group. Clients value her business strategy, seeking her comprehensive counsel throughout the product life cycle, especially in high-stakes litigation and product recalls.

Erin Bosman

11_23_li_tech4_thumbnail.jpg

Connected Devices Bring New Product Liability Challenges

New California IoT Law Requires Security for Connected Devices

11_23_li_tech4_image.jpg

“My Google Home Mini was inadvertently spying on me 24/7 due to a hardware flaw,” wrote a tech blogger who purchased Google Inc.’s latest internet of things (Io

Connected Devices Bring New Product Liability Challenges

“The rise of powerful AI will be either the best or the worst thing ever to happen to humanity. We do not know which.” –Stephen HawkingArtificial Intelligence (AI) and autonomous technology will shape the future, affect how people live and do business, and impact the legal landscape. While the scope of these technologies remains uncertain, numerous industries are already feeling their impact, including drones, autonomous vehicles and consumer products.AI has tremendous potential to simplify our lives by shortening various decision trees, but consumer product companies ceding control to technology should weigh efficiencies against the risks posed by such novel movements.Please see our full article as published on <a href="https://media2.mofo.com/v3/assets/blt5775cc69c999c255/blt24aa34e7b9841dc7/627315554886af2aa2be1036/171208-company-ready-artificial-intelligence.pdf">Law360</a>.

internet-of-things_thumbnail.jpg

Is Your Company Ready For Artificial Intelligence?

Digital Single Market Update: Technology Standardization in the EU

internet-of-things_image.jpg

“The rise of powerful AI will be either the best or the worst thing ever to happen to humanity. We do not know which.” –Stephen Hawking Artificial Intelligence 

Is Your Company Ready For Artificial Intelligence?

If your company is involved in selling products or services to consumers in New Jersey over the web or through mobile apps, you’ll want to read this client alert.In what amounts to a feeding frenzy, plaintiffs’ lawyers are working overtime bringing class action suits against e-commerce companies, alleging that their online terms and conditions violate New Jersey’s unusual <a href="http://www.gannlaw.com/OnlineApp/dtSearch-Data/TextFiles/Condominium/App-32.pdf" target="_blank" rel="noopener">Truth-in-Consumer Contract, Warranty and Notice Act</a> (“TCCWNA”). Some of the online retailers to have been sued include Victoria’s Secret, Bed Bath & Beyond and TOYS ‘R’ US, with more suits being filed every day.Unlike most consumer protection laws, the TCCWNA focuses specifically on the contractual terms governing certain transactions with consumers, imposing limitations on such terms even if such contractual terms are governed by the law of a state other than New Jersey—creating a potential gotcha for e-tailers who are based outside of New Jersey and who traditionally have their online terms and conditions reviewed only by lawyers admitted to practice in the state whose laws govern such terms and conditions.Although the TCCWNA was enacted in 1981, it has only recently achieved notoriety, as more and more plaintiffs’ lawyers have embraced the statute due to its broad scope and its statutory penalty of not less than $100 per violation without the need to prove actual harm.

Controversial New Jersey Consumer Protection Law Creates a Potential “Gotcha” for E-Commerce Companies

If your company is involved in selling products or services to consumers in New Jersey over the web or through mobile apps, you’ll want to read this client aler

Controversial New Jersey Consumer Protection Law Creates a Potential “Gotcha” for E-Commerce Companies

Health care apps are one of the most important and growing segments in the ecosystem known as the Internet of Things (IoT). After the recent amendments to the Health Insurance Portability and Accountability Act (HIPAA) that, among other things, broadened the definition of a “Business Associate,” many technology companies found themselves wondering whether they were, or were not, subject to HIPAA. Health and Human Services (HHS) recently issued some guidance, Health App Use Scenarios & HIPAA, that attempts to provide some clarity on these issues for app developers.

health-care-apps_thumbnail.jpg

HIPAA and Health Care Apps: Is Your App Covered?

HIPAA and Health Care Apps: Is Your App Covered?

health-care-apps_image.jpg

Health care apps are one of the most important and growing segments in the ecosystem known as the Internet of Things (IoT). After the recent amendments to the H

The Internet of Things (IoT) is booming. Smart cars, wearable health trackers, connected medical devices, drones—entrepreneurs and evolving industry are connecting to the world in ways only science fiction writers imagined. In 2008, the number of connected devices surpassed the number of people on earth. By 2020, conservative estimates predict the IoT market will grow to $7.1 trillion (up from $1.9 trillion in 2013). Its massive scale and expected future growth belies the simple truth that IoT is still in its infancy. In fact, you were probably born before IoT was; the market didn’t even have a name until 1999.As with any profitable and developing market, legal questions abound. IoT is no different, especially for designers and manufacturers of novel devices. What happens if your product injures a customer? What kind of data should your product collect? Do you have a duty to review and understand all the information your product provides? What happens when your connected device gets hacked? How much control should customers have over connected devices? Is a recall necessary when a product’s connection to the Internet fails but the product still works? These questions all share a common thread: there is not yet a developed body of case law with the answers.Because of companies’ abilities to capture, analyze, and capitalize on information gathered from connected devices, one of the most important questions for IoT companies concerns data ownership and governance. Who “owns” all of the data that’s being collected by these billions of devices? Again, the courts have not weighed in on this yet. But we have some ideas that may help companies stay out of trouble in courtrooms.Figure It Out Early. Where ownership of data hasn’t been properly appropriated, we expect significant disputes between all interested parties. This means companies may be unwittingly signing up for prolonged litigation down the road when they haven’t made clear (1) what data it plans to collect; (2) what it plans to do with that data; and (3) how much say the consumer has in limiting the amount or kind of data collected. Much of what a company can, or should, do with information collected depends on (1) the type and source of the data; (2) the specific ways in which the data will be used; (3) the scope of disclosure or consent given by the data subject; (4) contractual restrictions on data usage; and (5) regulatory authority over the use of data. These complicated and often intertwined factors require serious analysis and foresight when bringing novel products to market.Take for example, a “smart” thermostat. This cool device provides the manufacturer with advanced metrics about consumer usage and preferences. In turn, the company can use this information to implement firmware updates designed to reduce overall energy use or to provide personalized settings for individual users. The company could also analyze aggregate data and use patterns from all of its customers to tailor its marketing and design for future models. The company may further capitalize on this data by selling it to third parties for research or analysis purposes. But what if a customer objects (or sues!) saying it didn’t agree to the company using or selling data collected from his or her home? Or more concerning, what if a third party breaks into the company’s database and can ascertain when a customer has turned off his or her smart thermostat and is, therefore, not home? When the hacker then robs the customer’s house and the customer sues the manufacturer for failing to keep his or her information safe, who’s to blame? Although they may not provide an answer to every disagreement down the road, clearly delineated user agreements and disclaimers can go a long way in providing customers’ expectations of what their data will or will not be used for.With great data comes great possibilities. We are here to remind you that these possibilities can also lead to great risks. Check back for more tips and insights on IoT!

Internet of Things: Whose Data Is It Anyway?

The Internet of Things (IoT) is booming. Smart cars, wearable health trackers, connected medical devices, drones—entrepreneurs and evolving industry are connect

Internet of Things: Whose Data Is It Anyway?

The FDA’s recently issued draft guidance on “<a href="http://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm482022.pdf" target="_blank">Postmarket Management of Cybersecurity in Medical Devices</a>” seeks to address some of the increasing concerns that medical device providers, regulators, and consumers have about postmarket cybersecurity standards related to medical devices. Because the consequences of cybersecurity breaches related to medical devices can be serious, manufacturers, health care facilities, and providers should take precautions to ensure that cybersecurity policies and protocols are thorough and up-to-date. It should be noted that this draft guidance is still in draft form and not to be implemented yet.Imagine this scenario: A rogue agent gains access to the serial number on the Vice President’s pacemaker. The agent sends the number to an associate who remotely hacks his way through the device’s security framework and accelerates the Vice President’s heart rate, inducing a heart attack. Sound familiar? Fortunately, this was not a news report; rather, it was a plot line during the second season of Showtime’s television series Homeland. But like many science fiction predictions, this one has already found roots in reality. With the rapidly expanding Internet of Things, and with millions of medical devices now connected to the Internet, hackers have more devices to target every day. Many of these devices, like the pacemaker in Homeland, are essential to a customer’s health, and as a result security breaches should not be taken lightly.BackgroundIn February 2013, President Obama issued <a href="https://www.whitehouse.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity" target="_blank">Executive Order 13636</a>, which stated that cyber threats to national security are among the most serious our nation faces. Additionally, <a href="https://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil" target="_blank">Presidential Policy Directive – 21</a> tasks Federal agencies to strengthen the security and resilience of critical infrastructure against physical and cyber threats. The FDA’s draft guidance borrows principles from these directives and represents the FDA’s current efforts to help strengthen cybersecurity in the rapidly-growing medical device market. Moreover, the FDA encourages manufacturers to apply the voluntary National Institute of Standards and Technology (“NIST”) framework in the development and implementation of their cybersecurity controls. Although the NIST framework only applies to critical infrastructure, the FDA encourages applying its principles broader than critical infrastructure and offers guideposts for companies to improve their cybersecurity posture.Although the FDA’s guidance does not establish legally enforceable responsibilities, it does paint a picture of the FDA’s “current thinking” on this topic, though it should be noted that the draft guidance does not establish any rights for any person, and it is not binding on the public or the FDA, and medical device manufacturers retain the ability to use alternative approaches.Focusing primarily on patient safety, the FDA recommends that medical device manufacturers monitor, identify, and respond to cybersecurity vulnerabilities and exploits during the postmarket management of their devices. The draft document also provides some guidance concerning reporting duties related to cybersecurity breaches.General Principles Concerning Postmarket RegulationThe FDA states that its position is that medical device cybersecurity is a shared responsibility that implicates not just the manufacturer of medical devices, but also health care facilities, patients, and providers, though manufacturers are likely to be on the front line of any litigation.The FDA stated its view that due to the continuing evolution of cybersecurity risks associated with medical devices, it is not possible to eliminate risks through premarket controls alone. Accordingly, manufacturers should[1] increase their postmarket cybersecurity risk management measures. The draft guidance suggests that medical device manufacturers focus on certain aspects, including:<ol><li>Identify problem areas in cybersecurity framework. This can be achieved through analysis of complaints, returned products, service records, and other sources of data that may help identify existing and potential cybersecurity risks. Many medical devices now contain or share internal records, statistics, and incident reports related to their performance. These metrics can be crucial for manufacturers to identify potential weaknesses in their cybersecurity armor before they are exploited.</li><li>Characterize and assess the identified vulnerabilities with regards to exploitability and potential severity of impact to health. This includes establishing and communicating the process for receiving and managing vulnerability reports. The FDA guidance provides additional detail and recommends using a cybersecurity vulnerability assessment tool or similar scoring system in this process.</li><li>Clearly define “essential clinical performance” of the medical device at issue in order to develop safeguards that protect, respond, and recover from the cybersecurity risk. Essential clinical performance is defined as “performance that is necessary to achieve freedom from unacceptable clinical risk.” In turn, an unacceptable clinical risk is one with high exploitability potential that poses a severe impact to health. The FDA admits that risk assessment may be difficult (i.e. manufacturers may struggle to categorize a risk as acceptable or unacceptable). Even so, the FDA recommends that manufacturers “make a binary determination that a vulnerability is either controlled or uncontrolled using an established process that is tailored to the product, its essential clinical performance, and the situation.”</li><li>Adopt a coordinated vulnerability disclosure policy and practice. Clearly defining user expectations and allocating risks appropriately can save manufacturers time and money in the long run.</li><li>Deploying mitigations that address cybersecurity risk early and prior to exploitation. If possible, risks should be addressed before they are exploited. Not only will early action protect customers, it may also limit potential damage claims down the road. The FDA notes that “acceptable mitigations will vary according to the device’s essential clinical performance”—i.e., manufacturers should apply a sliding scale analysis. For example, the FDA notes that more significant mitigation may be necessary for a vulnerability affecting an insulin pump than one affecting a thermometer.</li></ol>The FDA recognizes that even in the most sophisticated cybersecurity programs, vulnerabilities may arise and complete security is impossible. The FDA’s guidance focuses only on those vulnerabilities that may affect safety. Manufacturers should be cognizant that other issues beyond the scope of the draft guidance could become the focus of other regulating bodies and/or plaintiffs’ attorneys.ReportingThe FDA document also provides some guidance to manufacturers with regard to reporting cybersecurity vulnerabilities and breaches to the FDA. Generally, the FDA does not plan to require premarket review or approval of “cybersecurity routine updates and patches” to medical device software.Additionally, the FDA does not plan on requiring reporting when changes to a device are made to address vulnerabilities associated with controlled risks. Controlled risks are those that present “sufficiently low residual risk that the device’s essential clinical performance could be compromised by the vulnerability.” Reporting is also not necessary when these changes are implemented “solely to strengthen cybersecurity.” However, the FDA suggests that companies report newly acquired information about cybersecurity vulnerabilities and device changes made as part of a cybersecurity routine update or patch in an annual report when they concern a premarket approval (or Class III) medical device (one that supports or sustains human life).The draft guidance provides a relevant example where manufacturers may not have to report an action to mitigate a controlled risk. In this example, a manufacturer becomes aware of an “open communication port” on its device. However, a design feature prevents unauthorized remote firmware from being downloaded onto the device. This requirement for physical access to the device substantially mitigates the threat; therefore, the risk is considered by the FDA to be controlled and acceptable. The manufacturer then enhances the device’s security by closing the open communication port and notifying users. These actions would be considered a cybersecurity routine update or patch and may not require reporting under federal standards. However, if this were a Class III device, the manufacturer would need to report the changes to the FDA in its annual report.On the other hand, when manufacturers implement risk control measures to account for uncontrolled risks to essential clinical performance, the FDA’s view is different, and reporting might be necessary. However, the FDA does not intend to enforce these reporting requirements when:  (1) there are no known serious adverse events or deaths associated with the vulnerability; (2) within 30 days, the manufacturer identifies and implements device changes and/or compensating controls to bring the residual risk to an acceptable level and notifies users; and (3) the manufacturer is a participating member of an Information Sharing Analysis Organization (“ISAO”)[2], such as the National Health Information Sharing & Analysis Center.The FDA’s drafters may have been Homeland fans as the guidance contains a familiar example where reporting may be necessary:  a manufacturer becomes aware of a vulnerability in a Class III medical device (i.e. a pacemaker) that allows it to be reprogrammed by an unauthorized user. The manufacturer performs a risk assessment and concludes that the vulnerability is moderately exploitable and the risk to the device’s essential clinical performance is uncontrolled. The manufacturer notifies the relevant stakeholders and distributes an emergency patch to mitigate the risk. The manufacturer is not a member of an ISAO. Even if the manufacturer is unaware of any incidents, because this vulnerability could result in severe injury or death, reporting may be necessary.ConclusionEven in light of the FDA’s guidance, manufacturers will likely struggle to categorize risks associated with cybersecurity vulnerabilities. Consequently, determining reporting requirements (contingent on whether a risk is uncontrolled or controlled) may also present challenges unique to each medical device at issue. Manufacturers will be well served by factoring in the FDA guidance into their existing cybersecurity plans. [1] The use of the word should in Agency guidance means that something is suggested or recommended, but not required.[2] An “ISAO” is a group created to gather, analyze, and disseminate critical infrastructure information. See <a href="https://www.whitehouse.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari" target="_blank">Exec. Order No. 13691 (Feb. 13, 2015)</a>.

FDA Embraces Internet of Things: New Draft Guidance on Postmarket Cybersecurity for Medical Devices

The FDA’s recently issued draft guidance on “Postmarket Management of Cybersecurity in Medical Devices” seeks to address some of the increasing concerns that me

FDA Embraces Internet of Things: New Draft Guidance on Postmarket Cybersecurity for Medical Devices