Electronic Signature Legality for Non-profit Organizations in European Union

How to eSign a document: electronic signature legality for non-profit organizations in European Union

today we have erin mccarthy on the legal side of non-profit technology aaron is the founder of erin mccart mclarty p llc and she helps clients worldwide create the worlds they want to live in by working with businesses charities institutions and movement leaders to form structures documents and business models that reflect their values dreams purpose and mission so all done through focus healing tools community and education and i'll put the link for aaron's website as well in and with that i'll turn it over to you aaron to start things off thank you so much i know that's a mouthful so i appreciate your dedication you're welcome i will go ahead and share my screen now i'm not actually i guess i can't put it in yeah if you can put it a full screen they'll probably see there we go fantastic perfect okay and and joyce i will rely on you to let me know if anything goes wonky since i can't see literally anything right now okay okay great okay perfect so i know that we don't have that much time together everyone i won't uh spend too much time talking about myself since i had that wonderful introduction the summary if you take anything else away from who i am is i help people translate their ideas into life-changing projects programs and initiatives i am an impact architect but attorney by training and so that is why i am talking to you about the legal side today to that point here are some of the topics that i'm going to cover privacy ip intellectual property online programming fundraising and then just overall how to protect the organization however keep in mind my intention is to not or not to make you a legal expert you'll have to spend a mortgage to do that just as i did but my intention is to give you just some things to be thinking about as you were going about your day-to-day so that you could say ah you know what i remember aaron talking about this i may have a privacy issue come up or you know what i remember aaron brought this up i may have a online programming issue come up so really what i'll focus on are triggers moments where you start to think okay you know what there's there's more to this that i should be looking into and then i always tell clients the intention is not for you to know everything right and so once you know the triggers at least then you can start reaching out to the appropriate people to be thinking and co-creating solutions around or even brainstorming around what may come up so if i know i have a privacy issue i need to start talking to some people in i.t i mean you start talking to an attorney or to someone in the privacy space and so it's really more of a way of helping you problem solve then understanding what every single law is so i'll start with privacy really the trigger here is anytime you're collecting personal or sensitive information you will have yourself a privacy challenge and so when i say personal or sensitive information what's important to keep in mind is that this definition actually changes depending on the law that is applicable or that you're talking about so some people don't think that addresses or email is that sensitive of information especially since we give out email out to everyone but most laws do define emails as sensitive information it is it's just interesting how much it can change so keep that in mind when i when i say that as far as the concerns of course is keeping info private making sure that you're abiding by the laws and it matters for a few reasons so a lot of people don't know that one there are state requirements around data collection so when you are collecting email addresses and addresses and horoscope signs and all the other things that people are collecting these days there are many states that have laws around what that process has to look like because there are 50 states there are a number of different ways in which the laws are written and a number of different ways in which they require that data be collected even trickier most of these laws are what we call long-arm statutes what that means is they attach to the people and not the place so when you look at data privacy laws in california it often attaches to the people californian residents not necessarily where those residents are accessing the website or whatever the case may be in which the data is being collected this is really important because i have non-profit clients who may be in maryland who think they're only responsible for maryland law but if i'm collecting information from california or from which i think of another one pennsylvania then their data privacy laws will also likely apply with respect to those individuals and that's something that i have to be aware of not only in how i collect that data but what happens if there is a breach of that data then there's federal law to be thinking about as well can spam having contact information and opt-outs and things of that nature and then international privacy law gdpr is one that i'm sure you've heard a ton recently so thinking about that thinking about the laws in specific countries that can vary so gdpr is european union but there's laws throughout african continent that have differing requirements in terms of data collection so all of us to say the smaller the organization the more overwhelming it can be if you are a small organization collecting information you may not be able to be thinking about the entire world and its data collection requirements so what i tell clients to do is be looking at who you're collecting data from and watch for trends if we're getting a ton of signups from california maybe start to look into is california high risk which it is okay what are the things that we need to make sure that we have in place both in terms of data collection and then if there's a breach because there's often a breach protocol if we're collecting a lot from european countries then are we complying with gdpr and how information is accessible and the language that has to be in our terms of use is one way to work around all of that so when this comes up newsletters online accounts payment processing things like that is oftentimes when we need to be thinking about privacy making sure i didn't miss anything oh also keep in mind that many of the state laws and sometimes federal around privacy have protections so if you have a minimum standard of protocols or protections in place then they kind of give you the benefit of the doubt and say you know what hate the player not the game not your fault we get it so we're not going to penalize you on this level but we're going to ask that you go through the following to make sure that everybody's a-okay but that only applies if you have the minimum level of protections all that to say not doing something is not an option do something right and then again look at where you're collecting that data to see what is the minimum protection that we need to have in california versus the minimum protection versus in in under gdpr get those in place that you can avail yourself of those it's called safe harbors so protections for at least trying to protect people's people's data intellectual property is a biggie this comes up anytime you're creating or using content and it's really a concern in terms of ownership licenses limitations that you need to be aware of and making sure that you don't infringe someone else's intellectual property so where this comes up is let's say i have someone who is developing blog posts for my website a lot of organizations forget i don't own the copy that they develop legally technically copyright is goes into the author right now there is work made for hire and there's a whole thing around that to be safe if i want to make sure that i own the blog posts and i can use the blog posts in any way that i want i need to have some type of arrangement written arrangement with the person who's drafting that either giving me ownership outright under the work made for hire or i need to make sure that i have a license to use it if i don't have a license and i don't have ownership but i use those blog posts i'm technically infringing that person's right they may not say anything now but where this can be problematic is relationships can go sour and in the future if this person decides they want nothing to do with me they can say you know what take all my content down i want nothing to do with this take it down i'm taking it back and i'm giving it to these other people which they have every right to do if they have ownership so if you are having content developed for you and you want to make sure that you are able to use it in ways that are appropriate for the organization putting in its newsletters sending it out to donors etc make sure that you have something in writing that outlines what that relationship is supposed to look like to that same end when i am allowing people to use my information my branding and things of that nature there needs to be a license in place to make sure that i'm protecting all of my intellectual property a problem or what the problem can be is if i don't do that not only am i making myself at risk for abandonment that basically means i lose my rights in my intellectual property my branding because i didn't protect it but it also just allows other people to infringe on it so anytime you are allowing platforms partners etc to use your logo to use your name any content of yours there should be some type of license agreement in place and basically in that all you're saying is you can do this you can't do that you can do this you can't do that and you go from there as far as why it matters you want to make sure of course that you're on the right side of any federal and state laws around intellectual property and then you also just don't want to be in breach of any type of contracts that you have around intellectual property making sure i covered everything here as far as protecting yourself as i said make sure that you're papering everything if you're having a logo developed there needs to be something in place that addresses your ownership of that logo a lot of my non-profit clients have no idea how little they own because they didn't get paper in place you may be thinking oh no i have all these things i don't have paper in place for you can always go back and get it right so if i have anyone developing a database websites is especially important i can't tell you how many people i know who have been held hostage under their websites where they had a creator them and the creator started to have a falling out the creator changed the passwords now the nonprofit doesn't have any access to the website this is i've seen this happen dozens and dozens and dozens of times so that's that's why it's really important if you have ownership of that as it's being made if you have the passwords if you if all of that is written out in writing then there's more of a route toward making sure that you you continue to have accessibility than there isn't if you don't if you don't own it and then you can also just think about a policy having a policy when i say policy because i know so many of the organizations i work with have a smaller team that can truly be half a page it doesn't have to be an illuminated bible in terms of link but just having some type of policy for your team in terms of hey guys or hey all when you have things developed make sure you have these contracts in place make sure you're getting this language in there and that we own it or that we have the right to market and reproduce and publish and all the other magic language that you have to have from a legal perspective can help out a ton online programming so everyone with the covet restrictions is turning their programming online which is incredibly helpful as you are doing that be reading your terms of use you may be surprised by how many rights they plot or maybe you're not but you may be surprised by how many rights a platform is reserving for themselves through your use of their platform so for example do they have a right to reproduce your content whenever they want however they want without asking you most platforms do and so that may be great if they have a great audience and you don't mind but there i have seen situations where platforms have ized to be frank and because so many of my clients my non-profit clients in general are working with vulnerable populations that's something that we have to be vigilant about and so there may be a use that a platform has that you don't necessarily feel comfortable with and you want to make sure that you're aware of that possibility and any possibility to opt out if if you want ahead of time so reading those terms of use both in terms of the general terms of use privacy policies that they have on the website and then any specific terms of use they may have the product you're using is going to be really really important also seeing what your ownership rights are i have started to see some platforms that have ownership rights over content generated through that platform crazy i know that can be really problematic if you end up getting locked out you don't pay they lock you out of the account whatever the case may be and so reading all that and making sure that you're clear as you go online as to what the rules of using those platforms are is going to be really really important as you start using software a little bit differently also be keeping that in mind so if we have a certain amount of software license seats are we using more than what we've purchased if we only have one seat and by seat i mean basically one right we bought a license for one person but now we've got 10 people using it because we're all working from home when you true up those licenses that may get really expensive with penalties so just be aware of that and making sure that you are paying for what you're you're you're using and then of course making sure that you have protections in place against hackers especially when you're working with vulnerable populations there's been a lot of instances of the zoom bombing bombing on other platforms there's been examples of eavesdropping on vulnerable populations and so having those protections in place is going to be really important and as far as online fundraising let's see i'm checking my time okay five minutes as far as online fundraising just making sure when you're soliciting funds one we're keeping in mind that each state has its own laws around solicitation less of a tech issue more of a just logistics issue but i bring it up because a lot of organizations don't know or don't remember that you know i have to register in california before i can ask people for money in california i have to register in georgia before i can ask people in georgia for money what does that look like is it can it be passive can it be active each state is different so for some states merely just having a website that asks for money that a citizen happens to donate to is enough for it to trigger their requirements around you um in their doing their solicitation registration for some states you have to be super active so that means reaching out to people having fundraising campaigns emailing people directly where this can become tricky is let's say it's a state that requires an active solicitation i may have them donate to my site i add them to my database the next year or my end of year campaign then i email them now i've triggered the active requirement without even knowing it so just being aware of those things making sure that you're registered similar to the information collection you may not have the capacity to do that for everyone and so just trending to see who you're getting information or or in that case fundraising from is going to be important because if you don't then there's there might be some fines and penalties as far as protecting the organization i've kind of talked about this generally just making sure you have workflows and approvals that you look into the laws because ignorance is not bliss trust me and develop policies and even templates you know ahead of time especially when you are contracting people to do things for you because if you have the contract templates then you can already have that language that you need in there around licenses and use and things like that to make sure that your bases are covered so i'll stop their breathless to see if there were any questions before i closed out because i know we have just a couple minutes left uh joyce drawing are you talking to me or a mute yeah no question so far but if folks have questions please feel free to add them in in chat you know i guess for those who are doing you know you were just talking about donations across and donations are such a tricky thing because as you said folks might not might be getting them in from states that they're not even necessarily know what they're triggering for that like do you have any more broad advice beyond like or other advice beyond that for you know for that sort of situation i think that would be good in terms of the fundraising yeah yeah because i think that's something that there's people who do okay come up for them so there are people who do it they can be expensive i guess i think the best thing is to just be looking at your platforms to see who is donating and then if i see that i have a significant amount of people coming from new york then i know i probably need to look into new york's law there are some websites from the donation perspective that will tell you what the most stringent states are and so california is definitely one new york is another one texas is a little bit more on the more lenient side being aware of those states is also helpful so that if you see them coming up then you can be thinking proactively i know i saw a couple of questions so of course as the attorney i have to give the disclaimer that none of this is legal advice should i give that up front but i bring this up because i see the mention of the templates be very careful of course i always have clients just put several of their agreements that they need to gather for cost saving measures because i can't tell you how many template driven templates i've gotten and it has new zealand law or it has language in it that the client didn't really understand but was totally opposite to what they needed and actually hurt them so i would never use something that was developed for someone else for myself without fully understanding what the language is in that even having an attorney review it just to make sure that there's nothing in there that's going to hurt you it's probably going to be really really important harbor compliance is a great website someone just mentioned in terms of the restrictions that's one of my one of my favorites and then someone asked about the don't house or house don't house or host outside that was merely to say try to keep everything internal that you can because the more that you have externally hosted outside of your control the more likely it is that you may have a liability issue come up if their protocols are not as stringent as yours any other questions we still have a few minutes oh do we okay that's why i'm like running through this because my time i wasn't i wasn't sure you still have time so if there's anything else you want to go into or a little deeper that's fine too awesome [Music] privacy policy so there are depots again template depots for privacy policies what i like to say is look at some of your favorite platforms to see what they've included because i have had clients do that and i've said look and see what these people have in theirs that we need to make sure that we cover in your privacy policy and then we put their privacy policy together you know the range in terms of how much it can cost can be anywhere from maybe 500 to i don't know if i would pay a thousand but they i mean if it's long it can get to that point i cannot tell you how much how helpful that 500 to 1 000 is and usually you can do them in a package right so it's your terms of use your privacy policy and because of gdpr people do a cookie policy and your dmca policy and all of that so get all of that done together and out the way because again i've just had clients that have put language in their templates that they didn't understand that end up shooting them in the foot and that's not what we want to do so jane uh has a question too should not probably be concerned about the websites being accessible for people with disabilities from a legal perspective so businesses get sued frequently what about nonprofits absolutely i that's a great question so just from an equity perspective absolutely an inclusivity perspective absolutely from a legal perspective which i appreciate the differentiation you know nonprofit is a business and so ada and all the other requirements absolutely apply to nonprofits similarly the enforcement in some states may be different uh but there's definitely this myth of and i'm not saying this is jane but i have it in my own clients where they say well you know because i'm doing good but they kind of give me a break some states will some states especially around seasons like this want to make an example of organizations and that can include even small organizations so the technology can get expensive sometimes commercially reasonable efforts is usually what people are asking for so looking to see what sources partnerships are great to this end working with nonprofits that work with those along the physical spectrum will help with finding some of the free platforms that do allow for your websites to become more accessible for those who may be physically chat we partner up with organizations that work with those respective populations because they know about the different apps and things that i can use for clients that are more cost effective than some of the larger business oriented interventions that get used or i hate to say business because non-profits are business but you know what i mean and suzanne had a question about do you have any advice on electronic signature policies which i imagine is very important in covent times you know it's so interesting so one of the reasons why that was so important years ago is because most states didn't allow for electronic signatures and many i think texas no i think we did adopt one um many still don't because it's just kind of a given what i would say is and this is putting on my hat for when i was what a fortune 500 company one of the biggest issues with the electronic signature is just fraud right and forgery so just having something quick that talks about that if you allow others on the team to use an ed signature you'll absolutely want a policy for that i wouldn't recommend it but i know it's a practice that is used especially for smaller teams so having a process around what that looks like apps like adobe which is maybe twenty dollars a month will actually have a chain of command that that has to go through and so there's some apps that that in addition to a policy will create workflows that ensure security and permissions and so if someone was to use my signature i would actually get deemed i'd have to approve then the signature gets applied to the contract and so looking into some of those would probably be helpful as well but it's ironic i wouldn't say that the electronic is as important as it's historically been outside of just making sure that folks aren't using electronic signatures all really willy-nilly and jane added in should nonprofits get some uh sort of insurance to protect them in case they are sued for uh defamation libel how affordable is this and where should they look for that no and i appreciate the ringer question jane yes i have a lot of accessibility advocate friends so i'm i am learning myself so yes i would get insurance there's a number of different things to be thinking about with insurance and then of course i appreciate the question about affordability because they can get expensive so you know cyber insurance is becoming a biggie for some organizations especially those that are collecting a lot of information that may be something to look into in addition to that you do have board insurance you do have insurance for arizona missions if we're consulting and then of course as mentioned there's there's insurance around defamation liable what i would do is i would look at programmatic activities of the organization what is the highest risk there's always a few activities for my ads that keep them up at night looking at those activities then i would start to look at insurance policies it's not to say that the others aren't as important but i would definitely prioritize i would also prioritize in terms of risk and exposure so you know if we're not on the computer a lot if we're not asking for a lot of information and the cyber policy may not be as important right now as having board and officers insurance for example or having some type of arizona admissions insurance for our staff or vehicle insurance for our fleet if we have staff who are doing a number of different things so it really just depends on that travelers is a great one that i hear a lot of my non-profit clients bring up cdfi's i've noticed the community community foundation no community financial development institutions we're going to get there somewhere cdfis are a great resource for insurance now for communities more often than not and they usually are very accessible in terms of pricing if they don't have an insurance vehicle they usually have a partner that they're working with so i've had some of my clients go through them as well and would look into would look into those i know there was a question about ip policies on agreements for ips so again as far as the policies themselves there are a couple of websites like lexology that are mostly for attorneys but every now and again because they're they're all attorneys that write these they'll have policies and things that they post following things like that so lexology l-e-x-o-l-o-g-y and jd supra j-d-s-u-p-r-a both have resources that come out from attorneys it can be a lot of legalese but they have great resources that are usually free so that's that's a good one to look at i'm hesitant to recommend again some of the depots because i've read through them and not everyone gets their stuff checked and so not everything is of the same quality but starting i think with with some of these legal sites and seeing what they talk about and what they're bringing up as legal issues is a great start you're also going to have more better vetted information than we would with like an ask core or some of the other resources that i know a lot of clients like to use oh so wrapping up the three minutes so is any final comments erin i mean i guess anything that you've seen that have popped up maybe during covid that have been questions or concerns i know that's a big question but since we have just like a a few minutes yeah absolutely i'm glad you asked because i'm looking through making sure with my notes i covered everything so one that i would keep in mind is as people are trying to engage with folks offline or online more often be careful what information you're asking for do we need blood type you know there's i i fill out so many forms from non-profits where there's just a thousand different questions and i wonder do you even really use any of this because again the more information you collect the more exposure you're creating for yourself and then if there is a hack that's more liability you have with respect to the gravity on the spectrum of really kind of okay bad and really really really fast just being careful with what you asked for you know to the extent that something is not your expertise like credit processing and you're asking for information for that purpose then using one of the biggies is going to be important make sure that you have disclaimers on your website and disclaimers in your agreements with users around a third party so blacks was it blackstone i think it was or black bowed had the really big ip breach of their uh system nonprofits can often be responsible for that because they were the ones that gave blackout the information and so having something in your terms of use you often see this where it says we are not responsible for the policies procedures or actions of any third party site that you access through us or credit processors that we use in this case donation platforms that we use is also going to be really really important and then of course be careful with any social media and sweepstakes there are very specific laws that the ftc has around ads sweepstakes that have to be included in the body of the language there is a pdf that they've created for influences but really applies to everyone that uses social media for sweepstakes and contests and things like that so make sure you download that and that you're aware of what those laws are so with that we can wrap and and thank you aaron and for this this has been i think very insightful and hopefully helpful for everybody in the audience