Going Viral: Mitigating the Impact of Negative Reviews While Managing PR Crises

American Conference Institute Digital Advertising Compliance

October 18, 2016

Emily Goodman BinickVice President & Senior Counsel

American Express Company

■ UDAAP (CFPB) and UDAP (FTC)

■ For a Financial Institution (and their partners and service providers), the Federal Financial Institutions Examination Counsel (FFIEC)guidance on social media.

■ GLBA / Privacy / Data Security

– Variety of regulatory communications / notices may be required (e.g., SEC disclosures; data breach notifications).

– E.g., Depending on industry, product and channel, GLBA, FCRA, TCPA, COPPA may apply.

■ HIPPA Privacy Rule

■ Regulator and law enforcement scrutiny

– Negative review may not be a “complaint” within company’s definition, but should be tracked and analyzed for trends or indicatorsof issues.

– Customer complaints can lead to investigations.

– Customer complaint management, across a variety of channels (including social) is integral part of business.

• Analyze data & identify trends; classify customer complaints

• Take Management Action

• Use data to improve complaints process

Considerations in Regulated Industries

■ “Tabletops” exercises are common for data security space, but principles can be applied more broadly. Select any narrativethat applies to your business.

– Be prepared; identify and train a crisis management team in advance. Include representatives from management, legal,public affairs, investor relations, security, IT, etc. Ensure external parties (e.g., PR) are interviewed ahead of time toensure crisis readiness, and get agreement in place so that engagement is covered by privileged.

– Key benefits include: people know each other and procedures already in place; save time and effort during response;identify gaps; determine interoperability; improve accuracy of information decimated (internally and publicly).

■ Incident response plan should be a living document, periodically tested and revised to meet current needs.

■ Communication to Partners, Regulators, Media & Impacted Persons

– Communication plan should: identify all stakeholders (dept. and individual) who must be notified after an incident,channels for communication.

■ Consistent messaging

■ Consistent remedies

Incident Response Planning and Action

If hosting review or ratings directly or via vendor/agency, must present in a fair and unbiased way. Should have and represent “the criticalmass”.

■ If you invite feedback and reviews/ratings, be prepared to show the good, bad and ugly. Reviews presented should reflect thetypical experience and distribution of good/bad. Disclose or avoid material connection (e.g., employee reviews).

■ Avoid improper engagement – E.g., avoid actual or appearance of opportunities for astroturfing.

– UDAAP; 2013 NY AG action (“By producing fake reviews, these companies violated multiple state laws against false advertisingand engaged in illegal and deceptive business practices.”) . Caution re: brand reputation management during crisis.

■ Use of consumer review or user generated content with proper notice, consent can turn a positive review into a negative situation.

■ Include Terms of Use and be clear about who is collecting and managing (vendor/agency or company itself), and for what purpose.

■ “Start Up” podcast example.

Inviting and Hosting Reviews

The good, the bad and the ugly...

Inviting and Hosting Reviews

The good, the bad and the ugly...

Inviting and Hosting Reviews

■ Take steps ahead of and during crisis to ensure that communications fall under privilege umbrella.

■ The extent to which these non-lawyers come within the bounds of attorney-client privilege, andwhich non-lawyers fall within the protection of the privilege, can be unclear.

■ Especially important to consider, pre-incident, at the start of a relationship, if you use an externalPR firm.

– PR/media consultants are not lawyers dispensing legal advice. Communications with them maybecome the subject of discovery or subpoenas—even when they relate to litigation strategy.

– Communications may be protected if they’re for the purpose of helping counsel render legaladvice. Courts vary.

Attorney-Client Privilege During a PR Crisis

Practical tips to increase likelihood that a chance that a court will recognize as privilegedcommunications with a media firm.

■ Agreement with that external firm should be specific – purpose should be to facilitate counsel’sprovision of legal advice. Don’t combine with day-to-day, regular business matters engagement. Ifsame firm doing both, take steps to separate work within the firm.

■ Outside counsel (or in-house legal group) should engage PR firm. They should also manage billingand ongoing administrative matters with engagements.

■ Include counsel on all communications. Label each email appropriately (“Privileged &Confidential”).

■ Communications include an explanation of how the document pertains to the provision of legaladvice.

Attorney-Client Privilege During a PR Crisis

Contact Information

Emily Goodman BinickVice President & Senior CounselAmerican Express Companyemily.h.goodman.binick@aexp.com

Thank you!