Categories
Blog

What’s Under Your Hood? The CCPA and Compliance

California’s privacy agency, the California Privacy Protection Agency (CCPA), targeted design features and contracting policies used by many companies in its inaugural enforcement strike under the state’s data privacy law. This demonstrates a “broad regulatory approach experts say promises to heat up as the agency continues to mature.” In an article in Law360, author Allison Grande looked at the recent enforcement action against American Honda Motors Company (Honda).

California’s recent privacy enforcement action against Honda has made headlines, and rightly so. This inaugural move by the California Privacy Protection Agency (CPPA) sends an unmistakable signal to corporate compliance professionals: it’s time to examine data privacy practices closely or risk significant consequences.

The CPPA’s allegations against Honda were not industry-specific; instead, the allegations highlighted universal challenges and concerns around data privacy practices and compliance that apply broadly across sectors. Why should compliance professionals sit up and pay close attention?

Firstly, consider consumer data requests. Honda faced scrutiny for requiring excessive information from consumers exercising their privacy rights, specifically when opting out or limiting data use. This nuanced point underscores a critical compliance lesson: not all privacy rights are equal, nor should they be managed uniformly. Compliance teams must tailor their mechanisms, perhaps even developing distinct web forms or processes, to differentiate between requests requiring identity verification and those not.

Grande quoted Gregory Leighton from Polsinelli PC, who said, “Once there’s an investigation open, the CPPA will clearly look at everything.” An open investigation invites regulators to scrutinize every aspect of your compliance program. Compliance teams need robust processes and airtight documentation to withstand such scrutiny.

Secondly, the issue of “symmetry in choice” came into sharp focus. Honda was flagged for making it more straightforward for users to activate advertising cookies than turning them off, a seemingly minor point with significant implications. It emphasizes that regulators now view user experience in data privacy tools through a strict compliance lens. A two-step process for disabling versus a one-step process for enabling cookies was enough to trigger regulatory criticism. Compliance officers should revisit user interfaces of consent management platforms and cookie notices, ensuring equal simplicity in opting both in and out.

Another critical compliance takeaway surrounds vendor management and contract documentation. Honda stumbled by not swiftly producing its contracts with third-party advertisers. This illustrates vividly that having contracts isn’t enough; immediate access and retrieval capability are equally crucial. Grande quoted Lily Li of Metaverse Law, who noted, “The Privacy Protection Agency was looking under the hood,” spotlighting the importance of being compliance-ready regarding documentation.

Beyond immediate lessons, this enforcement marks a new maturity stage for the CPPA. The agency’s stringent interpretations mean past assumptions about compliance, such as the adequacy of generic, broadly used privacy forms or common consent tools, are being upended. Compliance teams should anticipate increasingly rigorous scrutiny and proactive enforcement stances from regulators.

Lisa Sotto, chair of the global privacy and cybersecurity practice at Hunton Andrews Kurth LLP, summarized her thinking, indicating California’s regulator’s growing maturity and stringent interpretations. Similarly, Travis LeBlanc from Cooley LLP emphasizes that this enforcement action has broader implications for any company engaging digitally with consumers, highlighting the CPPA’s widening lens.

Adding to the urgency is the CPPA’s leadership transition. The incoming executive director, cybersecurity veteran Tom Kemp, signals a future of heightened enforcement activity. Kemp’s background and commitment to stringent enforcement strongly suggest a proactive regulatory stance.

Compliance professionals must recognize that federal pullback on data privacy regulation will likely spur increased state activity. California’s actions could be the vanguard for similar initiatives in other states. Manatt’s Brandon Reilly notes the completion of rulemaking and transition toward increased enforcement activities at the CPPA, predicting a significant uptick in regulatory actions.

In short, compliance teams must prioritize several key actions to remain ahead of this regulatory curve.

  • First, differentiated handling for various privacy rights requests is crucial. Compliance teams need precise frameworks and targeted methodologies to distinguish between requests that necessitate identity verification and those that do not, ensuring effective and compliant processes.
  • Second, ensuring symmetrical ease in privacy-related user choices demands careful evaluation of user interfaces and consent management tools. Regulators will increasingly expect businesses to offer equally simple options for consumers to turn data-sharing functions on or off, emphasizing intuitive design and fairness.
  • Third, rapid accessibility and comprehensive documentation of third-party contracts have become imperative. Compliance teams must establish contractual arrangements with vendors clearly defining data handling and protection standards and maintain them in an organized, readily accessible manner to respond swiftly to regulatory inquiries and investigations.

The CPPA’s Honda is not simply California-specific but a wake-up call nationwide. Compliance professionals must heed this signal and review and reinforce privacy programs proactively. As Leighton warns, the enforcement action is likely “just the tip of the iceberg.” Now is the time for compliance to look deeply and proactively under their data privacy hoods.

Categories
Corruption, Crime and Compliance

[Replay] Carlos Villagran Discusses Rebuilding a Corporate Culture After a Corporate Crisis

This week, we are pleased to bring you one of our most popular episodes of 2024. Please enjoy, and we will be back next week with more insights from the Corruption, Crime, and Compliance podcast.

Carlos Villagrán is the Director of Compliance at CMPC, a 100-year-old Chilean-based holding company, one of the leading manufacturers of pulp, paper, packaging, personal care, and other forest products worldwide. With over 20,000 employees, CMPC has industrial operations in 9 countries (LatAm and the US) and commercial offices in the US, Europe, and China, selling and distributing its products to more than 45 countries worldwide. Carlos joined CMPC to remediate and rebuild CMPC’s culture and compliance program after a devastating scandal — CMPC was prosecuted for its involvement in a decade-long conspiracy to fix prices in Peru and Chile for consumer paper products. Carlos discusses the challenges in rebuilding CMPA’s culture and his commitment to compliance. His story inspires all legal and compliance professionals and provides important instructive lessons to corporate leaders and compliance professionals.

You’ll hear Michael and Carlos discuss:

  • The importance of rebuilding and rediscovering the values and purpose of CMPC after a major corporate crisis.
  • The effects on market share quotas and sales prices when CMPC was investigated and was found to be the leader of a cartel in Chile and Peru.
  • How the crisis significantly impacted CMPC’s reputation, leading to public protests and consumer backlash in Chile and Peru.
  • CMPC’s compliance team addressed the company’s complex nature because of its diverse workforce, including data analytics experts, IT professionals, and engineers.
  • How the compliance program at CMPC shifted from a traditional approach to a more cultural and system-thinking perspective, aligning with the company’s values and operations.
  • Success for the compliance program at CMPC is defined by the number of critical tables the team is seated on, indicating their value and integration within the business operations.

Resources:

Carlos Villagran on the Web | LinkedIn

Email: carlos.villagran@cmpc.cl or cfvillagran@gmail.com

Michael Volkov on LinkedIn | Twitter

The Volkov Law Group

Categories
Daily Compliance News

Daily Compliance News: March 31, 2025 the Mickey Mouse Under Investigation Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance brings to you compliance related stories to start your day. Sit back, enjoy a cup of morning coffee and listen in to the Daily Compliance News. All, from the Compliance Podcast Network. Each day we consider four stories from the business world, compliance, ethics, risk management, leadership or general interest for the compliance professional.

  • Charlie Javice found guilty. (WSJ)
  • Chinese ABC investigator caught up in corruption probe.  (South China Morning Post)
  • US presses French companies to stop DEI.  (NYT)
  • Disney under investigation for DEI. (BBC)
Categories
FCPA Compliance Report

FCPA Compliance Report – Gerry Zack Reports on the OECD Global Anti-Corruption and Integrity Forum

Welcome to the award-winning FCPA Compliance Report, the longest-running podcast on compliance. In this episode, Tom is joined by Gerry Zack, CEO and Founder of RiskTrek LLC, to discuss his recent attendance at the OECD Global Anti-Corruption and Integrity Forum in Paris.

Gerry provides an in-depth event recap highlighting significant presentations, panel discussions, and key takeaways. Topics covered include the current state of anti-corruption efforts, the international cooperation among governments in combating corruption, and the evolving role of compliance programs amid changes in U.S. enforcement policies. He also shares insights on applying artificial intelligence in compliance, the importance of building trust through compliance programs, and the unique challenges faced in the healthcare and private equity sectors. The episode underscores the forum’s overarching theme of innovation and the proactive steps needed to navigate a turbulent compliance landscape.

Key highlights:

• Structure and Highlights of the OECD Conference
• Key Themes: Compliance and Anti-Corruption
• Global Collaboration and Government Responses
• Incentives and Value of Compliance Programs
• Trust and Technology in Compliance
• Data Analytics and AI in Compliance

Resources:

Gerry Zack on LinkedIn

Gerry Zack’s Email: Gerry@risk-trek.com

RiskTrek LLC

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
All Things Investigations

All Things Investigations – Mike DeBernardis on Considerations for FCPA Trials

Welcome to the Hughes Hubbard Anti-Corruption & Internal Investigations Practice Group’s podcast, All Things Investigation. In this podcast, host Tom Fox is joined by HHR partner Mike DeBernardis on the considerations of trying an FCPA case.

Tom and Mike deeply dive into the complexities of preparing for and trying an FCPA case. It includes negotiating with corporate and individual clients involved in criminal cases. It is often easier to convince corporate clients to cooperate with government entities and engage in negotiation processes. Conversely, individual clients, driven by strong convictions of their innocence, can be resistant unless negotiation results in a non-prosecution decision. We highlight the challenging conversations defense counsels must have with individual clients regarding realistic outcomes, including discussing the strengths of the prosecution’s case and potential plea deals. Establishing early discussions about acceptable outcomes and strategies is vital to navigating these difficult negotiations.

Key highlights:

  • Corporate vs. Individual Clients
  • Challenges in Defense Counsel
  • Discussing Plea Deals
  • Importance of Early Negotiation

Resources:

Mike DeBernardis

Hughes Hubbard & Reed Website

Categories
Blog

Compliance Lessons from Sales Incentive Pitfalls

When the scandal broke around Wells Fargo’s sales incentive manipulation, it became clear that incentive structures weren’t just about motivating employees but also fertile ground for ethical missteps and compliance failures. The recent article by Timothy Gardner, Colin Wong, and Rick Butler, entitled How Salespeople Game the System in Harvard Business Review, sheds crucial light on this, offering a timely reminder for compliance professionals about the latent risks embedded in incentive-driven strategies.

Salespeople often exploit incentive programs to maximize their gain through various schemes, damaging company performance and putting the company at legal risk. The authors identify common cheating tactics, including sandbagging, falsifying data, and giving excessive discounts or incentives to close deals quickly. To counter these practices, companies should use data to detect irregularities, revise incentive plans to close loopholes and establish ongoing monitoring. Communication and education about acceptable behaviors are also crucial. Not all gaming tactics need immediate action; however, some may be tolerated if they have a minimal impact on performance and would cause undue disruption to the sales organization. Compliance professionals should adopt a continuous process to identify and mitigate cheating while balancing the need to maintain sales productivity and motivation.

Understanding the Landscape

From Wells Fargo’s notorious misconduct to Vivint Smart Home’s identity theft case, examples abound of sales incentives fostering environments ripe for unethical practices. Sales professionals, driven by quotas and commissions, employ an array of tactics—from sandbagging, where sales are delayed strategically to maximize later bonuses, to outright fraud, such as creating faux customer accounts.

The authors identified eight incentive gaming categories, offering corporate compliance teams a powerful diagnostic tool. These include:

  1. Sandbagging. This technique involves postponing the completion of sales to a later measurement period to optimize incentive earnings. The authors found that “some sales reps at his company would hold as many orders as possible from October through December and submit them in January. The extra sales translated into outstanding sales performance and a very high commission for far exceeding established quotas.”
  2. Partners in profit. This is a particularly dangerous fraud in which the BD folks will “team up with customers to manipulate company processes to secure a better deal for the customer and a higher bonus for themselves.” The authors heard “about personal bankers who coached customers to sign up for accounts to take advantage of promotional deals (earning the bankers a commission) and then close the accounts at the end of the promotion.” This was similar to the Petrobras FCPA bribery scheme.
  3. Squandering sales. This tactic involves misleading customers in ways that benefit the salesperson but not the organization or the customer. The authors cited the following example: “Sales reps would give customers discounts to upsell them to unneeded service levels to earn the higher commission associated with the higher service tier. Though the salespeople came out ahead, the upsell hurt the organization’s bottom line and the customers: The company paid out a higher commission as a result of the upsell, and the customers ended up paying more for unwanted, higher-tier services, possibly resulting in customer dissatisfaction and defection.”
  4. Lost in segmentation. Another FCPA latent risk is where BD folks will “game the system by focusing their efforts on buyer segments that provide greater opportunities for incentive payouts instead of the targeted segments favored by the company. One interviewee told us that this was common among customer service associates (CSAs) who were responsible for both inbound sales-and-service calls and outbound sales-only calls. The CSAs would avoid accepting the incoming calls to maximize the time they could devote to the outbound calls, thereby earning more commissions.”
  5. Carrot and stick. Salespeople may use rewards, promises, threats, or punishments to encourage customer behavior that maximizes incentive payouts. At one airline, “some agents offered to waive baggage fees for customers during check-in if they signed up for the airline’s credit card, thus earning themselves a generous bonus.” This was a Wells Fargo tactic.
  6. Misleading customers. This tactic involves misleading prospective customers or withholding information to move the sales process forward. An example cited by the authors was where sales “reps would falsely tell call-in customers that the transaction couldn’t be completed on the phone and encouraged them to meet with a financial adviser, which yielded them higher bonuses for in-house referrals.”
  7. Falsifying data. Another tactic with criminal overtones. Under this scheme, a “sales management system is fed false information or information is omitted to maximize incentive payouts. In one interview, we heard that sales reps often log in to sales management systems and add their names to deals they did not participate in to increase their bonuses.”
  8. Faux customers. Well Fargo redux. Here, sales folks create “fake customer accounts with the help of friends, relatives, or coworkers.” Simply fabricating accounts is also a common gaming tactic. Some sales reps ask friends to pose as buyers, one interviewer told us. After the rep receives the commission for the “sales,” the phony customers cancel their service.

While varying in severity and potential impact, each of these strategies has the potential to compromise organizational integrity and compliance standards. Therefore, compliance leaders must remain vigilant in recognizing these behaviors and preemptively addressing the conditions that allow them to flourish.

Anticipating Incentive Program Vulnerabilities

Compliance teams can learn from these sales incentive pitfalls by proactively thinking like unethical sales professionals—an approach Gardner, Wong, and Butler dub cultivating an “immoral imagination.” Such foresight enables compliance leaders to anticipate and identify incentive plan vulnerabilities before they manifest into actual misconduct.

For instance, organizations should routinely engage trusted leaders and experienced sales professionals to evaluate incentive plans critically. Using the typology as a checklist can spur proactive identification of potential loopholes and gaming opportunities, informing targeted policy enhancements and strengthened monitoring protocols.

Data-Driven Monitoring and Audits

A robust compliance monitoring infrastructure is central to preventing sales incentive exploitation. Auditing systems for irregularities is critical. This includes tracking sales timing, examining customer account patterns, and monitoring behavior like customer misdirection or misinformation. Companies that successfully curtail gaming implement sophisticated tracking and analysis systems capable of flagging suspicious activities for further investigation.

The authors highlighted instances where systematic auditing effectively detected fraudulent behaviors. A notable example includes a financial institution auditing deposit account closures to identify employees creating fake accounts to artificially boost commissions. The swift identification and termination of those involved prevented further ethical breaches and preserved organizational integrity.

Refining Incentive Plans with Clear Guidelines

Beyond monitoring, refining incentive plans to eliminate ambiguities and clearly articulate acceptable behaviors is imperative. Policies must explicitly outline ethical boundaries and the consequences of transgressions, including incentive clawbacks, disciplinary actions, and potential termination.

Gardner and his co-authors advise that companies embed explicit language prohibiting unethical behaviors and reinforce these through regular training and communication, emphasizing transparency and accountability. The case they presented, involving airline agents improperly waiving baggage fees in exchange for credit card sign-ups, underscores the importance of clear, enforceable policies and vigilant enforcement.

Strategic Communication and Ethical Culture

Communication is the bedrock of any robust compliance strategy. Sales teams need ongoing messaging about ethical standards and incentive program expectations. Establishing an open dialogue around compliance and ethics, including discussing discovered instances of misconduct, helps embed integrity deeply into organizational culture.

Leaders must foster a culture where ethical conduct is the norm rather than the exception. Regular compliance training, reinforced by real-world case studies like those discussed in the Harvard Business Review article, can significantly enhance sales teams’ ethical vigilance and deter potential gaming behaviors.

The Decision to Act or Tolerate

The authors noted that not all incentive gaming is equally damaging or requires immediate rectification. Some minor gaming activities, such as strategic timing of sales submissions, may present minimal risk or impact, suggesting that addressing these issues aggressively could inadvertently disrupt sales operations or morale. Hence, compliance professionals must judiciously evaluate the potential ramifications of intervention versus strategic tolerance.

Concluding Thoughts for Compliance Leaders

Incentive-driven environments inherently contain risks. The complexities and competitive pressures on sales professionals often create scenarios tempting unethical shortcuts. However, compliance leaders can significantly reduce opportunities for unethical behavior with strategic vigilance—anticipating risks, implementing rigorous monitoring, maintaining clear and enforceable incentive guidelines, and fostering an ethical culture.

The insights from this article offer a timely, instructive framework for compliance professionals tasked with overseeing incentive-driven business units. Understanding how incentive systems can be exploited becomes a powerful asset in our ongoing mission to uphold ethical standards, protect corporate integrity, and ensure sustainable business success as we continually adapt and refine our compliance strategies.

Categories
Sunday Book Review

Sunday Book Review: March 30, 2025, The Information Systems Edition

In the Sunday Book Review, Tom Fox considers books that would interest the compliance professional, the business executive, or anyone who might be curious. These could be books about business, compliance, history, leadership, current events, or anything else that might interest Tom. Today, Tom Fox looks at four 2024/25 books on information systems.

  1. Knowledge Management by Irma Becerra-Fernandez, Rajiv Sabherwal, and Richard Kumi
  2. Management and Information Technology after Digital Transformation, edited by Peter Ekman, Peter Dahlin, and Christina Keller
  3. Managing Information Technology 2nd Edition by Francisco Castillo and Korina Monoso
  4. Business Information Systems by Paul Bocij
Categories
Because That's What Heroes Do

Deep Space 9 – Episode 26: Til Death Do Us Part and Unraveling Complex Relationships in DS9

Get ready for an exciting new season of Because That’s What Heroes Do. This season, they take a deep dive into their favorite episodes of Deep Space 9. In this exploration, Tom and Megan are joined by Star Trek maven Alex Murphy (Murphy) from Montreal. Murphy is a local historian, cinema, and TV fan with a love for weird foreign films, all things horror, and obscure media. He has been watching Trek since he was a tiny punk, and it’s been a lifelong love.

In this episode, the team concludes by exploring the introduction to a new character for DS9’s final season and reviewing the episode Til Death Do US Part. They dive into the intricate relationships and transitional plot points of a particularly romantic yet unsettling episode of DS9. We discuss major developments such as Dukat’s infiltration of DS9, Damar’s new leadership role among the Cardassians, and the complex dynamics between Ezri and Worf following their ill-advised hookup. The conversation touches upon profound moments of character introspection, especially with Kai Wen and her interactions with Dukat. Murphy highlights Quark’s emotional depth and the evolving narrative arcs while exploring the impacts of these character developments within the broader DS9 storyline. Join us to uncover the intertwined fates and emotional struggles that drive this pivotal episode forward.

Key highlights:

  • Romantic Entanglements and Character Dynamics
  • Kai Winn and Dukat: A Controversial Pairing
  • Ezri and Worf: Youthful Mistakes
  • Sisko and Kasidy: Prophecy and Struggle
  • Dukat’s Manipulations and Damar’s Downfall
  • Quark’s Heart and Ferengi Values

Resources

Megan Dougherty

LinkedIn

One Stone Creative

Twitter

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Kerrville Weekly News Roundup

Kerrville Weekly News Roundup: March 29, 2025

Welcome to the Kerrville Weekly News Roundup. Each week, veteran podcaster Tom Fox and his colleagues Andrew Gay and Gilbert Paiz get together to go over a couple of their favorite stories from the past week from Kerrville and the greater Hill Country. Sit back, enjoy a cup of morning coffee, and listen in to get a wrap-up of the Kerrville Weekly News. We each consider two of our favorite stories and talk about the upcoming weekend’s events, which we will enjoy or participate in this weekend.

In this episode, Tom takes a solo turn to look at some of the stories that caught their attention over the past week.

Stories include:

  • BESS protests in Harper
  • Rain and hail damage in Kerrville
  • Watch out for scammers on roof repair in Kerrville
  • David Jones named to Schreiner University football team staff
  • New AD at KISD and head coach at Tivy

Resources:

Tom Fox on LinkedIn

Gilbert Paiz on LinkedIn

Andrew Gay on LinkedIn

Texas Hill Country Podcast Network

The Lead

Kerrville Daily Times

Categories
10 For 10

10 For 10: Top Compliance Stories For the Week Ending March 29, 2025

Welcome to 10 For 10, the podcast that brings you the week’s Top 10 compliance stories in one podcast each week. Tom Fox, the Voice of Compliance, brings you the compliance professional and the compliance stories you need to know to end your busy week. Sit back, and in 10 minutes, hear the stories every compliance professional should know from the prior week. Every Saturday, 10 For 10 highlights the most important news, insights, and analysis for the compliance professional, all curated by the Voice of Compliance, Tom Fox. Get your weekly filling of compliance stories with 10 for 10, a podcast produced by the Compliance Podcast Network.

  • Will Habba go to trial in the Cognizant Tech execs case?  (NY Post)
  • Boeing was sued for the wrongful death of a whistleblower. (WSJ)
  • Even Bloomberg says to enforce the FCPA. (Bloomberg)
  • The House speaker says Congress can eliminate district courts. (Reuters)
  • What is the fire risk for your business? (NYT)
  • Judge orders Boeing to trial. (WSJ)
  • Mintz’s staff was freed after 2 years in Chinese jail.  (BBC)
  • Blatter and Platini were cleared of corruption charges. (Reuters)
  • Target DEI flip-flop costs. (Bloomberg)
  • Nadine Menendez’s: From Under the Bus to ‘Mon Amor”. (Bloomberg)

You can check out the Daily Compliance News, which features four curated compliance and ethics stories each day here.

Connect with Tom 

Instagram

Facebook

YouTube

Twitter

LinkedIn