Compliance Stuff

Introduction Recent decisions by some companies to prohibit employee participation in prediction markets signal growing concerns about the reputational, conflicts of interest, and confidentiality risks posed by this rapidly expanding marketplace. Every company where employees have access to nonpublic information, client intelligence, licensed information or data, or proprietary analytical expertise should assess whether its compliance framework adequately addresses the risks these platforms present. I f your company has a principles-based Code of Conduct that provides guidance to employees on ownership of and misuse of data, confidentiality, and conflicts, your company may be technically covered, but you should consider whether additional training, guidance, or policies specific to prediction market activity is appropriate. Preventing prohibited or potentially problematic conduct before it occurs is easier than remediating the problem after the fact. Companies should consider providin...

In addition to the immediate operational impacts, data breaches can trigger a range of legal consequences for clients— from the obligation to provide notice to regulators, individuals, and business partners, to the burden of defending regulatory oversight investigations and class action litigation —not to mention the pressure to mitigate effects on end clients and reputational damage. In the U.S., all 50 states, as well as the District of Columbia and three of the territories, have data breach notification laws with varying requirements, but generally the entity that owns the data (called a “controller”) must notify natural persons if there is unauthorized access to certain categories of their “personal information” (which includes SSNs and financial information). If a vendor suffers a data incident, they must notify the controller, often “immediately,” after which the obligation to provide the notices to the data subjects shifts to the controller . Most industrialized countries have ...