arrow-double-right arrow-noline-right arrow-lrg-left arrow-lrg-right arrow-med-down arrow-med-left arrow-med-right arrow-med-up arrow-sml-right checkmark close close-sml contact-card event-clock linkedin menu minus outbound-link phone plus print search-lrg search-sml twitter Winthrop-mark

Collection #1 Data Breach: What Happened, and What You Can Do About It

One of the single largest public data breaches in history was recently discovered, and it includes more than 770 million unique email addresses and over 21 million unique passwords. The massive breach was first reported by cybersecurity researcher Troy Hunt, who received multiple tips about the data’s availability on a popular hacking forum. The breach, which some are calling the “mother of all breaches,” appears to be a combination of more than 2000 smaller data breaches and leaks over a broad time period. Given the vast scale of the data dump, chances are good that your personal and/or company’s data can be found in the 87 gigabytes of leaked information.

What Happened?

The leaked data was made available for download through the well-known MEGA cloud storage service before being removed a few days ago. Initial reports indicate that the data may have been first posted online as early as October 2018. For a sense of scale, the breach, dubbed “Collection #1,” is more than five times larger than the headline-grabbing 2017 Equifax data breach that affected 148 million Americans. The leaked data set appears to include data from a variety of sources, including some data stolen between two and three years ago, as well as older data dating as far back as 2008. The passwords leaked in the data dump were decrypted by the hackers, and can be easily misused by any unscrupulous downloader. Most concerning of all, however, is that Collection #1 may just be the tip of the iceberg.

In an interview with the anonymous party offering to sell Collection #1 for just $45, security journalist Brian Krebs reported that the seller was also offering to sell several more volumes of stolen data, including downloads entitled Collection #2 through Collection #5. The seller also provided evidence suggesting that the additional collections were much larger than the leaked Collection #1, and contained data from more recent data breaches. Time will tell whether this is the largest hacked data leak in history.

What is the Risk?

We already know that the leaked email addresses and passwords from Collection #1 (and other breaches) are in the hands of hackers looking to illegally profit off the data. The question you should ask yourself is what is the risk of harm? Or, if you are a business owner, what does the breach mean for your business? The answer largely depends on one major risk factor: password reuse.

If you, your business’ customers, or your employees reuse the same passwords across multiple online accounts, you are at a significantly higher risk of harm from breaches like Collection #1. Using a technique known as credential stuffing, hackers can automatically test thousands of known email & password combinations across thousands more websites and accounts. That means that if you used the same password for your streaming music service, work email, and Amazon account, all three accounts could be at risk due to a single breach. Similarly, if an employee accesses your company’s computer system using the same password he or she used in one of the 2000+ breached databases contained in Collection #1, your company systems would also be vulnerable. Collection #1 should be a wake-up call for everyone who reuses passwords, because no matter how strong your password or how good your other security measures, password reuse makes a hacker’s job easy. The breach is also a stark reminder that security breaches at unrelated organizations can still affect your company’s IT systems.

What Can You Do About It?

 Your first step should include determining whether you or your business’s data was compromised by the Collection #1 breach. You can easily cross check your email addresses and passwords against a database containing the Collection #1 data, in addition to thousands of other known public data breaches. Companies can also do a domain search to see if any users’ passwords within their organizations were hacked. If you were not affected (lucky you!), you should still take the opportunity to review and improve your password and security practices. If, on the other hand, your password credentials were compromised, your focus should be on recovering from the breach by securing your accounts, fixing existing vulnerabilities, and preventing future harm.

Individuals can recover from breaches like the Collection #1 leak by immediately changing all affected passwords, enabling two-factor authentication for any accounts that enable it, and paying close attention to financial accounts and credit monitoring. Individuals can also minimize future harm by choosing strong, unique passwords for all new accounts, and never, ever reusing old passwords. A password manager can do wonders here, and is one of the few security measures that actually makes life easier. Use one.

Businesses have a steeper hill to climb. To begin, affected businesses should already have a detailed cybersecurity incident response plan, and should immediately assemble their incident response team, and follow the documented plan. If no such response plan exists, business owners should seek third-party assistance in responding to the breach to ensure all practical and legal obligations are met. Next, it is prudent to begin securing company systems by disabling any affected users’ account access and forcing password resets. A secondary measure may also include strengthening internal password policies by prohibiting use of any passwords exposed in the breach. After securing operations, businesses should determine whether any unauthorized access to company systems actually occurred. Breach response teams should review access logs and other data sources to identify suspicious log-ins or data traffic, especially for compromised user accounts. Computer forensic services can assist in this process if needed. Depending on the conclusion of the analysis, companies should either set about repairing any damage caused from the breach, or breathe a sigh of relief that no actual breach occurred. No matter the conclusion, the incident should be fully documented, and reported to any required parties in accordance with relevant legal requirements.

After the dust has settled, businesses should take the opportunity to review and update existing incident response procedures, information security policies, and other internal security mechanisms to ensure preparedness for future cyber-threats. Whether or not you or your business was affected by Collection #1 or any as-yet unknown future breaches, individuals and businesses alike can minimize their risk through awareness, planning, and following preferred security practices. When it comes to cybersecurity, there is no question that an ounce of prevention is worth a pound of cure.

For more information on this or other data security & privacy issues, contact Winthrop & Weinstine.

EPA proposes new definition for Waters of the United States

On December 11, 2018, the United States Environmental Protection Agency and the Department of the Army, the two agencies primarily responsible for regulating waters under the Clean Water Act, issued a pre-publication version of its proposed rule revising the definition of “waters of the United States” (aka “WOTUS”) under the federal Clean Water Act.

If finalized, the new rule would change the nature and scope of permits and approvals required for many projects, such as developments or infrastructure projects, that involve potential filling of wetlands or other waters.

This proposal is the second step in the EPA’s efforts to modify the WOTUS definition. The first step was a proposed rule repealing the Obama-era 2015 rule defining WOTUS.

The 2015 Rule

The 2015 Rule proposed what the Obama administration characterized as an easier, bright-line method to establish whether a water was subject to Clean Water Act jurisdiction. A number of states, however, disagreed and took the position in litigation that the rule, which included a broad list of waters in the definition of WOTUS, exceeded the EPA and Army Corps of Engineers’ regulatory jurisdiction under the Clean Water Act. An injunction against the rule was issued by the federal District Court in North Dakota, and a nationwide stay was issued by the federal Sixth Circuit Court of Appeals. Due to a jurisdictional ruling by the Supreme Court, however, the status of that national stay was called into question.

Proposed Repeal of the 2015 Rule and Addition of an Effective Date for the 2015 Rule

In July, 2017, the EPA and the Army proposed to repeal the 2015 rule.

In January, 2018, in the wake of the Supreme Court’s ruling finding that the Courts of Appeals lacked jurisdiction to review the rule, and in order to address confusion caused by litigation rulings affecting some, but not all, states, the EPA and the Army finalized a new rule delaying the implementation of the 2015 rule until 2020.

Meanwhile, the proposed repeal rule has not yet been finalized.

Proposed Revised Definition

The proposed definition largely follows Justice Scalia’s WOTUS definition as set forth in the 2006 Rapanos v. United States decision. According to the EPA, WOTUS would be limited to the following six categories:

  • Traditional navigable waters (mostly large rivers and lakes, tidal waters and the territorial seas and tidally-influenced waterbodies, including wetlands) that are used in interstate commerce;
  • Tributaries to traditional navigable waters;
  • Certain ditches that are traditional navigable waters (such as the Erie canal), are subject to the tides, or were constructed in a tributary or were built in adjacent wetlands;
  • Certain lakes and ponds, including those that are traditional navigable waters, lakes and ponds that contribute flow to a traditional navigable water and those that are flooded by a WOTUS in a typical year;
  • Impoundments of a WOTUS, and
  • Adjacent wetlands, meaning those that physically touch other jurisdictional waters or have a surface water connection to a WOTUS in a typical year.

Certain types of waters would be explicitly excluded from the definition of WOTUS:

  • Ephemeral features, meaning those that flow only when it rains;
  • Groundwater;
  • Most farm and roadside ditches;
  • Prior converted cropland;
  • Stormwater control features in upland;
  • Wastewater recycling structures in upland, and
  • Wastewater treatment systems.

Effect of the Proposed Definition

While the proposed revision would likely lead to a significant reduction of the number of waters and wetlands subject to federal regulation across the nation, the on-the-ground effect on overall wetlands regulation in Minnesota will be less significant due to Minnesota’s robust regulation of wetlands under Minnesota’s Wetlands Conservation Act. The effect of the revised definition on activities affecting wetlands is likely to have greater regulatory impact in states that engage in less direct regulation of activities impacting wetlands. Also, some states may, in response to a reduced level of federal oversight, enact additional regulations governing impacts to public waters.

That said, the revised definition will affect the nature and scope of permits needed for some projects. In some cases, the only federal permit required for a project is a wetlands permit under section 404 of the Clean Water Act. If the wetland in question is no longer subject to federal regulation, however, a host of federal requirements that might be triggered by the need to get that federal permit might go away, such as compliance with the federal National Environmental Policy Act, the federal Endangered Species Act, and obligations under Section 106 of the federal National Historic Preservation Act. The need for a water quality certification by the state environmental protection agency (in Minnesota, the Minnesota Pollution Control Agency) under section 401 of the Clean Water Act also goes away.

Overall, while repealing the 2015 Rule and adopting the proposed rule based on Justice Scalia’s reasoning in Rapanos will reduce obligations under federal regulations for many projects, there may be added administrative costs to monitor and maintain compliance with varying state regulations.

Status of the Proposed Rule Revising the WOTUS Definition

Upon publication of the proposed rule in the Federal Register, the rule will be subject to a 60-day comment period. The EPA had also planned to host a webinar and a public meeting on the rule in January. As a result of the current government shutdown, however, the publication of the rule in the Federal Register, as well as the planned webinar and public meeting, have been postponed. It is anticipated that this proposal will move forward once the government reopens.

FCC Seeks Public Comment On TCPA’s Autodialer Definition After Ninth Circuit Decision

On October 3, the Federal Communications Commission (FCC) released a Public Notice[1] seeking comment on the meaning of an “automatic telephone dialing system” or “autodialer” under the Telephone Consumer Protection Act (TCPA). The FCC’s move comes in the wake of a recent ruling by the U.S. Court of Appeals for the Ninth Circuit broadly construing the term, and effectively expanding the scope of the TCPA. The Ninth Circuit’s decision marked a split with other circuits that have considered the issue, which creates uncertainty for any businesses that send automatic text messages or calls. The FCC now requests public comment on several issues raised in the Ninth Circuit’s decision, including whether the statutory language of the TCPA is ambiguous, and which types of devices qualify as an autodialer under a proper reading of the statute.

Two weeks earlier, the Ninth Circuit reached its long-awaited decision in Marks v. Crunch Fitness, an appeal from a dismissed lawsuit against Crunch Fitness alleging violations of the TCPA. In filing the suit, the plaintiff Jordan Marks alleged that he had received three unwanted text messages from Crunch without his consent. The lawsuit also alleged that Crunch’s use of a third-party SMS marketing platform violated the TCPA by using an autodialer to send the messages.

Although the district court determined the SMS marketing platform used by Crunch was not an autodialer under the TCPA, on September 20th the Ninth Circuit disagreed and vacated the decision. The Marks court also held that an autodialer under the TCPA could include any device that automatically calls or texts phone numbers from a stored list of phone numbers.[2] This broad interpretation expands the applicability of the TCPA, and puts many businesses located within the Ninth Circuit’s jurisdiction at risk of substantial fines—between $500 and $1,500 for every message or call—for failing to gain affirmative consent from recipients.

The Ninth Circuit’s ruling stands in stark contrast to the recent trend away from a broad application of the TCPA to modern technology.  The decision also signals a clear split from the narrow interpretations of an autodialer announced by the Third Circuit[3]  and D.C. Circuit[4] earlier this year. While the FCC has the power to overrule the Ninth Circuit’s interpretation, for now the ruling is legally binding precedent throughout the Ninth Circuit. This circuit split may also spark future interest from the Supreme Court, which could weigh in to push the broad interpretation of the TCPA on businesses across the country.

What are the important takeaways for businesses using this technology?

  • Businesses will need to gain express consent for nearly any automated customer contact via phone call or text message. The consent should be documented.
  • If using autodialer technology without documented consent, businesses will have to consider halting related promotional campaigns, or run the risk of large monetary penalties.
  • For those outside of the Ninth Circuit’s jurisdiction, businesses should understand that the ruling offers an early warning that the TCPA is far from settled law, and could still have teeth in the future.
  • There is still time to voice an opinion on this matter. The FCC is actively soliciting comments by October 17, 2018, with reply comments due by October 24, 2018.

Notwithstanding the Marks decision, the FCC’s request for comment signals its interest in intervening on the autodialer issue.  Although no specific timeframe for any FCC rulemaking exists, if the FCC issues new rules as expected, there could be another shift of the TCPA landscape across the country. For now, businesses must consider the potential risks associated with TCPA noncompliance, and plan their automatic messaging or calling campaigns accordingly.

[1]DA/FCC # DA-18-1014, available at https://www.consumerfinancemonitor.com/wp-content/uploads/sites/14/2018/10/DA-18-1014A1.pdf

[2] Marks v. Crunch San Diego, LLC, No. 14-56834 (9th Cir. 2018)

[3] Dominguez ex. rel. Himself v. Yahoo, Inc., 894 F. 3d 116, 120 (3d Cir. 2018)

[4] ACA Int’l v. FCC, 885 F.3d 687 (D.C. Cir. 2018)

6 Lessons Learned From The GDPR Transition As California’s New Data Privacy Law Comes Into Focus

Four months after the General Data Protection Regulation (GDPR) burst onto the data privacy scene in May, many businesses are still scrambling to meet the law’s extensive requirements. But now, there’s another looming deadline for many businesses. In June, the California State Legislature passed its own set of privacy regulations named the California Consumer Privacy Act of 2018 (“CCPA”). The CCPA restarts the compliance countdown for many affected businesses still reeling from the GDPR transition. While the CCPA is still being finalized (a technical corrections amendment was recently passed on August 31, 2018), here are six lessons learned from the GDPR compliance struggle that can save your business time and money as you prepare for the CCPA.

1. Compliance will take longer than you think.

Despite the two-year gap between passage of the GDPR and the May 25, 2018 effective date, surveys indicated that only about half of the businesses affected by the GDPR achieved compliance by the deadline. For many small and medium-sized organizations without mature privacy programs, full GDPR compliance can easily take six to eight months to complete. For larger businesses, or businesses with a high volume, complex data processing, the process can take even longer. Even though certain provisions of the CCPA are not slated to take effect until January 1, 2020, companies should begin developing CCPA-compliant protocols sooner rather than later to reach compliance before the deadline to avoid potential fines and lawsuits that could have been otherwise avoided.

2. Getting started early saves money later.

In addition to avoiding costly fines and lawsuits associated with violations of data privacy regulations, businesses that developed an early, intentional compliance strategy for GDPR preparation often reduced their overall transition costs. For example, organizations that gave their compliance team and legal counsel enough time to plan and implement appropriate compliance steps were more likely to avoid unnecessary and inefficient efforts that resulted from a rushed changeover. In addition, strategically planning future ad campaigns, apps, and products to meet GDPR or CCPA compliance standards can help avoid the need to make expensive modifications to these investments in the future.

3. Don’t assume you’re off the hook.

Just because your business isn’t based in the EU doesn’t mean you are free from the GDPR, and likewise, just because your business isn’t physically located in California doesn’t mean you can ignore the CCPA. Many affected companies made the mistake of assuming they didn’t have to worry about the GDPR until it was too late to reach compliance by the deadline. However, both the CCPA and GDPR extend to companies that are based outside of the borders of California and the EU, respectively. Make sure to review and verify the status of your business under the regulations to ensure that you aren’t at risk for regulatory investigations and lawsuits.

4. Confusion and uncertainty are expected.

Both the GDPR and the CCPA represent wholesale changes in data privacy regulation. As a result, some uncertainty and confusion surrounding the interpretation and enforcement of these new regulations is to be expected. This ambiguity lead some businesses to take the risky “wait and see” approach to compliance, without fully understanding the risks they were taking, and without realizing that they could be punished in the future for the time period during which they were intentionally noncompliant. But smart businesses aren’t taking any chances. By making good-faith efforts at achieving compliance on time (and being able to demonstrate those efforts to a regulatory authority), businesses can greatly reduce the risk of fines or lawsuits, even if they end up missing the compliance deadline.

5. Data subject rights are here to stay.

The GDPR and the CCPA define specific data subject rights that all covered businesses must be prepared to enforce. While each set of regulations lays out different variations of data subject rights, there is an unmistakable trend toward elevated scrutiny and greater transparency when it comes allowing an individual a measure of control over their personal data. Even if your business may not be subject to these regulations now, integrating many of these requirements into your operation, including an individual’s rights to access, right to erasure, and right to withdraw consent, can give you a leg up should a broader, farther-reaching piece of legislation be passed in the future.

6. Significant fines and class action lawsuits await the noncompliant.

Large data privacy class action lawsuits have become a regular occurrence in today’s privacy-sensitive climate. Under the GDPR, individuals are given a number of private rights of action, including the right to bring a class action lawsuit. On the first day of the GDPR, for example, both Facebook and Google were hit with approximately $8.8 billion lawsuits. When the CCPA launches in 2020, enterprising class action attorneys are expected to lead a surge of consumer litigation under the CCPA’s private right of action. In addition to lawsuits, businesses will want to protect themselves from costly fines as well. While CCPA fines (up to $7,500 per violation) are initially smaller than GDPR fines, the CCPA also allows for statutory damages between $100 and $750 per consumer, per incident. Compliance violations also have the potential to quickly become PR nightmares for an organization, as public support continues to swell for stricter data protection laws, making effective compliance all the more important.

While none of these lessons offers a magic bullet that can ensure your organization will be compliant when the CCPA takes effect in 2020, learning from these lessons can help your business stay ahead of the compliance curve, and better prepare for a data-protected future. Moreover, taking a proactive approach to the coming wave of data privacy laws can pay financial, legal and PR dividends down the road.

Snapshot of 2018 Minnesota Political Races

The General Election will be held on Tuesday, November 6, and it will be a momentous one in Minnesota: Governor Mark Dayton is retiring, and the unexpected resignation of U.S. Senator Al Franken has put both U.S. Senate seats on the ballot, along with all Congressional seats, all state-wide constitutional offices, and all 134 seats in the Minnesota House.

Gubernatorial Race (Open Seat)

Republican candidate and Hennepin County Commissioner Jeff Johnson has aligned himself with President Trump and touted a message of less government bureaucracy. Johnson will face U.S. Rep. Tim Walz (1st District) on the DFL side. Walz is a moderate Democrat running on a “One Minnesota” platform seeking to bridge the urban-rural divide.

Both candidates have a Native American running mate on the ticket: Peggy Flanagan (Walz) – White Earth Nation of Ojibwe and Donna Bergstrom (Johnson) – Red Lake Nation of Ojibwe .

Should Johnson win the November election and the State House and Senate retain a Republican majority, the Republicans would control State government. On the flip side, should Walz win, the DFL would retain a pivotal role in the upcoming legislative budget debate and the 2020 census and resulting redistricting.

The St. Cloud Times and Suffolk University conducted a survey of 500 likely voters between August 17-20. The poll shows Walz 45%/Johnson 40%.

Attorney General (Open Seat)

DFL U.S. Rep. Keith Ellison (5th District) has been an ardent Trump critic, and is sure to engage at the national level should he win. Former Eagan State Representative Doug Wardlow is the Republican candidate running on a conservative values agenda. The office of Attorney General has been held by a DFLer for the last 47 years.

Secretary of State

Incumbent DFL Secretary of State Steve Simon (Hopkins) is running against former State Senator and Red Wing Mayor John Howe. Simon is an advocate for increasing voter turnout, election system security, and early voting options. Howe’s message is one of office transparency and efficiency.

State Auditor (Open Seat)

Current DFL State Auditor Rebecca Otto ran an unsuccessful bid for the DFL nomination for Governor, and will not be on the ballot.

Former teacher and AFL-CIO Secretary/Treasurer Julie Blaha (Minneapolis) is the DFL candidate facing former State House member and C.P.A. Pam Myhra (Burnsville).

U.S. Senate – Class 1

Incumbent U.S. Senator Amy Klobuchar (Plymouth) is running for reelection for a third term on the DFL ticket.  She is frequently mentioned as a potential candidate for President in 2020.  Klobuchar will face conservative Republican State Rep. Jim Newberger (Becker).

The St. Cloud Times/Suffolk University poll shows Klobuchar 53%/Newberger 33%.

U.S. Senate – Class 2

Former Lt. Governor Sen. Tina Smith (appointed by Gov. Dayton to fill the seat vacated by Sen. Al Franken) is running to retain the seat on a progressive agenda. Smith (Minneapolis) will face Republican State Rep. Karin Housley (St. Mary’s Point) in November. Housley is a two-term State Senator and realtor.

The St. Cloud Times/Suffolk University poll shows Smith 43%/Housley 36%.

State Senate – District 13 (Open Seat)

State Senator Michelle Fischbach (R) joined former Governor Tim Pawlenty’s ticket as candidate for Lt. Governor in his unsuccessful bid for the Republican nomination for Governor.

The Central Minnesota district is heavily Republican. Former Sartell Mayor and Stearns County Commissioner Joe Perske is running on the DFL ticket against three-term State Rep. Jeff Howe (R-Rockville). Perske is advocating for affordable health care and access to quality education. Howe is running on restoring local control, tax reform, and making transportation funding a priority in the State budget. This will be the only State Senate seat on the ballot. State Senate seats are up in 2020.

1st Congressional District (Open Seat)

Former U.S. Dept. of Treasury official Jim Hagedorn (Blue Earth) is the Republican candidate. Hagedorn is focusing on agriculture, tax reform, and anti-abortion issues. He will face former soldier/Assistant Secretary of Defense Dan Feehan (N. Mankato) on the DFL-side in November. Hagedorn ran unsuccessfully against Tim Walz in 2014 and 2016. Trump won the district by 15 %. Feehan is promoting affordable post-secondary education, investments in infrastructure, and universal health care.

2nd Congressional District

The 2nd is considered a swing district and as such has garnered national attention. It has been held by Republican, former talk radio host Rep. Jason Lewis (Woodbury) since 2016. DFLer and former executive at St. Jude Medical Angie Craig (Eagan) lost to Lewis by a narrow margin (1.8%) in the last election, and is seeking to unseat him in 2018. Lewis has an independent streak and is an avid proponent of tax relief. Craig is advocating for campaign finance reform, collective bargaining, reproductive rights, and a living wage.

3rd Congressional District

Five term U.S. Rep. Erik Paulsen (Eden Prairie) is seeking reelection against wealthy DFL entrepreneur Dean Phillips (Deep Haven). Paulsen is promoting fiscal discipline and investment in technology, science, and math education. Notably, Paulsen did not attend the June rally for Trump in Duluth. Trump did not win the district. Phillips is an advocate for campaign finance reform.

4th Congressional District

Rep. Betty McCollum (St. Paul) has represented the safe DFL district since 2001.  She is a progressive Democrat serving on the Appropriations Committee. Her Republican opponent is plumber, business owner Greg Ryan. He ran unsuccessfully against her in 2016.

5th Congressional District (Open Seat)

State Rep. Ilhan Omar (Minneapolis) is running in a solidly DFL district. She was the first Somali-American woman elected to office in the nation. Omar received national publicity as a result of her 2016 win, and is expected to focus on economic justice, education, criminal justice reform, and a just immigration system. Republican activist Jennifer Zielinski is running against her.

6th Congressional District

Incumbent Republican Rep. Tom Emmer (Delano) is seeking reelection in a safe Republican district. Emmer is instrumentally involved in the National Republican Campaign Committee. Former member of the Air Force Ian Todd (Anoka) is running as the DFL candidate.

7th Congressional District

DFL Rep. Collin Peterson (Detroit Lakes) has served this rural, Pro-Trump district since 1991. Peterson is a conservative Democrat and is Ranking Minority Member on the House Agriculture Committee. His two-time Republican opponent is Air Force veteran David Hughes. Hughes lost to Peterson by 4% in 2016.

8th Congressional District (Open Seat)

Former State Rep. Joe Radinovich (Crosby) is running on the DFL ticket on a message of protecting collective bargaining rights, campaign finance reform, skyrocketing child care costs, and protecting Social Security and Medicare. He will face St. Louis County Commissioner and Trump-endorsed Republican candidate Pete Stauber (Hermantown) in the November election. Historically DFL, the district is now considered a toss-up.

State House

All State House seats will be on the ballot in November. Republicans currently hold an eleven-seat majority in the House.

The 2019 State Legislative Session will be gaveled in on January 8, 2019.

2018 Minnesota Primary Election Preview

Minnesota’s Primary Election, which takes place August 14th, could possibly be the most crowded, intriguing, and drama-filled in Minnesota history.  Minnesota has a number of constitutional offices and congressional seats in play.  Despite both the Republican and Democratic parties endorsing candidates at their respective conventions, a number of candidates have chosen to take their chances with primary voters anyway.  To help sort through it all, below is a brief description of each of the major candidates vying for their party’s endorsement in tomorrow’s primary election.

 

Governor/Lieutenant Governor (Open Seat)

After two terms, Governor Dayton is retiring.

Democratic Candidates

Erin Murphy/Erin Maye Quade (Endorsed Candidate)
Erin Murphy is a six-term State Representative from St. Paul. She is a former nurse. Her running mate is a first-term, bi-racial State Representative from Apple Valley whose message centers around equity issues. Their platform highlights strong public schools, raising the gas tax to pay for transportation infrastructure, gun control measures, a single-payer healthcare system, efforts to address climate change, and renewable energy options. Murphy advocates for reducing carbon emissions and expanding investments in wind, solar, and biomass. She wants to invest more in the Natural Resources Research Institute to make advances in clean water.

Tim Walz/Peggy Flanagan
U.S. Representative Tim Walz (1st District) has been serving in Congress since 2006. He is a former Mankato high school teacher/coach. Peggy Flanagan is a two-term State Representative from St. Louis Park, and is a citizen of the White Earth Band of Ojibwe. Walz and Flanagan have highlighted Native American issues: honoring tribal sovereignty, prioritizing equitable education for Native students, working in collaboration with the tribes to combat the opioid crisis, and protecting and investing in the well-being of Native American children and their families. They are also seeking to expand the Renewable Energy Standard, reduce carbon emissions, and work with farmers on clean water solutions. Walz submitted a letter to the Public Utilities Commission expressing his concern that tribal rights must be respected through the Enbridge Line 3 review process. Like Murphy, he supports raising the gas tax to pay for transportation projects and gun control measures. He has released a “One Minnesota” plan to attempt to bridge the rural/urban divide.

Lori Swanson/Rick Nolan
Lori Swanson is the current State Attorney General (since 2006) and an Eagan resident. U.S. Representative Rick Nolan (8th District) has been serving in Congress for six terms. He is from Brainerd and serves on the bipartisan Congressional Climate Change Caucus. Swanson wants to appoint a “Career and Technical Education Czar” to focus on the workforce shortage. Swanson’s office represented the State in legal actions to defend the Clean Power Plan, limiting carbon-dioxide emissions. She supports raising the Renewable Energy Standard, reducing carbon emissions by building more wind power, incentivizing solar, supporting energy conservation and efficiency programs, and helping communities refurbish their wastewater treatment and drinking water systems.

Republican Candidates

Tim Pawlenty/Michelle Fischbach
Former two-term Minnesota Governor and Eagan resident Tim Pawlenty announced in April that he would run for Governor. Michelle Fischbach served as a State Senator from Paynesville for eight terms. Pawlenty has highlighted the need to make college more affordable, cut down on health care fraud, eliminate taxes on social security benefits, and go after drug companies responsible for the opioid crisis. In 2007, Governor Pawlenty signed the Next Generation Energy Act, directing State agencies to reduce greenhouse gases and develop a market-based and multi-sector cap-and-trade mechanism. However, in 2009 he called cap-and-trade overly bureaucratic.

Jeff Johnson/Donna Bergstrom
Jeff Johnson is a Hennepin County Commissioner and former State Representative from Plymouth. He ran unsuccessfully for Governor in 2014. His running mate, Donna Bergstrom, is a Red Lake Band of Chippewa Indians member and a retired Marine Corps intelligence officer from Duluth. Johnson is positioning himself as the conservative candidate advocating for a smaller State government with lower taxes and reduced spending. Johnson supports work requirements for welfare recipients, suspending the refugee resettlement program, school choice, and placing stringent restrictions on abortion. He wants to move the State away from the Affordable Care Act to a free-market system. Johnson is a vocal Trump supporter.

 

Attorney General (Open Seat)

The Democrats have controlled the Attorney General’s office since 1971.

Democratic Candidates

Matt Pelikan (Endorsed Candidate)
Matt Pelikan is an openly gay, Democratic activist and attorney. Pelikan is running on a platform of equity and diversity. He supports divestment from fossil fuels, protecting Minnesota’s waters from mining, and opposes “dangerous” pipeline projects.

Keith Ellison
Keith Ellison has served in the U.S. Congress for the 5th District since 2007. Ellison has a progressive agenda and has been an ardent Trump critic. He calls himself a champion for labor and workers’ rights. Ellison sponsored a $15 minimum wage bill and led the charge against wage theft at the federal level. He is in favor of a Single-Payer health care plan, a union advocate, and intends to fight any efforts to undermine the Clean Power Plan. Ellison is expected to wade into national issues.

Debra Hilstrom
Debra Hilstrom is a nine-term State legislator from Brooklyn Center and prosecutor in the Anoka County Attorney’s office. She touts her record in taking on the bank lobby, standing up to credit card companies, taking a stand against corporate special interests, fighting for utility ratepayers, and protecting vulnerable adults and senior citizens.

Mike Rothman
Former Minnesota Commerce Commissioner Mike Rothman described his role as the State’s consumer watchdog. While Commissioner, he highlights his efforts to protect seniors from exploitation, fight the opioid epidemic, and conserve the State’s lakes. He is an advocate for renewable energy.

Tom Foley
Tom Foley served as a Ramsey County Attorney for sixteen years. Foley’s platform focuses on the opioid drug crisis, cybersecurity, safeguarding schools, environmental crimes, elderly abuse, and health care fraud. Foley is a former Vice Chairman of the National Indian Gaming Commission.

Republican Candidates

Doug Wardlow (Endorsed Candidate)
Doug Wardlow is a former State Representative from Eagan. Wardlow promotes conservative values and seeks to safeguard religious freedom, defend Minnesotans’ right to keep and bear arms, defend the constitution, and ensure legal defense laws protect the lives of unborn children.

Robert Lessard
Bob Lessard served in the State Senate from 1977 to 2001 (he aligned himself with the Democratic party until 2001 when he switched to the Independence party). His messaging is centered around not using the Attorney General’s office as a political platform and advocating for wildlife conservation.

 

U.S. Senate

Senator Al Franken resigned from his seat last January in light of sexual harassment allegations.  Governor Dayton appointed his then-Lieutenant Governor, Tina Smith, to the U.S. Senate. As an appointee, she must run for re-election in the first general election after her appointment.

Democratic Candidates

Tina Smith (Incumbent/ Endorsed Candidate)
Tina Smith, former Lieutenant Governor to Mark Dayton, serves on the Senate Committee on Energy and Natural Resources and the Senate Committee on Indian Affairs. She has been a long-time champion of rural broadband funding and early childhood education. Smith supports clean energy research, extending the tax credits for renewable energy, and supporting biofuels. Addressing the effects of the opioid crisis on tribal communities and the lack of housing in Indian communities are two issues she is advocating. Smith also introduced legislation to allow tribes to have more control over how federal hunger programs are administered.

Richard Painter
Former Chief Ethics Counsel to President George W. Bush and University of Minnesota law professor, Richard Painter switched parties following the election of Donald Trump. He is running on an anti-corruption message. He opposes copper/nickel mining, supports tax credits to grow solar farms, and trade policy that promotes the clean energy sector.

 

1st Congressional District

Republican Candidates

Jim Hagedorn (Endorsed Candidate)
Jim Hagedorn served as a legislative assistant to former Congressman Stangland, and spent time as the Director for Legislative and Public Affairs for the Financial Management Service agency in the U.S. Department of the Treasury. Hagedorn ran for the seat in 2016 and lost to Congressman Tim Walz by less than 3,000 votes. Hagedorn has focused on agriculture issues, regulatory and tax reform, gun rights, and anti-abortion issues.

Carla Nelson
Carla Nelson is a sitting Minnesota State Senator from Rochester in her 3rd term.  While she did not received the GOP endorsement, she has been endorsed by the National Rifle Association, which is important in the rural district.  Nelson is focusing on balanced budget and fiscal responsibility, health care, and tax reform.

 

5th Congressional District (Open Seat)

The 5th Congressional District is reliably Democratic.  Barring a major issue, the Democrat who wins the primary is a sure bet to win the general election.

Democratic Candidates

Ilhan Omar (Endorsed Candidate)
Ilhan Omar was elected to the Minnesota House of Representatives in 2016, becoming the first Somali and Muslim-American woman elected to office in the United States.  As such, she received nationwide publicity. She  has said she will focus on economic justice, education, criminal justice reform, Medicare for All, and a just immigration system.

Margaret Anderson-Keliher
Margaret Anderson-Keliher is a former state representative from Minneapolis.  She served as the second female Speaker of the Minnesota House from 2007-2010.  She is currently the President and CEO of the Minnesota High Tech Association, a technology non-profit that focuses on STEM education, workforce development, and jobs of the future. Her campaign platform centers on education, affordable housing, gun reform, Medicare for All, and jobs and infrastructure.

Patricia Torres-Ray
Patricia Torres-Ray was elected to the Minnesota Senate in 2006, becoming the first Latina lawmaker in Minnesota.  She studied law at the University of Nariño in Colombia and moved to Minnesota in 1987.  Her early work in Minnesota focused on foster care placement with immigrant families.  Her campaign has focused on education, immigration, climate change and pushing more renewable energy, and Medicare for All.

Jamal Abdulahi and Frank Drake (DFL) are also running in tomorrow’s primary.  Abdulahi is a political newcomer with ties to the Somali community in Minneapolis. Drake has run for the seat in past elections

 

8th Congressional District (Open Seat)

The 8th Congressional district has been historically Democratic for much of the 20th and early part of the 21st century most likely due to the strong base of organized labor in the major industries in the district. However, the politics of the 8th have begun to shift and it is now a toss-up. President Trump won the 8th District with 54 percent of the vote. Congressman Rick Nolan (D) announced that he is retiring to run as the Lieutenant Governor on the Lori Swanson ticket. Additionally, Democratic activists left the endorsement convention with no endorsement as none of the candidates could get enough votes to get over the 60 percent threshold for an endorsement.

Democratic Candidates

Jason Metsa
Jason Metsa was elected to the Minnesota House of Representatives in 2012.  He has proposed a “Northern New Deal” which would provide for debt-free higher education, Medicare for All, and economic reforms such as a $15 per hour minimum wage, a federal jobs guarantee, paid family leave, and collective bargaining rights.

Joe Radinovich
Joe Radinovich served one term in the Minnesota House from Representatives from 2013-2014.  His campaign has focused on protecting collective bargaining rights, Medicare for All, campaign finance reform, child care costs, and protecting Social Security and Medicare.

Michelle Lee
Michelle Lee is a former news anchor with wide name recognition.  While not a establishment politician, her name recognition and connection with voters during her decades in the media make her a contender.  Her campaign focuses on rural broadband, Medicare for All, student debt, affordable education, and protecting Social Security and Medicare.

Kirsten Hagen Kennedy and Soren Christian Sorenson are also running in tomorrow’s primary. Kennedy is the mayor of North Branch, a city in the southern part of the congressional district.  Sorenson is an activist focused on environmental issues.

Six Weeks Until the GDPR: Is Your business ready?

The far-reaching European General Data Protection Regulation (GDPR) takes effect on May 25, 2018. Yet, with only six weeks to go, many companies are still unaware that their businesses must comply with the GDPR or face large fines. The GDPR doesn’t just apply in the European Union; it can apply to companies both inside and outside the EU if they market goods or services to EU-based customers, or have any EU-based operations. The GDPR also covers all types of businesses, from technology companies to banks, manufacturers, and even online vendors. If your business touches the EU, and you deal with any data from people living in the EU, you need to evaluate your GDPR readiness. Here are a few questions to ask yourself about how the GDPR might apply to your business:

Does the GDPR apply to your company? The GDPR applies to U.S. and other Non-EU companies. For example, the GDPR could directly impact your business if any one of the following situations applies to your company:
  • You have any places of business in the EU; OR
  • You receive data from any European companies; OR
  • You sell products or services to customers in the European Union.

Are you aware of the possible penalties? The fines for GDPR violations can be massive, permitting the European privacy authority to levy fines of up to 4% of a company’s annual worldwide revenue, or €20 million (about $25 million), whichever is higher.

Has your company generated required GDPR compliance documentation? The GDPR requires organizations to affirmatively demonstrate compliance, for example, by creating publicly available GDPR-compliant privacy policies, and by generating detailed internal data inventories, audits, and data breach response plans. U.S. businesses can meet some of these obligations by joining the Privacy Shield program administered by the U.S. Department of Commerce. These obligations must be met before May 25, 2018, not after receiving a knock on the door from a regulatory agency.

Does your company have GDPR-ready Data Protection Agreements in place? The GDPR requires companies to have formal GDPR-compliant data processing agreements in place whenever sharing or transferring relevant personal data to vendors, clients, or partners. Are you using consultants, cloud services, or other vendors to assist in storing or managing personal data? If so, you need to make sure your company has a data protection agreement with your vendors.

Is your company prepared to enforce personal data rights? If you collect or receive personal information covered by the GDPR, including, for example, usernames or email addresses, you have certain obligations to the people behind that data. You should evaluate whether you are prepared to enforce the rights and legal requests of those people under the GDPR, including the rights to access, delete, or correct their data.

If you want to know more about the GDPR, or need help getting your business GDPR-ready by May 25, 2018, contact your attorney today—the deadline will be here before you know it.

Legislative Client Alert: Franken Fallout

Following sexual harassment allegations, Sen. Al Franken (D-MN) announced on Thursday, December 7, that he will be resigning in “the coming weeks” from his U.S. Senate seat.

Governor Mark Dayton is expected to appoint a replacement in the coming days. The only requirements for the replacement are that the person be a Minnesota resident, at least 30 years old, and a U.S. citizen. This person will serve until a special election is held in November 2018. The Senator elected in the 2018 special election will serve for two years until November 2020, the time Franken’s term would have been up. It is not known who Governor Dayton will appoint, but Lt. Governor Tina Smith has been mentioned as a strong contender. Smith is not expected to run for the seat in 2018.

Should Lt. Governor Tina Smith be appointed, an interesting scenario will unfold. As President of the Senate, state Sen. Michelle Fishbach (R-Paynesville) would become the Lt. Governor, and a special election would need to be held to replace Sen. Fischbach’s seat. The Republicans currently hold the state Senate by only one seat.  Complicating that margin, state Senator Dan Schoen (DFL-Cottage Grove) is also resigning amid sexual harassment allegations. Should the DFL hold Schoen’s seat and flip Fishbach’s, the DFL would regain the majority.

The November 2018 election in Minnesota will be momentous in that both U.S. Senate seats (Sen. Amy Klobuchar’s term will be up) will be on the ballot, all congressional seats, as well as the Governor’s seat, all state-wide offices, and all Minnesota House seats.

All eyes will be on Minnesota.

Minnesota Supreme Court Upholds Governor’s Veto of Legislative Appropriations

The Minnesota Supreme Court has upheld Governor Mark Dayton’s line-item veto of appropriations for the Minnesota House and Senate for the 2018-2019 biennium. The Court acted with only a single dissent.

At the conclusion of the 2017 regular legislative session and following a brief special session, Democratic Governor Mark Dayton signed into law several omnibus tax and budget bills that contained provisions of which he disapproved. In an effort to force the Republican-controlled Legislature back to the negotiating table on those contested items, the Governor line-item vetoed the appropriations for the House and the Senate beginning July 1, 2017.

Response

In response to the line-item veto, the Minnesota House and Senate commenced litigation in Ramsey County District Court, contesting the Governor’s action on grounds that it violated the Constitutional separation of powers, by preventing the Legislature from exercising its functions by depriving it of fiscal resources. The Legislature prevailed in the Ramsey County District Court, where the Governor’s line-item veto of the legislative budget was held to be an unconstitutional act. In the meantime, the Legislature and the Governor had stipulated to continued legislative funding until October 1, 2017.

The Supreme Court expressed great reluctance to enter into a political dispute between the other two branches of State government, the Executive and the Legislature. The Court asked attorneys for the Legislature to produce detailed budget information indicating how long the Legislature could continue to operate if it expended reserve funds and transferred other funds from Legislative operations not affected by the Governor’s veto. In the end, the Court concluded that the Legislature, with the benefit of the reserves and related funds, could continue to operate until the February 20, 2018 beginning of the next regular legislative session. At that time, the Legislature could override the Governor’s line-item veto, or the Legislature and the Governor could enter into negotiations over the items to which the Governor had objected at the conclusion of the 2017 session.

Looking Forward

The Court left the door open to taking another look at the issues should the legislative budget run out, conceding that if it does, “Minnesotans may soon be deprived of their constitutional right to three independent branches of government, each functioning at a level sufficient to allow the exercise of the constitutional powers committed to each branch.” The Court encouraged the Legislature and Executive to “promote the constitutional cooperation Minnesotans expect and deserve.”

Legislative leaders from both sides indicated that the uncertainty of legislative funding, combined with deteriorating relationships between the Governor and Legislature, will lead to an unproductive 2018 legislative session.

Big Changes Ahead for Minnesota LLCs: What you need to know—and do

Big changes are on the horizon for the thousands of limited liability companies (LLCs) organized under Minnesota law. The Minnesota Revised Uniform Limited Liability Company Act (codified in Chapter 322C of the Minnesota Statutes, which replaces the previous laws under Chapter 322B) will apply to all Minnesota LLCs effective as of January 1, 2018, and will functionally amend the governing documents of LLCs that do not take any action in anticipation of the change. While the new LLC Act ultimately gives LLCs greater flexibility, it’s important that all LLC owners understand the changes—and make preparations ahead of time—to ensure their LLCs are structured to reflect the way they want the businesses to operate.

Here’s what you need to know about Minnesota’s new LLC Act—and what you need to consider.

Why the new law?

It seems like LLCs have been around forever, so many people are surprised to learn that the first Minnesota LLC Act was adopted by the Legislature in 1992. Extremely popular within Minnesota’s business community, LLCs provide similar liability protections as do corporations but with greater flexibility, fewer requirements and the advantage of avoiding entity-level taxation. In essence, LLC members get the protection of shareholders of a corporation, while retaining the flexibility to operate their business like sole proprietorships or partnerships.

However, the fundamental structure and framework of the original Minnesota LLC statute was lifted directly from Minnesota’s Corporate statute. By contrast, most other states have adopted LLC statutes based on a partnership model and give more flexibility to the members to set their own governing structure in a negotiated operating agreement.

The adoption of the new LLC Act brings Minnesota LLC law into greater conformity with LLC statutes throughout the country. In particular, it gives members significant latitude in crafting an operating agreement that covers custom business arrangements, along with the freedom to adjust that agreement as the business and partnership evolves.

Do I need to worry about the LLC law change?

  • LLCs formed on or after August 1, 2015: No—you’re covered.
    Newer LLCs have been subject to the new LLC act from their inception. The January 1, 2018 deadline has no implications for these LLCs.
  • LLCs formed prior to August 1, 2015: Yes—unless you’ve proactively made changes already.
    Older LLCs have been allowed to continue operating under the original LLC Act. Seeing the January 2018 deadline approaching, some LLC owners have proactively elected to amend their agreements to take into account the new LLC Act. Most, however, have not made these changes, and should be aware of the fast-approaching January deadline.

What happens if I do nothing?

The new LLC Act includes “bridging language” to provide some level of continuity for LLCs that take no action. Certain default provisions from the original LLC Act will automatically carry over. These default provisions include provisions relating to distribution rights, voting rights and dissenters’ rights. The bridging language also contemplates that the existing LLC documents—including the articles of organization, bylaws and member control agreement—will be deemed automatically included in the “operating agreement” under the new LLC Act.

What are the big changes I should know about?

Here are some of the most important changes in the new LLC Act that LLC owners should be aware of:

  • Management Structure and Framework: While the original LLC Act imported corporate concepts such as management by a board of governors, the new LLC Act is based on partnership statutes and allows for greater flexibility in governance matters. Under the new LLC Act, an LLC has three options for governance:
    1. Member-managed: Decision-making resides with the members, with each member having equal rights in management; this is the default management structure under the new LLC Act.
    2. Board-managed: Mirroring corporate structure, members elect a board of governors that manages the LLC and oversees the executive(s) of the LLC.
    3. Manager-managed: One or more persons or entities has authority and control over the operations of the LLC.
  • Governing Documents: The new LLC Act limits governing documents to the articles of organization and an operating agreement. Almost all substantive terms are incorporated into the operating agreement, which typically includes the terms previously contained within the articles of organization, bylaws and member control agreement under the original LLC Act.
  • Oral Governing Agreements: While the original LLC Act stipulated that a member control agreement must be in writing and signed by the members, the new LLC Act allows that the operating agreement may be written, oral or even implied.
  • Distributions: Under the original LLC Act, the default rule provided for the distribution of cash or other assets to the members in proportion to their capital contributions. The new LLC Act changes the default rule to provide for the distribution of cash or other assets to the members per capita—i.e. in equal shares to each member.
  • Voting Power: The default rule under the original LLC Act gave voting power to members in proportion to their capital contributions. The default rule under the new LLC Act provides that the members will have equal voting rights, regardless of the amount of their capital contributions.
  • Corporate Formalities: The original LLC Act, closely mirroring Minnesota’s Corporate statute, incorporates corporate case law relating to piercing the corporate veil of limited liability protection. The new LLC Act limits the applicability of such corporate case law. Most importantly, the failure of an LLC to observe corporate formalities can no longer be used to impose liability on the members, managers or governors of an LLC.
  • Fiduciary Duties: The new LLC Act provides greater flexibility to limit or modify fiduciary obligations of the members, managers and governors that are responsible for managing an LLC.

Why shouldn’t I wait to amend my LLC’s governing documents?

The LLC law change gives LLC owners a great reason to re-examine their LLC documents and agreements, as well as to amend these documents to better reflect how their businesses operate today. Moreover, waiting until the last minute is never a smart business practice. Taking a proactive approach to amending an LLC’s governing documents not only prevents unintended consequences—acting now yields several advantages:

  • Increased Flexibility: Businesses thrive on flexibility. Under the new LLC Act, almost all statutory defaults can be modified in the operating agreement. For example, for some LLCs, it may make sense to adopt a different management structure (e.g. manager-managed or member-managed).
  • Mitigate the Risk of Oral Amendment: As noted above, the new LLC Act allows that an LLC’s operating agreement may be oral, written or even implied. To avoid the risk of inadvertent, unintended or otherwise unwanted changes to an LLC’s governing documents, it’s important to add a provision to its governing documents expressly providing that all amendments must be in writing.
  • Address New Statutory Defaults: While the new LLC Act allows an LLC significant latitude to change its default provisions by contract, for this flexibility to be useful, the LLC needs to ensure it has a comprehensive operating agreement that includes its preferred terms, and modifies the new statutory default provisions included in the new LLC Act, as desired.
  • Maintain Existing Rights of Members: LLC owners need to pay special attention to ensure that the new LLC Act doesn’t deprive members from valuable rights that were provided by default in the original LLC Act. For example, the original LLC Act’s default rules provided members of an LLC with preemptive rights, meaning members would have the right to participate in future offerings of equity to prevent dilution. The new LLC Act includes no such statutory default. This means that if an LLC does nothing, its members will lose their preemptive rights by default. In order to preserve the existing rights of the members, preemptive rights would need to be incorporated into in the governing documents of the LLC.
  • Filling in Gaps in New Act: The new LLC Act leaves certain gaps that the original LLC Act did not. To prevent unintended consequences, it may be useful to amend the governing documents of an LLC to address areas in which the new LLC Act is silent. For example, the original LLC Act includes detailed provisions on member meetings; the new LLC Act does not.
  • Consolidation of Agreements: To simplify the transition and avoid future confusion or disputes, it’s a good idea to consolidate provisions previously spread throughout an LLC’s articles of organization, bylaws and member control agreement into a single comprehensive operating agreement.
  • Limitation on Certain Remedies: To protect the business from the actions of a single member, it may be advisable to incorporate language limiting the availability of alternative remedies. For example, an operating agreement could contractually limit the availability of remedies such as a forced sale in cases in which a member brings legal action against an LLC.
  • Nomenclature Changes: Small changes in statutory definitions may have significant implications for the meaning and interpretation of a legal agreement. Addressing changes in nomenclature between the original LLC Act and the new LLC Act enables business owners to mitigate risks arising from ambiguous defined terms. For example, while the original LLC Act referred to “membership interests” consisting of “financial rights” and “governance rights,” the new LLC Act contains the same general concepts—but defines them differently. The new LLC Act uses the term “transferable interest” to refer to financial rights and does not include an analogous defined term for “membership interests” or “governance rights.” Amending the governing documents of an LLC allows for greater precision by incorporating the new statutory defined terms.

Proactively address change

Ultimately, it’s better to address the changes of the new LLC Act proactively rather than passively relying on the bridging language contained in the new LLC Act to fill in the gaps left by the change in law. LLC owners have a natural opportunity to revisit governing documents that may not have been updated for many years, revise them to fit the way the company is operating today, and ensure it continues to operate smoothly for years to come.