The EU’s General Data Protection Regulation (GDPR) can feel like a burden to your credentialing organization, but it’s imperative to stay compliant. This article by GKG Law's Oliver Krischik will help you navigate the challenges your organization may face when requesting and obtaining information.

Credentialing bodies collect information such as the name, address and occupation of people applying for certification. If an organization accepts such information from residents of countries in the European Union (EU) or operates a branch office in the EU, the organization may be subject to the EU’s General Data Protection Regulation (GDPR). This means that, among other things, organizations will need to: determine the lawful basis for all data processing, evaluate the lawfulness of any criminal background checks, establish a procedure for destroying data after a certain time frame and add data privacy language to existing contracts with vendors that process data on the organization’s behalf. 

While the GDPR applies to all entities that fall within its scope, its relationships among credentialing organizations, relevant industry sectors, credential-holders, and the public are unique in many ways. As a result, credentialing organizations may face different burdens and challenges in navigating the GDPR when compared to other types of associations. Below are four areas of GDPR compliance that may affect credentialing bodies differently than other types of organizations. 

1) Lawful Basis For Processing, Sharing and Communications 

Under the GDPR, organizations must have a “lawful basis” to justify the collection, processing or sharing of personal data. Processing is only permissible where an organization has explicit and informed consent from an individual, or where processing is necessary to meet one of the other lawful bases. Obtaining consent under the GDPR requires specific disclosures, procedures and record-keeping. Due to the nature of the credentialing industry, however, a great deal of credentialing bodies’ processing activities may be able to proceed without consent by relying on the following lawful bases:

• Contract Performance: Organizations can process personal data when necessary in the context of a contract or intention to enter into a contract. In most cases, the relationship between a credentialing body and the credential holder is multi-faceted and long-term while involving a range of obligations and services. For this reason, credentialing bodies can rely on the following activities to justify the lawful basis to process data when issuing and maintaining credentials:
  • reviewing applications
  • vetting applicants, with some exceptions for criminal background checks
  • publishing the fact that the credential has been granted to the holder
  • conducting any testing needed to obtain the credential
  • providing other services necessary for the organization to grant and maintain the credential.

When relying on these activities as the lawful basis, it is prudent for credentialing organizations to clearly communicate to applicants what types of personal data processing activities are involved with obtaining and maintaining a credential.

• Pursuing Legitimate Business Interests: Credentialing bodies may be able to rely on this lawful basis to process information in ways related to and reasonably expected by credential holders, such as: (1) direct marketing related to the renewal and maintenance of a credential (g., emailing credential holders regarding the need to renew their registration); or (2) investigating wrongful or fraudulent representations about a credential, such as the misuse of suspended, denied or revoked credentials. This lawful basis requires a balancing test, so credentialing organizations should weigh their legitimate interests against the data privacy interests of any credential holder. 

2) Restrictions on Criminal Background Checks

The GDPR restricts processing related to criminal history except where authorized by an EU Member State’s laws. Many EU Member States forbid processing of this information except by local government institutions. As a result, credentialing bodies may be practically prohibited from processing criminal history data about individuals in the EU even when the individuals have provided explicit consent. At the same time, credentialing bodies may have a substantial interest in processing criminal history, particularly when the credential relates to practitioners who work with vulnerable individuals like the elderly, sick, disabled or children. Credentialing bodies that work with EU-based credential holders should carefully review their obligations to develop compliant policies for criminal background checks. 

3) Data Retention 

The GDPR requires organizations to destroy or return personal data once it is no longer necessary for the purposes for which it was collected. Credentialing bodies, however, may have a unique interest in retaining such data to keep a record of past and present credential holders. Accordingly, credentialing organizations should review their data retention policies to determine: (1) what data may require longer-term retention; and (2) specific timeframes for the retention of certain data. For example, certain contact and payment information may be less important following the expiration of a credential, whereas the organization may determine that a record of the name of the credential holder and dates the credential was valid should be retained for a longer period. Once an organization has developed a data retention policy, the relevant time frames should be reflected in an organization’s privacy policy.

4) Data Protection Addendums and Contractual Language 

The GDPR requires organizations and vendors that process data on behalf of organizations to enter into written agreements setting forth specific data privacy terms. Over the past year, United States (U.S.) organizations and vendors have worked to find suitable contractual language that covers GDPR requirements and protects both parties. Not all data protection agreements were created equal, however, and many of the data protection clauses floating around the marketplace are either non-compliant or overly broad. 

The credentialing process often involves substantial data processing by third-party vendors as part of application, training and testing practices. In many cases, these third-party vendors may not be very familiar with the GDPR, particularly when the vendors serve a limited clientele located purely in the U.S.. For these reasons, credentialing bodies should carefully review contracts with vendors to ensure that the clauses meet both the GDPR requirements and protect the credentialing organization. Specifically, credentialing bodies should be sure that vendors are: (1) only processing data per documented instructions; and (2) vendors have adequate data security. Over the past year, EU data protection agencies have used the GDPR’s mandatory data breach reports to open broad investigations into organizations’ GDPR compliance practices. Good data security practices help mitigate the risk of investigation. 

Conclusion 

Credentialing bodies that are subject to the GDPR can benefit from a close examination of their GDPR obligations. As the world continues to focus on data privacy legislation, becoming GDPR compliant can provide organizations with excellent tools to understand and refine their data privacy practices. Every credentialing body will have different compliance requirements based on its processing activities, including what data it collects, what it does with these data and how data is shared. There is no “one size fits all” GDPR compliance program. Each compliance program should be customized based on what an organization does. 

A common problem faced by contractors and subcontractors is getting paid for work performed on a construction project. This may be the result of the project owner withholding payments or in the case of a subcontractor, the general contractor refusing to issue payments. Whatever the reason, the contractor or subcontractor is faced with the dilemma of how to secure payment for the labor and/or materials that it provided. In seeking to collect money owed, the contractor or subcontractor must decide if and when to file a mechanics lien.¹

Mechanics lien rights, which exist in some form in all 50 states, give a party an involuntary security interest in the property where the work was performed. The lien attaches to the property and creates a title defect for the property owner. In order to properly file a lien, the contractor or subcontractor must provide notice to the property owner prior to filing the lien. The notice informs the owner that a lien will be filed unless payment of overdue amounts has been made within a specified amount of time. A subcontractor can file a mechanics lien on the property even if the property owner has already issued payment to the general contractor.

A mechanics lien is one of the most powerful tools a contractor or subcontractor has to secure payment for work performed. While a contractor/subcontractor has the option of filing a lawsuit for breach of contract for unpaid work, that option can prove costly and may take a considerable amount of time to resolve. Thus, the mechanics lien may be a more efficient method of ensuring that the contractor or subcontractor’s invoices are paid. 

In exercising lien rights, two factors often come into play. One is a concern about poisoning the relationship with the project owner, or in the case of the subcontractor, with the general contractor. Especially if one has a longstanding relationship with a project owner or general contractor, one does not want to unnecessarily create a hostile working environment or preclude the possibility of future business.  One also has to be aware, however, that there are deadlines on when a contractor or subcontractor can file a lien on the property on which work has been performed. Although the deadline for filing a lien varies from state to state, the time to do so generally ranges from between 3 months until a year after the work on a project has been completed.²  Thus, if a project owner or general contractor is promising to pay, the contractor or subcontractor needs to be careful not to let the deadline for filing a mechanics lien expire based upon what may turn out to be empty promises.

A mechanics lien provides a contractor or subcontractor with important leverage to ensure payment for work performed. While one does not want to do so unnecessarily, if uncertainty exists as to whether you are going to get paid one should file a mechanics lien. As one subcontractor client often states, “‘if in doubt, lien it!”

Please contact GKG Law if you have construction related contract issues or litigation (or other contract issues). Brendan Collins may be reached by telephone at (202) 342-6793 or by email at bcollins@gkglaw.com; Kristine Little may be contacted at (202) 342-6751 or by email at klittle@gkglaw.com.

When entering into a contractor-subcontractor agreement, it is important to carefully review the “boilerplate” to ensure that you as a subcontractor are properly protected and are not being subjected to onerous and unfair obligations.  Although as a subcontractor you may have limited bargaining power with respect to negotiating the terms and conditions of the contract, it is important for a subcontractor to try to ensure that its liability is appropriately allocated and that it is aware of its obligations under the contract.  At a minimum, the subcontractor needs to be able to assess how much risk it is assuming.  Below are a few things to consider when reviewing a contractor-subcontractor agreement.¹

Conditional Payment

Conditional payment clauses are a popular tool used by contractors to shift the risk of a property owner’s insolvency or non-payment by the property owner. A “pay when paid” or “pay if paid” clause is common in contractor-subcontractor agreements. As the name states, these clauses provide that a subcontractor receiving payment for work performed is contingent on the owner issuing payment to the general contractor. As a result, if the contractor never receives payment from the owner, the contractor is under no obligation to pay the subcontractor. Although some courts have found these clauses to be unenforceable, they are often upheld by courts and it is important to be aware of the risks posed by such provisions.  The risks posed are particularly pronounced if the general contractor and the project owner have a close relationship whereby the owner may collude with the general contractor regarding payments so as to deny payment to subcontractors.  

Design Performance

In reviewing a construction contract, the contractor or subcontractor should strike any contract language that refers to design intent. Instead, the bid should be based upon plans and specifications. The contract documents should also reflect the same dates as the plans and specifications.

In most instances, a subcontractor will submit shop drawings to the general contractor, and to the architect or engineer of record, to show how a particular portion of work will be performed. This is often true when a subcontractor is working on prefabricated components, as the shop drawings provide the architect or engineer with greater detail regarding the installation of such components. A contractor or subcontractor needs to review the contract to determine whether the contract is shifting design responsibility to it.  In some instances, the language may explicitly state that it is imposing design responsibilities on the contractor or subcontractor. In other instances, it may be more ambiguous and the contract may simply include language such as warranty provisions or code compliance obligations that have the effect of imposing performance standards on the contractor or subcontractor’s work. If the contractor or subcontractor wishes to not have design responsibilities imposed on it, the best option available to it is to include disclaimer language in the contract expressly denying any responsibility for design in the contract. If an owner or contractor refuses to accept such language, the contractor or subcontractor should have its work completed by a qualified individual and reviewed and stamped by a design professional. This is important because if problems arise with the project, the first person the owner and general contractor are likely to point the finger at is the subcontractor, even if the problems are the result of design defects.

Attorney’s Fees Provision

In the event of a legal dispute, attorney’s fees provisions allow a contracting party to collect its costs and attorney’s fees incurred in enforcing the agreement.  Often construction contracts are larded with such provisions, including in indemnification clauses. A subcontractor should carefully review the attorney’s fees provision to determine whether they are reciprocal or one-sided. In the former case, it provides that the prevailing party is entitled to recover its attorneys’ fees in the event of litigation or arbitration. In the latter case it simply states that the general contractor is entitled to recover its attorneys’ fees in enforcing the contract’s provisions. A subcontractor should insist on the prevailing party language because in the event of litigation or  arbitration, the threat of attorney’s fees — which ultimately could be as large or larger than the amount of the underlying dispute — can be used as a cudgel by a general contractor seeking to  impose an unfair settlement on a subcontractor. 

Additional Things to Consider

The project schedule should be agreed upon. Failure to reach an agreement in this regard may result in a contractor or subcontractor being forced to attempt to perform under unrealistic deadlines and may result in damage claims resulting from deadlines that are impossible to meet.   

Once the agreement has been signed, there are some additional things a subcontractor should consider when working onsite. When performing work on a construction site it is not uncommon that either changes or additional work is required to complete the project. The subcontractor should not begin to perform additional work until it submits a change order and the change order has been approved by the contractor.

By way of example, the subcontractor may receive an urgent notice from the contractor that it needs additional work to be completed by next week.  Under these circumstances, although the subcontractor will want to accommodate the request, it needs to calculate the cost of the additional work and determine if overtime is necessary.  If the subcontractor begins work prior to seeking approval, due to the press of time, and overtime is incurred, the general contractor may later deny overtime payment. (Emergency work is often not recognized as having been urgent after the work has been completed.)  As a result, a subcontractor should always submit a change order prior to beginning additional work in order to ensure full payment from the general contractor.

Please contact GKG Law if you have construction related contract issues or litigation (or other contract issues). Brendan Collins may be reached by telephone at (202) 342-6793 or by email at bcollins@gkglaw.com; Kristine Little may be contacted at (202) 342-6751 or by email at klittle@gkglaw.com.

Many aircraft owners use their aircraft for both business and non-business purposes during the same trip. This practice can often make categorization of a particular trip more difficult, as the “primary purpose” of the trip must be for business in order to be tax deductible. Further, this categorization must be made for each passenger for each leg of a trip. GKG Law would like to remind aircraft owners of the “substantiation requirement” for taxpayers and discuss factors that will cause the Internal Revenue Service (“IRS”) to more heavily scrutinize the classification of a particular trip. One of these factors happens to be travel around holidays, such as the Fourth of July.

An aircraft owner is required to make the initial determination of how to categorize its aircraft-related travel for purposes of tax deductibility (e.g., business, entertainment, personal non-entertainment, commuting). However, the aircraft owner must also be able to adequately substantiate with detailed records its classification of the primary purpose of a particular flight in order to support its deductions for the business use of its aircraft. If this requirement is not met, the IRS is able to reclassify the aircraft owner’s initial categorization, thereby potentially disallowing the aircraft owner’s deduction of expenses relating to the flight.

Certain factors that make a particular trip look more like it was undertaken in connection with entertainment, which would make those expenses non-deductible, can raise “red flags” for an IRS auditor and cause the auditor to scrutinize the trip more closely. As previously mentioned, one such factor is travel around holidays. Other factors include:

• Travel itineraries that include a weekend (e.g., flying to the destination on a Friday and leaving on a Monday);
• A longer period of time spent at the destination than is necessary for the business purpose;
• Travel with multiple passengers of the same last name aboard the flight (e.g., husband/wife, family members);
• Travel to a “resort type” destination (e.g., a location known for skiing, golf, or the beach);
• Travel with many passengers on board a particular flight when it is not clear that all of the passengers are traveling for the business purpose; and
• Travel where fewer passengers are on the return leg of a round trip, or on later legs of a multi-leg flight.

Take the recent Fourth of July holiday, for example, where an aircraft owner has a business meeting in Miami, Florida on Friday, July 5th. The aircraft owner flies to Miami on Thursday, July 4th and returns home on Monday, July 8th. In an income tax audit, it is likely that the IRS would scrutinize the business classification of such a flight.  The IRS may recategorize it as a personal entertainment flight unless the aircraft owner can produce adequate documentation to prove otherwise. The aircraft owner will need to produce sufficient documentation, created contemporaneously with the travel (as records created after a tax audit is initiated are usually deemed to be less credible), proving that the primary purpose of the travel was for business. For example, records or correspondences showing that the business meeting was planned before any subsequent entertainment activities were planned would be helpful to show the primary purpose of the trip was business related.

Categorization of the reason for travel on board a company aircraft is decided on a case-by-case basis using a facts and circumstances analysis. Certain trips can be more difficult to categorize than others or contain taxpayer adverse facts that accompany legitimate business travel. The business aviation tax attorneys at GKG Law regularly advise clients regarding these issues and the types of records that an aircraft owner should keep to maximize the taxpayer’s ability to deduct legitimate aircraft-related business travel expenses. GKG Law also regularly represents aircraft owners in IRS income tax audits involving these issues. 

For more information on this topic or other business aviation related needs, please contact Ryan Swirsky (rswirsky@gkglaw.com or 202.342.5282).