George S. Isaacson

Many online merchants have been watching closely the saga of the Direct Marketing Association's (DMA) constitutional challenge to a 2010 Colorado law targeting remote sellers. This legislation would require out-of-state catalog and internet retailers that do not collect Colorado state and local sales tax to turn over customer transaction information to the Colorado Department of Revenue.

Unfortunately, it's not a question of if, but when your company will experience a data breach. Whether caused by a hacker, equipment failure, theft, disgruntled employee or a vendor error, most retailers will experience an incident resulting in the unauthorized disclosure of confidential customer or employee information. According to the Open Security Foundation and security consultancy Risk Based Security, last year set a record for the number of reported data breach incidents — 2,644 incidents, more than double the number in 2011, which previously had been the highest amount in one year.

If your company uses cookies — small information files that are downloaded onto a computer or mobile device when a user visits a website which enable the website operator to recognize the user's device and preferences — on its website, and the website is either "designed for the European market" or "provides products or services to customers in Europe," you should be aware of the new European Union (EU) Cookie Directive.

On Nov. 9, 2011, a group of 10 senators from both sides of the aisle introduced the Marketplace Fairness Act, S.1832. On Oct. 13, 2011, a similar bipartisan bill was introduced in the House of Representatives called the Marketplace Equity Act.

The Supreme Court of California recently ruled that collecting ZIP codes from customers who paid by credit card may subject merchants to class-action lawsuits. Dozens of such actions have already been filed, including against retailers "yet to be named." Reported settlements paid by some companies have exceeded $25 million. The lesson is clear: All retailers should review their customer information collection practices in light of California law (and other states) to avoid becoming the target of class-action lawyers.

State legislatures continue to experiment with novel nexus legal theories in their persistent drive to compel use tax collection by retailers located beyond their borders. The most recent state efforts are aimed directly at online retailers through passage of so-called "Amazon laws."

On Jan. 26, a United States District Court Judge in Denver entered a preliminary injunction against the Colorado Department of Revenue in the lawsuit that the Direct Marketing Association (DMA) brought challenging Colorado's new notice and reporting law, H.B. 10-1193. This controversial legislation — the enforcement of which is now suspended by the court's order — imposes three sets of obligations on out-of-state retailers that don't have nexus in the state and don't collect Colorado sales tax.

On June 30, the Direct Marketing Association (DMA) filed a lawsuit in U.S. District Court in Denver against the executive secretary of the Colorado Department of Revenue challenging the constitutionality of Colorado's new consumer notice and reporting law that's targeted at out-of-state retailers who don't collect Colorado sales tax.

A recent federal appellate court decision concluded that the 
removal of a product's universal product code (UPC) may constitute a trademark infringement. In Zino Davidoff SA v. CVS Corp., decided this past June, the court supported claims of a high-end distributor of luxury fragrances because "the UPC acts as a quality control mechanism which enables [the trademark owner] to protect the reputation of its trademarks by identifying counterfeits and by protecting 
against defects."

Last year, 12 states had do-not-mail legislation under consideration. But none of the bills were enacted. This year, however, bills already have been refiled in some states, and new bills have been introduced in Connecticut, Florida and New Jersey. With varying enforcement mechanisms, the laws would prohibit mailing unsolicited direct marketing materials to persons who enter their names and addresses to state-maintained registries.

In the first century B.C., the Roman author Publilius Syrus wrote: “A good reputation is more valuable than money.” More than two millennia later, it remains true that a merchant’s brand, which carries its reputation, is its most valuable asset. Consequently, the piratical misuse of brand names on the Internet is a persistent problem that plagues many online retailers.

Catalogs and Web sites provide customers with more than just product displays, merchandise descriptions and purchase information. They generally include a number of legal disclosures as well. Frequently overlooked, however, is an explanation of the retailer’s refund and return policy. Such a disclosure should be included, both as a matter of legal compliance and industry best practice. State Disclosure Laws Approximately one-third of states have enacted legislation related to retail sales return policies. A few states have disclosure laws specifically targeted toward certain types of direct marketers. • In California, a vendor conducting business through the Internet or other electronic means must

New York’s new nexus-expanding affiliate marketing law has generated considerable confusion and anxiety in the direct marketing industry. The legislation was signed into law on April 15, and now the second shoe has dropped in the form of a technical services bulletin (TSB) issued by the New York Department of Taxation and Finance on May 8 — TSB-M-08(3)S. The TSB purports to explain the new law and resolve some of the uncertainties arising from its vague statutory language. The good news is the TSB actually narrows the scope of the new law in certain important respects. It may provide comfort to catalog companies

Escheat. The very word sounds sinister, and for good reason — direct marketers beware! But how do state escheat laws, which are often known as “abandoned property laws,” work? And what risk do they pose to multichannel merchants? Defining ‘Unclaimed Property’ Let’s start with unclaimed property. This is a liability that a company owes to an individual or other business that has remained outstanding beyond a specified period of time. Every year, billions of dollars of economic entitlements go unclaimed, including obligations of retailers to their customers and suppliers. Depending on the particular state, these include: • unredeemed gift certificates and gift cards; •

Catalogers can’t reduce their nexus exposure unless they first identify their nexus risks. Many CEOs and CFOs are unaware of their own company’s various affiliate marketing programs, cross-promotion initiatives, vendor drop-ship relationships and other activities that carry a nexus risk. Senior managers also may be lulled into the false belief that a relatively small amount of in-state activity isn’t enough to cross the nexus threshold. Even a very limited physical presence in a state, however, may be sufficient to create a tax-collection obligation on all sales to consumers in that state. Therefore, every cataloger should undertake a nexus self-audit. Attorneys and accountants