By: Michael W. Ross, Williams S.C. Goldstein, Amy Egerton-Wiley and Maria E. LaBella

Last month, the Office of the Comptroller of the Currency (OCC) adopted a final rule clarifying that the terms of a national bank’s loans remain valid even after such loans are sold or transferred.  The rule was intended to reject the Second Circuit’s decision in Madden v. Midland Funding 786 F.3d 246 (2015).  The Federal Deposit Insurance Corporation (“FDIC”) followed suit later in the month, adopting a rule to clarify that interest rates on state bank-originated loans are not affected when the bank assigns the loan to a nonbank.  These steps do not resolve all of the uncertainty surrounding the decision, as discussed further below.

1. The Madden v. Midland Funding

In Madden v. Midland Funding, Saliha Madden, a New York resident, contracted with Bank of America for a credit card with a 27% interest rate.  That rate exceeded the 25% usury cap under New York law.  But, as a national bank, Bank of America believed that it was entitled to “export” the interest rate of Delaware, its place of incorporation, under the National Bank Act and attendant principles of federal preemption.  By the time Madden defaulted, the balance had been acquired by Midland Funding, a debt collector headquartered in California.  When Midland Funding tried to collect the debt at the 27% interest rate, Madden sued under New York usury laws.  She argued that Midland could not take advantage of Bank of America’s interest-rate exportation.

By: Michael W. Ross and Jacob D. Alderdice

The implementation of the Paycheck Protection Program (PPP) under Title I of the Coronavirus Aid, Relief and Economic Security Act (the CARES Act) amidst the COVID-19 economic downturn has spawned a growing cottage industry of litigation, including several waves of cases against different defendants—primarily bank and non-bank lenders, and the United States Small Business Administration (SBA).  The nature of the cases has varied.  In the first cases filed, borrowers excluded from PPP sued banks for imposing additional restrictions on their applications, and for prioritizing bigger, institutional clients.  The second wave of lawsuits saw different categories of borrowers, such as companies owned by borrowers with criminal records, companies in bankruptcy, and others, suing the SBA for excluding them from the program entirely.  Finally, the latest round of cases involve financial services firms, accountants, and other borrowers’ agents initiating class actions against lenders for the failure to pay agent fees to those parties.  These three “waves” encompass the bulk of PPP litigation to date, but there have been some lawsuits of other varieties as well, including at least one civil enforcement action by the Federal Trade Commission alleging unfair and deceptive practices.[1]

In a prior update, we described one of the first court rulings in the PPP cases, in which on April 13, a federal district court in Maryland denied relief to a borrower who had sued Bank of America for imposing its own eligibility requirements on PPP borrowers.  See Profiles, Inc. v. Bank of Am. Corp., No. CV SAG-20-0894, 2020 WL 1849710, at *1 (D. Md. Apr. 13, 2020).  The court held that the CARES Act did not authorize a private right of action for borrowers to sue private lenders, and that the Act permitted banks to impose their own lending restrictions.  Soon after, a California federal court denied relief in a similar suit, denying a temporary restraining order for borrowers alleging that JPMorgan Chase and other large banks improperly accepted PPP applications from only existing customers.  Legendary Transp., LLC v. JPMorgan Chase & Co., No. 220CV03636ODWGJSX, 2020 WL 1975366, at *2 (C.D. Cal. Apr. 24, 2020).  Although no court has yet ruled in favor of borrowers in this type of lawsuit, similar lawsuits have continued to be filed and remain pending, alleging violations of state laws.[2]

By: Neil M. Barofsky, Michael W. Ross and Ali M. Arain

On June 8, 2020—shortly after announcing the program was set to launch—the Board of Governors of the Federal Reserve (Federal Reserve) announced material changes to some of the key terms for the “Main Street” lending program.^[1]  As of June 15, 2020, months after it was first announced, the program is finally operational.

As described in our prior alert, the Main Street lending program will provide up to $600 billion in loans to small- and medium-sized businesses in order to ease the economic dislocation caused by the COVID-19 pandemic.  Federal Reserve Chair Jerome H. Powell has underscored in several recent remarks that one key goal of the program is to ensure companies can continue to support the country’s workforce.  

Since the initial roll out of the program, the Federal Reserve has continued to announce changes, new details, and clarifying FAQs, that provide important guidance to potential participants.  These include significant changes made to the program on May 27, 2020, and then again on June 8, 2020, on the eve of the program’s launch.  Understanding the changes and clarifications to the program since its launch will be crucial for companies considering submitting an application for funds.

This client alert builds on our prior alert and provides a summary of the key features of the Main Street program, highlighting changes since its initial announcement and how those changes may affect the businesses that are considering seeking relief through this program.  We encourage you to follow up with any questions or concerns.  Jenner & Block offers a wide array of resources and lawyers with experience necessary to help our clients navigate the implications of these important new programs, led by our COVID-19 Response Team.  The firm is well positioned to help our clients manage the challenging issues related to the current crisis, from applications for funds, to managing workforce concerns, to the Congressional oversight and government investigations that may accompany any such financial assistance.

To read the full alert, please click here.

Additional Contributors: Marc B. Hankin, Anna Meresidis, Edward L. Prokop, Jacob D. Alderdice and William R. Erlain

By: Kali N. Bracey and Damon Y. Smith

As data began pouring in from cities and states hit hard by COVID-19 it became clear that, even though the virus is color blind, certain racial and ethnic communities were suffering a disproportionate impact from the disease.  See, e.g., https://www.npr.org/2020/04/09/831174878/racial-disparities-in-covid-19-impact-emerge-as-data-is-slowly-released, last visited on May 5, 2020.  In particular, African Americans who contract COVID-19 have higher death rates, caused by underlying conditions and lack of access to health care.  Id.  Similarly, women- and minority-owned businesses may be disproportionately impacted by this crisis due to preexisting economic conditions such as lack of access to credit.  See, e.g., https://www.mbda.gov/page/executive-summary-disparities-capital-access-between-minority-and-non-minority-businesses, last visited on May 5, 2020.

When Congress passed the CARES Act to provide desperately needed funds to impacted industries, they waived statutory and regulatory requirements that could delay the delivery of that aid.  However, in recognition of the disparate conditions described above, Congress did not provide waivers of the Fair Housing Act, 42 U.S.C. § 3602 et. seq. and the Equal Credit Opportunity Act, 15 U.S.C. § 1691 et. seq.

The Fair Housing Act (FHA) prohibits discrimination in the sale or rental of housing because of race, color, national origin, religion, sex, familial status and disability.  With very few exceptions, homebuyers, homeowners, renters and prospective renters are protected from discrimination based on these classifications in all aspects of the financing and provision of housing.  The FHA prohibits both intentional discrimination and policies and decisions that are not intentionally discriminatory, but have a disproportionate and adverse impact against a protected class.  If a plaintiff is able to show that the disproportionate adverse impact exists, the burden shifts to the defendant to prove that there is a legitimate, non-discriminatory business need for the policy or decision.

By:  Kate T. Spelman and Amy Egerton-Wiley

Proposition 65 warnings are familiar to any business that manufactures, distributes, or supplies consumer products for sale in California. Enacted through a ballot initiative in 1986 as “the Safe Drinking Water and Toxic Enforcement Act,” Proposition 65 requires businesses to provide “clear and reasonable” warnings to consumers regarding exposure to certain carcinogenic and/or toxic chemicals identified by the California EPA’s Office of Environmental Health Hazard Assessment (OEHHA).

Recent amendments—and proposed amendments—to the Proposition 65 warning regulations purportedly seek to clarify ambiguities related to the who, what, where, and when of providing safe harbor warnings under the law. With respect to internet purchases, however, the proposed amendments arguably go farther than simply clarifying the existing law, requiring e-commerce businesses to provide multiple warnings not required of brick-and-mortar retailers.

I. Recent Amendments Addressing Responsibility for Proposition 65 Warnings

OEHHA’s most recent amendments to the Proposition 65 warning regulations became effective on April 1, 2020. These amendments clarify the roles of upstream sellers and retail sellers in providing Proposition 65 warnings to consumers.

The warning regulations previously provided that upstream sellers (including manufacturers, distributors, and importers) could satisfy the Proposition 65 warning requirement with either an on-label warning, “or by providing a written notice directly to the authorized agent for a retail seller.” This “written notice” provision created confusion for upstream businesses involved in complicated supply chains or otherwise without knowledge of the final retail seller of the product at issue. The April 2020 amendments helpfully clarify that upstream sellers are only required to provide Proposition 65 notices to their direct customers, which in some cases may be other manufacturers or distributors as opposed to retailers. The April 2020 amendments also clarify that an upstream seller may deliver such notice to its customer’s “legal agent” if that customer has not selected an “authorized agent” for purposes of Proposition 65.

By: Michael Ross and Jake Alderdice

On April 13, 2020, a federal district court in Maryland issued one of the first rulings to interpret the provisions of Congress’s Coronavirus Aid, Relief and Economic Security Act (the CARES Act), signed into law by President Trump on March 27, 2020.  At issue before the Court was whether Bank of America could be prevented from adding eligibility restrictions, beyond those in the Act, on small businesses applying for forgivable loans under the CARES Act’s $349 billion Paycheck Protection Program (PPP).  In denying relief to the prospective borrower, the district court found that the bank could impose additional eligibility criteria and that private parties were powerless to bring private actions to enforce the terms of the program.  Although just one data point, the early ruling may signal that courts will give lenders latitude in how they are carrying out CARES Act programs.

Background

Title I of the CARES Act established the Paycheck Protection Program (PPP), which provided for $349 billion in loans to small businesses.  These loans become fully forgivable if the businesses use them for certain purposes, such as maintaining their payroll.  Demand for the emergency loans quickly ate up the funding, with the entire $349 billion fund depleted by April 16, 2020, based on 1.4 million approved applications. Congress is currently debating providing additional funding for the program.

The CARES Act set out eligibility requirements for PPP borrowers, including, among others, that the businesses, with some exceptions, need to have fewer than 500 employees.  Following the program’s launch, news reports indicated that lenders were imposing additional requirements on potential borrowers, particularly to ensure borrowers had certain preexisting relationships with the lender.  In the case of Bank of America (BofA), early reports claimed that the bank required applicants to have both a preexisting deposit account and a lending account in order to apply for a PPP loan.  BofA later changed that requirement so that it only required a deposit account with the bank, and that the applicant not have a lending relationship elsewhere. BofA included simply having a credit card with another bank as a “lending relationship.”

On April 9, 2020, the Board of Governors of the Federal Reserve (Federal Reserve) announced an array of new and expanded programs designed to ease the economic dislocation caused by the COVID-19 pandemic. Together, these programs will provide up to $2.3 trillion in funding to support the flow of credit to US businesses of all sizes, individual households, and state and local governments. Although these programs in many ways mirror those established by the Federal Reserve after the 2008 financial crisis, there are some significant expansions and differences as well.

The support programs include:

• a new “Main Street” lending program that will provide up to $600 billion in loans to small- and medium-sized businesses;
• expanded corporate credit programs that will provide up to $750 billion to purchase corporate debt on the primary and secondary markets, including, in a significant departure for the Federal Reserve, debt that is rated below investment grade;
• a groundbreaking new program that will provide up to $500 billion in lending to state and local governments;
• up to $100 billion in loans for borrowers who pledge certain highly rated asset-backed securities (ABS), which will support consumer and other types of lending; and
• a new lending facility that will provide up to $350 billion in financing to banks to help them meet the overwhelming demand by small businesses for the Paycheck Protection Loans created by the Coronavirus Aid, Relief, and Economic Security Act (the CARES Act).

To read the full article, click here.

By: Tracey Lattimer

On July 25, 2019, New York Governor Andrew Cuomo signed into law the Stop Hacks and Improve Electronic Data Security (SHIELD) Act, which updates New York’s data breach notification law (as set out in the New York General Business Law and New York State Technology Law) and implements new data security requirements.  On March 21, 2020, the SHIELD Act came into full effect.

The most significant changes introduced by the SHIELD Act include:

• The types of information that may trigger the data breach notification requirements have been expanded to include: (i) in combination with a personal identifier, an account number, credit or debit card number if such number could be used to access an individual’s financial account without additional identifying information, security code, access code or password; (ii) in combination with a personal identifier, biometric information; and (iii) a user name or email address in combination with a password or security question and answer that would permit access to an online account.  (See definition of “private information” within the Act.)
• The Act introduces new data security requirements.  Any person or business that owns or licenses computerized data that includes private information of a New York resident must now develop, implement and maintain “reasonable safeguards to protect the security, confidentiality and integrity of the private information.”  The Act also sets out “reasonable” administrative, technical and physical safeguards that should be included in a compliant data security program.

The amendments to the data breach notification requirements came into force on October 23, 2019.  The new data security requirements came into force on March 21, 2020.

Under the Act, violations of the data breach notification requirements can attract a civil penalty of the greater of $5,000 or up to $20 per instance of failed notification, provided the latter amount shall not exceed $250,000 (an increase from the cap of $150,000 under the old law).  Similarly, violations of the data security requirements can attract a civil penalty of not more than $5,000 per violation (as set out in § 350-D of the New York General Business Law).

In order to comply with the SHIELD Act, companies throughout the United States that process information relating to New York residents should review the information they collect and consider whether they need to update their data protection and breach notification policies and procedures.  Such companies should also implement appropriate data security programs and safeguards as detailed in the Act.

By: Jason P. Hipp

As just one of the many aspects of New York State’s response to the coronavirus outbreak, last month, on March 21, 2020, New York Governor Andrew Cuomo issued Executive Order 202.9 (the Order), which directed institutions regulated by the New York Department of Financial Services (DFS) to provide financial relief to any person or business who has a financial hardship as a result of the COVID-19 pandemic for a period of ninety days. 

To carry out that general mandate, the Order directed DFS to ensure that “licensed or regulated entities”—which includes banks and savings banks, credit unions, investment companies and mortgage loan servicers, among others—provide to consumers in New York State an opportunity to make an application for a forbearance of mortgage payments (including principal and interest) to “any person or entity facing a financial hardship” resulting from the COVID-19 pandemic and grant such applications in “all reasonable and prudent circumstances.”  While the Order does not specify the precise meaning of the “forbearance,” when read in context of the Order as a whole, it appears to refer solely to a forbearance of mortgage payments for a consumer in New York State.  The Order also empowers DFS to issue regulations directing the restriction or modification of ATM fees, overdraft fees and credit card late fees.

The Order took effect on March 21, 2020, and, under a subsequent executive order issued on April 7, 2020, will remain in effect through May 7, 2020.

Days after the Order, on March 24, 2020, DFS issued emergency regulations implementing the Order.  Under the emergency regulations—which remain in effect for the same period of time as the Order— “New York regulated institutions” (which include both banking organizations and mortgage servicers) are required to grant forbearances of payments due on a residential mortgage for property in New York for ninety days for individuals who reside in New York and demonstrate COVID-19-related financial hardship.  3 NYCRR § 119.3(a).  Denial of such forbearance will subject an institution to a review by DFS of whether that activity constituted an unsafe or unsound practice (relying on several factors enumerated by DFS).  3 NYCRR § 119.3(f).  All DFS-regulated institutions are subject to such a review, notwithstanding language in the Order limiting the review to the practices of any “bank.”

By: Madeline Skitzki and Kate T. Spelman

As Zoom’s popularity has soared in recent weeks, the company has begun facing increasing scrutiny from both government regulators and consumer advocates.  Much of this scrutiny has focused on privacy and security concerns, including the following:

• “Zoombombing” incidents in which unauthorized individuals have allegedly hijacked Zoom meetings, often with racist or pornographic imagery;
• Zoom’s allegedly unauthorized disclosure of user data to third parties; and
• Zoom’s alleged use of transport encryption, rather than end-to-end encryption, which allegedly allows Zoom to access user video and audio content.

Government regulators at both the state and federal level have expressed concerns regarding these perceived privacy and security deficiencies.  Multiple state attorneys general, including those in New York, Florida, and Connecticut, have sought information on Zoom’s privacy practices.  Further, the Boston office of the FBI issued a warning and related guidance regarding Zoom’s privacy settings in response to reported “zoombombing” incidents.