COVID-19 UPDATE: SUMMER 2020
The BLG Business Venture Clinic is back from its exam season hiatus! Throughout the summer we will continue to provide local entrepreneurs with free legal information, but COVID-19 has impacted our operations in two ways:
 
1. We are currently unable to meet with clients in person. This also means our drop-in hours at the Hunter Hub and with other community partners are cancelled until further notice. However, we can easily communicate with you through email and phone or video calls. We are also looking into hosting virtual drop-in sessions for your quick legal questions.
 
2. Due to COVID-19, our response time may be delayed. Responses to initial inquiries can take up to 7 days, and work product may take up to 6 weeks depending on the complexity of your legal needs. We appreciate your patience during this challenging time. 
 
Please note that the clinic is run by law students, meaning we can only provide legal information, not legal advice. We can create memos on specific issues and draft basic legal documents, but we cannot advise you on what actions you should take. If you require legal advice, we strongly suggest contacting a lawyer.

For other COVID-19 legal information, our partners at BLG have created a COVID-19 Resource Centre available here.

Get in touch with us by filling out the form on our Contact page. We also recommend taking a look at this blog post for key tips about how to prepare for a meeting with us so we can best help you and your business. 

Follow us on Twitter, Instagram, Facebook, and LinkedIn for more updates!

​

Many small businesses are based around an idea, invention, process, or improvement, the value of which is often then bedrock of the company. The legal field of intellectual property deals with protecting ideas and inventions, but it is a complex and unintuitive area even for lawyers (some in the profession make entire careers in only part of IP law). This post may help you find the category that suits your work and give hints about next steps.

​Trademarks
Trademarks protect names and logos. Trademarks are about protecting your public image, not your creative property. Trademarking “Xerox” prevents another business from using that name but not from using their photocopying technology. If you are attached to a name
Trademarks are federally registered under the Trade-marks Act.[1] This affords national protection of names and logos once registration is complete. There is a $330 application fee.[2] It is illegal to register a trademark consisting of certain prohibited features such as deceptive marks, words in other languages, or a similarity to official trademarks used by the Canadian government or the UN.[3] An application may also be refused if it is confusingly similar to a previously filed trademark.[4] You can do a search yourself in the Canadian Trademarks Database[5] to look for similar trademarks before applying. Once filed, the Canadian Intellectual Property Office will do its own search of the database for registered or pending trademarks that are similar, examine the application for compliance with the Trademarks Act and Regulations, and then publish the trademark publicly for two months. During that time, anyone can file an objection to your trademark, at which point you enter in the formal opposition process.[6] If the application is approved and no one opposes, the trademark will be registered.[7] Trademarks must also be renewed periodically.

A Note on Symbols
Symbols like ® or ™ are commonly used to denote trademarks, but this is not a legal right and is not granted by the Canadian Intellectual Property Office.[8] This is simply a business practice that has developed and does not necessarily equate with actual ownership of a registered trademark. There is also nothing stopping you from using the ™ symbol without actually registering the trademark, though unregistered trademarks are more difficult to enforce if legal challenges arise. It is recommended that you seek the advice of a trademark agent before proceeding with obtaining a trademark. The Canadian Intellectual Property Office keeps a list of registered trademark agents.[9]

Trade Secrets
This is a form of intellectual property protection that arises automatically when you use secret information in your business. The problem in your case is that you are selling the information itself, as opposed to a by-product of that information (trade secrets are often the process by which a product is created).[10] Also, if a competitor were to independently come up with the same process, trade secret law would not protect you.
Trade secrets are different from patents or trademarks in that they are not registrable. Technically, you do not “own” a trade secret, but rather you have rights to it that can be protected in contract. The most relevant protections for many businesses are non-disclosure and confidentiality agreements, which allow you to take legal action against others who disclose the information. The rights granted depend largely on the wording of the contract.

Patent
Patents are the best-known and strongest form of IP protection in Canada. Generally speaking, patents are available for physical things like inventions, improvements, and manufacturing processes. There is also precedent for patenting a business process[11] and other potential forms exist. Whether a particular thing can be patented is often only known to experts in the field with substantial experience and evaluated on a case-by-case basis. The CIPO has a database of patent agents.[12]
It is worth noting that applying for a patent is known to be an expensive process. The fees are higher than those for a trademark, and the cost of hiring the patent agent to create the patent is substantial. It is also worth noting that patents are publicly available, so your invention would be in the patent database. You would have a cause of action against anyone who profited from your process without your consent, but the process would be available to potential clients and competitors.

Summary
A registered trademark allows you to protect your name and image. Trade secret law, enforced through NDAs and confidentiality clauses, can protect against clients or competitors disclosing or using your property. A patent may or may not be possible, and it is the most expensive option and requires public disclosure of the process, but offer the strongest and clearest protections.

Kevin Lee is member of the BLG Venture Clinic and is a second-year law student at the Faculty of Law, University of Calgary.

REFERENCES
[1] Trade-marks Act, RSC 1985, c T-13 [TM Act].
[2] Canadian Intellectual Property Office, “Complete list of fees for trademarks”, 28 Apr 2017, online: <http://www.ic.gc.ca/eic/site/cipointernet-internetopic.nsf/eng/wr04194.html>.
[3] A full list can be found under the heading “What you can’t register”, see Trademarks Guide, Canadian Intellectual Property Office, Government of Canada (14 June 2019), online: <www.ic.gc.ca/eic/site/cipointernet-internetopic.nsf/eng/h_wr02360.html> (TM Guide).
[4] Ibid.
[5] Canadian Intellectual Property Office, “Canadian Trademarks Database”, 28 Apr 2017, online:  www.ic.gc.ca/app/opic-cipo/trdmrks/srch/home?lang=eng
[6] TM Guide, supra note 9.
[7] Ibid.
[8] Ibid.
[9] Canadian Intellectual Property Office, “Find an intellectual property agent”, 15 Aug 2019, online: <www.ic.gc.ca/eic/site/cipointernet-internetopic.nsf/eng/h_wr04549.html>.
[10] What is a Trade Secret?, Canadian Intellectual Property Office, Government of Canada (1 Dec 2015), online: <www.ic.gc.ca/eic/site/cipointernet-internetopic.nsf/eng/wr03987.html>.
[11] Amazon Inc v Canada (Attorney General), [2010] 4 FCR 541.
[12] Ibid.

You have a business idea and need some assistance to draft documents. You have reached out to the BLG Venture Clinic (the “Clinic”) to set up an appointment. How can you best prepare for this meeting so you can ensure you receive the best possible service?

1. BE PREPARED TO PROVIDE A SIMPLIFIED DESCRIPTION OF YOUR BUSINESS
In order for us to properly provide you with services, we will need to understand your business. The more simply you can articulate your business the better. Even if we are preparing a standard document for you, it is important for us to understand what your business is because it may be subject to certain regulations. Before your meeting with the clinic, try to describe the nature of your business in a paragraph.

2. BE PREPARED TO ANSWER QUESTIONS ABOUT WHY YOUR BUSINESS WILL BE SUCCESSFUL
During your meeting you may be asked, “why do you think your business plan will work?” We are not asking you this question to insult you. We are asking you this question to help us better understand your business. Perhaps you have discovered a way to provide an existing service more efficiently, or maybe you have created an entirely new product. Whatever the case, providing us with such information will be helpful in our understanding of your business.

3. PRIORITIZE WHAT SERVICES YOU ARE LOOKING TO RECEIVE FROM THE CLINIC
You may have long list of tasks that you need us to help you with. That is fine, however, it will be helpful for you and us if you prioritize what needs to be done first. Providing us with 1 or 2 tasks at a time will allow for a more efficient process in completing your checklist. The great thing about the clinic is that we can continue to work with a client for an extended period of time. Setting up a business takes time and rushing the process can lead to failure.

4. PLEASE BE PATIENT
Know that the process of preparing your documents will take some time. All the clinic participants are volunteers and do our best to prepare your documents in a timely manner. However, please note that the preparation of your documents is a multiple step process. After meeting with you we may have to conduct research or speak to the head of the clinic to clarify questions regarding your matter. Next, we will complete a draft of your document and send it to an advising lawyer for review. The expectation is that the advising lawyers will return the document with comments within 3 weeks after receiving it. Once we receive the advising lawyer’s comments, we may amend your document further before sending you the final product.
 
Again, our goal is to get you your product in a timely manner. Feel free to send us emails requesting an update on your file throughout the process. We would like to thank you in advance for your patience.

5. PLEASE REMEMBER THAT THE BLG CLINIC CANNOT PROVIDE LEGAL ADVICE
If you are looking for legal advice, then you will likely have to see a lawyer. Clinic members are not allowed to provide legal advice since we are still law students. However, we can provide you with legal information. The following provides an explanation of legal information and legal advice:
 
“Legal information: explains the law and the legal system in general terms. Such information is not tailored to a specific case.
 
Legal advice: applies the law, including statute and case law and legal principles to a particular situation. It provides recommendations about what course of action would best suit the facts of the case and what the person wants to achieve.”[1]
 
An example of how this may impact the services you receive from the clinic can be explained in the context of preparing a Shareholders’ Agreement. While the clinic may help you prepare a Shareholder’s Agreement, or provide you with a list of the different type of restrictions that can be attached to shares, we cannot advise you on what restrictions you should attach to such shares based on meeting you had with potential investors.
 
If you are unsure whether your matter requires legal information or advice, still make an appointment. Even if your matter falls under the category of legal advice, there may be other matters that we are qualified to assist you with.
 
For more information contact the BLG Venture Clinic*
 
Suleiman Semalulu is member of the BLG Venture Clinic and is a third-year law student at the Faculty of Law, University of Calgary.

*Due to the evolving COVID-19 situation and the University of Calgary's decision to move all in-person classes to online delivery, the clinic has cancelled all drop-in hours and has limited appointments for the remainder of the 2019-2020 academic year. We ask you contact us directly at businesscliniccoordinator@gmail.com for more information.

REFERENCES
[1] Centre for Public Legal Education Alberta,”Legal Information vs. Legal Advice. What’s the Difference?” (2019): online: CPLEA < http://www.cplea.ca/wp-content/uploads/LegalInfovsLegalAdvice.pdf>.

Climate Change is a central issue for businesses.  Mitigating and adapting to its effects is causing far-reaching transitions in sectors such as energy, land and agriculture, banking and finance, infrastructure, transport and industry.  As a result, we are seeing provincial and national attempts to price greenhouse gases (GHGs) such as Carbon Dioxide.[i]  These pricing mechanisms and their laws will impact businesses resulting in both opportunities and challenges.  It is increasingly valuable for any business looking to work directly or indirectly with natural resources to understand carbon pricing.  This is especially the case in Alberta.
 
Carbon Pricing in Alberta
1. Alberta’s Technology Innovation and Emissions Reductions (TIER) Regulation[ii]
The TIER regulation came into force on January 1, 2020 and applies to facilities that emitted 100,000 tonnes of CO2e or more per year of greenhouse gases (GHGs) in 2016, or a subsequent year.[iii]
As a start-up or small business involved in the natural resources sector, you may be thinking the scope of TIER does not apply to you.  However, a facility with less than emitted less than 100,000 tonnes of CO2e may be eligible to opt-in to the TIER if it competes against a facility regulated under the TIER regulation or emits 10,000 tonnes of CO2e or more per year and belongs to a sector with high emissions intensity and trade exposure.[iv]

2. Why Opt-in? Benefits of being regulated:
By opting in, facilities may apply to become exempt from the application of the federal Greenhouse Gas Pollution Pricing Act (GGPPA) for fuels whose emissions are included in their site reporting.  Currently, the GGPPA charge applies to fossil fuels used in Alberta, including those in the conventional oil and gas sector.  However, the GGPPA includes provisions to exempt facilities subject to provincial policies that meet the federal benchmark criteria.[v]  TIER meets federal requirements and therefore can protect regulated facilities from full costs of complying with the GGPPA, while achieving emissions reductions that is cost-efficient and tailored to Alberta’ industries/ priorities.
3. How to Opt-in?
a. Opt-in key dates[vi]:

• November 1, 2019 - Facilities which are opted-in under the Carbon Competitiveness Incentive Regulation for 2019 are automatically opted in to TIER
• December 1, 2019 - Opt-out for 2020
• January 1, 2020 - Federal fuel charge in force in Alberta - Start of TIER 2020 compliance period
• September 1, 2020 - Opt-in for 2020 or 2021 - Opt-out for 2021 - Facility specific benchmark application for 2020
• June 30, 2021 - Compliance report due for 2020
• September 1, 2021 - Facility specific benchmark application for 2021 - Opt-in/opt-out for 2022

b. Eligibility[vii]:
There are two pathways for a facility with emissions fewer than 100,000 tonnes of CO2e per year to opt-in to TIER:

• Pathway 1 - Direct Competition: The intention for allowing these facilities to opt-in to the Regulation is to address situations where facilities with less than 100,000 tonnes of CO2e compete directly with larger facilities that are automatically subject to the Regulation. Without opting-in, these smaller facilities could face higher per unit carbon cost, impacting competitiveness. If the facility produces a product listed in Table 1 from the TIER Opt-in Fact Sheet, it is eligible to opt-in.[viii]
• Pathway 2 - EITE Facilities: Facilities that belong to an EITE sector as defined in Section 4(1)(a) of TIER and had total regulated emissions of 10,000 tonnes in any year since 2017 or is expected to exceed 10,000 tonnes in its third year of commercial operation are eligible to opt-in. Table 2 from the TIER Opt-in Fact Sheet provides a list of EITE sectors that include at least one facility that met or exceeded the 10,000-tonne CO2e threshold.[ix]
  

​Renewable electricity facilities are also eligible to opt-in, unless any of the following criteria applies to the facility[x]:

1. The facility has a total nominal capacity of less than 5 megawatts.
2. The facility has entered into a renewable electricity support agreement under section 7(4) of the Renewable Electricity Act.
3. An economic benefit is being provided under a program or other scheme that is attributable to the electricity produced at the facility having been produced from a renewable energy resource 

Stay up to date on Carbon Pricing
Carbon Pricing in Canada is evolving.  There are current constitutional challenges against the federal GGPPA which may impact what rules apply to your business.  Additionally, consider that while TIER is the current carbon pricing regime in Alberta you may be subject to the GGPPA if you fail to opt-in.
 
It is beneficial to understand the applicable rules on carbon pricing.  There are legal and business implications depending on what rules you are subject to.  For more information on carbon pricing obligations and your business, it’s a good idea to consult with a qualified lawyer.
 
For more information on TIER and how it works, visit:
https://www.alberta.ca/technology-innovation-and-emissions-reduction-regulation.aspx
 
For more information on the GGPPA and how it works, visit:
https://www.osler.com/en/resources/regulations/2015/carbon-ghg/canadian-government-carbon-and-greenhouse-gas-legi
 
Bradley Mills is a member of the BLG Business Venture Clinic and is a third-year law student at the Faculty of Law, University of Calgary.

REFERENCES:
[i] Norton Rose Fulbright, “Climate change and Canadian federalism: examining the constitutional dispute sparked by Parliament’s Greenhouse Gas Pollution Pricing Act”, online at: <https://www.nortonrosefulbright.com/-/media/files/nrf/nrfweb/knowledge-pdfs/climate-change-and-canadian-federalism.pdf?la=en-ca&revision=>
[ii] Technology Innovation and Emissions Reduction Regulation, 2002, (Alberta) online at: <http://www.qp.alberta.ca/1266.cfm?page=2019_133.cfm&leg_type=Regs&isbncln>
[iii] Government of Alberta, “Technology Innovation and Emissions Reduction Regulation, Information for industry on Alberta’s approach to reduce emissions from large industrial emitters”, online at: <https://www.alberta.ca/technology-innovation-and-emissions-reduction-regulation.aspx>
[iv] Ibid.
[v] Government of Alberta, “TIER Regulation Fact Sheet”, online at: <https://www.alberta.ca/assets/documents/ep-fact-sheet-tier-regulation.pdf>
[vi] Government of Alberta, “TIER Opt-In Fact Sheet”, online at: https://www.alberta.ca/assets/documents/ep-fact-sheet-tier-opt-in.pdf
[vii] Ibid.
[viii] Ibid.
[ix] Ibid.
[x] Ibid.

The General Approach
​Corporations are a separate entity from its directors and officers; therefore directors and officers are not normally personally liable for a corporate action, [1] whether in contract, fiduciary duty or tort[2]. Unless the plaintiff (the corporation) can establish that a duty of care was personally owed by the directors, it cannot bring a case of negligence or breach of statutory duty against the directors[3]. However, if a director was personally a party to the commission of the tort, he/she will be personally liable.
 
Exceptions
There are many statutory sources of liability for directors such as under corporation legislation, employment obligations, workplace safety legislations and tax legislations. Of all liabilities that directors face, those relating to tax remittance are more likely to happen.
 
According to section 227.1(1) of the Canada’s Income Tax Act (ITA), when a corporation fails to deduct, withhold, remit or pay tax as required, directors are jointly and severally, or solitarily, liable with the corporation to pay. Also in the ITA, section 242 provides that where a corporation commits an offence under this act, any director of the corporation who directed, authorized, assented to, acquiesced in or participated in the commission is a party to and guilty of the offence. These offences can include failing to file tax returns, failing to remit taxes, failing to keep carry out compliance offers, making false statements on tax returns, and failing to keep records and documentation.
 
Defences 
There are two significant defences available. The business judgement rule provides that courts generally do not second-guess the business decisions of directors and officers. A court will not substitute its business judgements[4]. Director’s decisions only needs to have been reasonable in the circumstances which they were made. The decisions do not have to be the best course of action.
 
The due diligence defence is usually given by legislation imposing liability. The defence requires the director to show that he/she gave good effort to prevent the harm that occurred[5]. This defence protects a director from liability if he/she can show that they were actively engaged in activities designed to prevent the harm in question. 
 
Kara Cao is a member of the BLG Business Venture Clinic and is a second-year law student at the Faculty of Law, University of Calgary.

REFERENCES
[1] Blacklaws v. 470433 Alta. Ltd., [2000] A.J. No. 725, 7 B.L.R. (3d) 204 (Alta. C.A.)
[2] Mentmore Manufacturing Co. v. National Merchandise Manufacturing Co., [1978] F.C.J. No. 521, 40 C.P.R. (2d) 164 at 171 (F.C.A.), per Le Dain J.
[3] Montreal Trust Co. of Canada v. ScotiaMcLeod Inc., [1994] O.J. No. 2194, 15 B.L.R. (2d) 160 (Ont. Gen. Div.)
[4] Bryce C Tingle, Start up and Growth Companies in Canada: A Guide to Legal and Business Practice, 1st ed (Canada: LexisNexis Canada, 2005) at 192 [Tingle, Start Up & Growth Companies].
[5] Ibid., at 193. 

An estimated 70% of Canadian businesses have been victims of a cyber-attack. It is not as much of a question of if but rather when your business may face its own cyber-attack. Startups, in particular, are especially vulnerable, given the limited number of resources available. With margins being consistently thin, a data breach may be the difference between success and failure. It is, therefore, crucial that you’re aware of the risks and how to best mitigate them. 
 
Cyber incidents typically occur for the following three reasons[1]:

1. Human Error – employees falling prey to fraudulent phishing emails or other forms of malware.
2. Operational Failures – internal process failures that could be either software or hardware.
3. Attacks by cybercriminals – this could range from all sorts actors both internal and external to your organization.

To this end, to ensure that your business is adequately prepared, I have outlined a simple data breach response plan. Ideally, this is read before a data breach and accordingly steps are taken to ensure “breach-preparedness”.
 
The fallout from a cyber attack is best mitigated by being prepared and being aware of the protocols and responses that ought to be triggered. The NIST Framework outlines five core competencies (shown in the diagram below) underpinning any comprehensive cybersecurity policy.[2] I suggest that as a startup, you may want to be most focused on the identification stage of the NIST framework so that you’re able to assess what needs priority protection given the likely limited funds available.





​
​
​





The following steps help outline the approach that organizations need to adopt to create an effective cybersecurity policy.

1.     Governance Team: the executive needs to determine which departments, and which individuals from within those departments need to be assembled on the cyber governance team. A team leader should be appointed. Efforts of the team should be reported to a specialized committee or the board itself to ensure that they are addressing organization-wide concerns relating to potential cybersecurity threats. Understand your requirements under PIPIDA. I have written a more extensive article on how PIPEDA affects you and your business. In short, it applies to most private sector organizations operating in Canada.  For more information, see this blog post.

2.      Current Inventory: Once a governance team is established, it needs to make an accurate inventory of its data and information system. This inventory should include where the physical systems are located, which information is on it, and who has permission to access it. It should also specify any obvious existing vulnerabilities. The key here is to recognize what your systems are so that you can adequately do a full risk assessment in the next step

3.     Risk Assessment: Assess the most common threats that the organization is susceptible to. This could range from malware to phishing attacks. Depending on the complexity of your business and the data it handles, you may wish to seek guidance from a cybersecurity expert to help triage your systems. 
 
4.     Target Profile: Upon completion of the risk assessment, your organization should create a target profile and assess where the threat is most likely to stem from. This could include internal threats such as employees being unaware of various phishing or malware threats that may inadvertently expose your system. 
 
5.     Determine and Prioritize Gaps: By analyzing the gap between your target and current profile, you’re able to detect any significant discrepancies that need to be addressed by the governance team. 
 
6.     Implement Action Plan: Assess deficiencies in the existing cybersecurity regime:

• Education of employees – By assessing how your employees are interacting with data, you become aware of risks that factor into the preceding risk assessment. Are your employees aware of data loss prevention tools? Do they know how to flag potential breaches? Are users being trained on phishing and malware attempts? Privacy training programs are vital in ensuring that the likelihood and susceptibility of your business being hacked are minimized. 
• Incident Response Plans – Ensure that your business has simple incident response plans that delineate the manner in which employees are to report and identify a potential data breach. Your response plans should include:
• Record keeping strategies relating to a breach
• Insurance considerations ensure you have appropriate coverage
• Reach out your legal counsel to make them aware of your risk assessment. 
• Do a cost analysis of how much a cyber threat may impact you financially. Include costs such as: hiring a professional response team, notification costs, administrative and safeguard expenses as well as potential litigation costs. 

To conclude, cyber-incidents, breaches and attacks are costly. They are so expensive that they can be fatal to your growing business. Given the relatively high probability of a cyberattack, it is best to be prepared and to ensure that your team is well-versed in order to deal with any breach. Being “data breach prepared” is the only way to reduce the potential fallout. 
 
Daniel Frederiks is a member of the BLG Business Venture Clinic and is a second-year law student at the Faculty of Law, University of Calgary.
​
REFERENCES
[1] Imran Ahmad, Cybersecurity in Canada: A Guide to Best Practices, Planning, and Management
[2] Ibid.

Both stock grants and stock options are tools which employers use to motivate their employees to keep up the hard work. These tools would align the interests of the employees with that of the shareholders. They benefit the employees when working for a startup that lacks the pay/job security. These two forms of compensation will also discourage employees from quitting their jobs until the options or stocks vest. Options and grants, however, are very different from each other.
​
Stock Grants
Stock grants occur when the company pays part of the compensation of the employees in the form of corporate stock. In most instances, there are some restrictions on these granted stocks so that they can be designed to keep the employees working for the company for a set period of time. For example, if the company awards an employee 1000 shares of stock which will vest over two years, the employee will retain the stock only after two years of employment. He will lose the stock if he leaves the company prior to vesting.
When awarded stocks, the employees would have to pay tax on theses stock the same year they were issued. It should be noted that share can only be issued for past, not future, services.

Stock Options
Stock options give the employee the right but not the obligation to buy a set amount of the company’s stocks at a set price within a specified time frame. Stock options are always subject to vesting schedules. In most instances, option agreements expire once an employee leaves the company. As a result, vesting schedules is a great way to induce an employee to stay.
It should be noted that because of the fluctuation of the stock price, stock options can be valued less than the employee cost, making them worthless. By contrast, the net worth of stock grants are much more stable and will not become zero unless the company goes out of business.
Regarding the accounting issues, since 2001, companies have to record the “fair value” of the stock options on the day they are granted, which is recorded as a company expense.

The Advantages of Stock Grants and Stock Options
Both of stock grants and stock options can discourage the employees from quitting through vesting schedules. They are both important for the startup because the company does not need to pay cash directly. As a result, they put less pressure on the cash flow.

The Differences between Stock Grants and Stock Options
One obvious difference has been mentioned above: stock grants are always worth something, however, stock options can be worth nothing at all if the company's share price falls more than expected. Then, what can be done to encourage the employees to stay at the company in this situation? There are two solutions: 1. To keep existing options as is and to issue new options at a new attractive strike price. 2. To cancel old options and to issue new ones (TSXV rules require shareholder approval for this if the company cancels and reissues options within 12 months).

The other side of the argument is equally strong: the returns of stock options can be much higher although they are risky. Therefore, to balance the risk and reward profile of the compensation package, the employer may award some options along with some stock.[1]
From the employee’s perspective, stock options are also more flexible, because, unlike grants, they frequently have an early exercise option, so an employee intending to leave the company can exercise his options before the end of the vesting period and garner some of the benefit without having to stay at the company. [2]
 
Rong Gao is a member of the BLG Business Venture Clinic and is a second-year law student at the Faculty of Law, University of Calgary.
 
 
References
[1] Hunkar Ozyasar, Stock Grants Vs. Stock Options, https://budgeting.thenest.com/stock-grants-vs-stock-options-20564.html
[2] Alice Stuart, Stock Grants Vs. Stock Options, https://finance.zacks.com/stock-grants-vs-stock-options-5440.html

Overview: Founders, Business Plan, Value Proposition, Strategy 
To best understand the story of WeWork, it is easiest to start it its origin and founder. Adam Neumann (“Neumann”) appears to be the ‘classic’ entrepreneur. He was ambitious, charismatic, and overconfident. He was also a talented pitch artist, as it is no small feat to bring in over $12.8 billion in financing over his time at WeWork.
 
It wasn’t until his third venture, GreenDesk, that ultimately began Neumann’s path to start-up stardom. The idea was sustainable co-working space. The business proved to be profitable in its first year of operation, however, GreenDesk was sold as the two founders differed in opinion with their main investor on the company’s direction. The two founders then started WeWork, with the only change being a shift from a ‘sustainable’ to a ‘community’ concept.
 
The Founders identified an opportunity in the market following the economic crisis in 2008. Neumann stated, “During the economic crises, there were these empty buildings and these people freelancing or starting companies. I knew there was a way to match the two.”[1] This was part of the Founder’s value proposition – individuals and start-ups renting office space without the need and cost of renting out a space larger than they needed. The business model entailed WeWork taking out a cut-rate lease on a floor or two of an office building, chopping it up into smaller parcels and then charges monthly memberships to start-ups and small companies that want to work close with each other. This ‘working close with each other’ was the second part of WeWork’s value proposition. It identified ‘community’ as the main product to sell to its members. The WeWork ‘community’ entailed: open floor plans, lounge amenities, social activities, and floor plan arrangements that were designed to promote entrepreneurs to utilize fellow members' skills and networks.
 
Setting ‘community’ aside, and looking at the fundamental business plan, it is apparent it could be easily replicated. When a business does not derive its value from any type of intellectual property or technology, it must put rapid growth and brand recognition at the forefront of its strategy. WeWork did this on an incredibly impressive scale. WeWork used a large amount of financing to expand at a rapid pace into over 110 cities across 29 countries.[2]
 Financings: (Information from: https://craft.co/wework/funding-rounds)







​

Over the span of 9 years, WeWork grew to an incredible $47 billion placing it as the highest valued private company in the United States in early 2019, ahead of the likes of Space X, Airbnb, JUUL, etc.
 
However, the company came crashing down to earth when WeWork filed for its IPO in August of this year. The prospectus faced harsh criticism from public markets as investors and analysts balked at the overinflated valuation and expressed major concerns about the company. This ultimately resulted in WeWork having to pull its’ IPO. Some of the major issues identified by the public market were the business model, profitability prospects, corporate governance and leadership.[3]
 
Issues: 
a. Profitability and Business Model
The profitability of the company was put into question both short term and long term. WeWork had a net loss of $1.6 billion in 2018, and nearly $700 million in the first 6 months of 2019.[4] It is not uncommon for start-ups to faces losses in their early years but you want to see net loss is shrinking as a percentage of revenue. Whereas, with WeWork the prospectus stated, "These expenditures will make it more difficult for us to achieve profitability, and we cannot predict whether we will achieve profitability for the foreseeable future.”[5]
 
A major concern was if WeWork’s economics could survive the inevitable real estate slump. WeWork was charging high per-square-foot prices but was also locking itself into long-term leases at record rents. There was clearly the prospect of a tenant exodus amid a recession or to cheaper competition.[6] As of 2019, WeWork had committed to $47.2 Billion in future payment obligations but had only received $4 Billion in committed revenue from memberships.[7]
b. Leadership & Corporate Governance
The issues surrounding WeWork’s corporate governance were also a major issue. First and foremost, Neumann had an incredible amount of power in WeWork. His class ‘B’ and ‘C’ shares carried 20 votes to the 1 of the class ‘A’ shares. This allowed for him to still maintain control of the company, even after SoftBank had invested over $10 Billion. Neumann was also said to have engaged with some questionable conflicts of interest with WeWork. When the company undertook to trademark the ‘We’ name, it was then revealed Neumann and the other co-founder had already owned the ‘We’ trademark in a separate corporation and made the company purchase it for over $5.9 million.[8] WeWork also leased properties that Neumann had an ownership stake in. Neumann also received extremely low interest rate loans from the Corporation in excess of $30 million.[9] Neumann’s wife also received a senior management position with the company and was said to possess the power to appoint a new CEO if Neumann were to become incapacitated or die.[10]
 
Because of the failed attempt at an IPO, which now appears actually necessary for funding and not just an exit for investors, WeWork was in need of money quickly. SoftBank, which was already its largest investor, came to the rescue with a package of $5 billion. However, that package was not without scrutiny and further showcases the failures of the board. Specifically, criticism surrounding the package that Neumann received, which included: $198 million consulting position, $970 million for his stock, and a $500 million credit faculty. It is no surprise to hear of criticism considering reports stated that WeWork had delayed layoffs because it couldn't afford to pay severance.
 
Lessons: 
There are plenty of learning lessons for the start-up community and investors resulting from WeWork’s fall. Start-ups can mitigate many of these by ensuring proper safeguards developed in their initial startup process. Legal counsel acting for the company needs to ‘founder proof’ the organization, and prepare for the inevitable transition from the initial founder and management team to a more experienced and suitable one, likely endorsed by the major investors of the company.
 
In WeWork’s case, it faced major financial difficulties removing power from Neumann. This could have been avoided had there been tighter board governance and attention placed on the voting power within the organization. It should have been apparent to the board from the ill-advised spending and poor media attention Neumann was getting for the company that they needed to move on to a better management team. However, the power structure of WeWork made this extremely difficult and extremely expensive. WeWork was not ‘founder-proofed’.
 
Another oversight was that WeWork had no employment agreement with Neumann. For someone to be as important to a company as they touted, it was irresponsible of the board to not have an employment agreement with him. He could have just walked away at any point and this was even identified as a risk in the IPO disclosing. Ultimately, Neumann’s exit was needed, but this could have been a disastrous oversight.
 
As noted above, rapid expansion made sense for WeWork, but it must be undertaken at a responsible rate and direction. WeWork began venturing into areas that were not core to its business which required a lot of capital that was not producing income. Those new ventures coupled with its massive debt laden growth in real estate, became too costly for the company to become profitable. This profitability was quickly identified once the IPO disclosures became absorbed in the public market.
 
Another issue was the extremely optimistic $47 Billion valuation, which clearly wasn’t reality. This can hurt the company two-fold. First, a more realistic valuation would have not received as much push back from the public markets. Secondly, your investors will not be happy when their investment becomes much less valuable when the more realistic valuation is placed on the company.
 
Lastly, the corporate governance practices remain of vital importance. History shows that start-ups fail more often than succeed, so to reduce those chances of failure, planning and execution of these must be done at the outset of any venture. Ensure your start-up has the proper agreements and bylaws in place.
 
Ty Buhler is a member of the BLG Business Venture Clinic and is a third-year law student at the Faculty of Law, University of Calgary.

REFERENCES
[1] Jason Sheftell, “WeWork gives alternative to working at home with swanky buildings across NYC” (22 July 2011), online: New York Daily News <https://www.nydailynews.com/life-style/real-estate/wework-alternative-working-home-swanky-buildings-nyc-article-1.1044412>
[2] Allana Akhtar, “Adam Neumann built a global coworking empire. These are the cities with the most WeWork offices, and how much they cost.” (22 October 2019), online: Business Insider <https://www.businessinsider.com/global-cities-with-the-most-wework-offices>
[3] Jon Banister and Ethan Rothstein, “Here’s everything you need to know from WeWork’s landmark IPO Prospectus” (14 August 2019), online: Bisnow <https://www.bisnow.com/national/news/coworking/heres-what-you-need-to-know-from-weworks-ipo-prospectus-100361>
[4] Ibid.
[5] Ibid.
[6] Alex Konrod, “Inside the Phenomenal Rise of WeWork” (5 November 2014), online: Forbes <https://www.forbes.com/sites/alexkonrad/2014/11/05/the-rise-of-wework/#26eaf94a6f8b>
[7] Supra at note 3.
[8] Kevin Dowd, “10 big thing: WeWork’s IPO in peril” (8 September, 2019), online: PitchBook <https://pitchbook.com/news/articles/10-big-things-weworks-ipo-is-in-peril>
[9] Supra at note 3.
[10] Ibid.

Every company is required by law to have a board of directors. The board is responsible for the overall direction of the company and for making major decisions, such as hiring and firing senior management, approving a budget and keeping the company financed through equity investments and debt financing. [1] Therefore, building a strong, effective board of directors is very important for your company’s success.
There are some considerations when building the board of directors for a startup.
Have The Right Number Of Members
At the early stage, 3-5 directors are appropriate number for a new company. Too many directors at this stage will make scheduling an issue and be a drain on your funds. Generally, after the initial seed round, the company will have to allocate a board seat to the corporation which has led that seed round. If the founders still want to keep control of the board, it is better for them to retain two seats and the new investor to have one seat. It should be noted that when you accept a new investor, you might have to allocate a new board seat for it. Thus, if you do not want a certain person on the board, you’d better refuse that person’s investment.
At some point, if the board is getting too big or if the investment size doesn’t merit a board seat, instead of giving out more board seats, the company might allow investors to act as “observers.” That is, they can come to and participate in the board meetings, but they do not get a formal vote.[2]
In order to avoid a tie vote, you are highly recommended to have an odd number of board members.
Create A Diverse Board
Establishing a board of directors with different knowledge, expertise, age and backgrounds can be a powerful force for your company's success. A diverse board can provide the company with unique perspectives. You might need a marketing expert, a financial expert, and an exit expert on the board, as well as an advisor who might help guide decisions and aid in negotiations.[3]
Provide Good Compensation For Directors
Compensation is essential, so keep that in mind and consider giving them access to a percentage of stock instead of money. A common amount given is 1 percent of stock or expenses per quarter plus a meager retainer.[4]
Choose People Who Can Participate Fully And Share The Same Vision For The Company
It is important to have board members who can dedicate significant time to the company. The board members should not just be available for scheduled meetings, they should also be available when urgent issues arise. Thus, it is better to have board members who are in close proximity to the company as you can meet face to face when some important issues emerge.
Please keep in mind to establish a board of directors who share the same vision and long-term goals for the company. If the members have different vision, the probability of risk of pulling the company in opposite directions will increase.
Have Independent Directors
An independent director is not a founder or an investor or an employee of the company. Appropriate independent directors can bring their previous business and operating experience to the company. They can also provide the company with their contacts which might be a great asset for the company. However, you should always have independent directors who can establish a long-term relationship with the company and who would like to dedicate significant time to the company. It would be great if the independent directors can provide hands-on mentorship.
 
Rong Gao is a member of the BLG Business Venture Clinic and is a second-year law student at the Faculty of Law, University of Calgary.
 
References
[1] Samer Hamadeh, Adam Dinow, What you need to know about startup boards, https://techcrunch.com/2016/11/05/what-you-need-to-know-about-startup-boards
[2] Ibid.
[3] Alejandro Maher, Build Board of Directors: Simple How To Guide for Startups, https://www.upcounsel.com/build-board-of-directors-simple-how-to-guide-for-startups
[4] Ibid.

​According to the Canadian federal government Canada has more computers per capita than any other country worldwide. Canadians are also the heaviest internet users worldwide with the average Canadian spending 40 hours online per month. However, our collective internet use comes with risks to both individuals and business. In fact, 70% of Canadian businesses have been victims of a cyber-attack.
​
Therefore, it is crucial that Canadian businesses are aware of their responsibilities regarding how to handle personal information of their users.
PIPEDA is the Personal Information Protection and Electronic Documents Act. This federal privacy law for private-sector organizations outlines the ground rules for how businesses must handle personal information in the course of their commercial activity. PIPEDA applies to private sector organizations in Canada that process personal information in the course of commercial activity. All businesses operating in Canada and handle information that cross Canadian provincial or national borders are subject to PIPEDA.
In a 2017 holding the Federal Court of Canada has found that PIPEDA will apply to businesses established outside of Canadian jurisdictions as long as “real and substantial connection” exists between a business’s activity and Canada. This effectively includes all Canadian startups.
Factors include:

• Targeting of promotional efforts to a Canadian audience
• Location of end users
• Source of content
• Location of operator
• Location of host server

In general, businesses have no legal obligation to register with or notify the relevant data protection authorities in respect to processing activities. But when businesses collect data as well as process it then they have to be aware of the rights that individuals retain with respect to their data.

• Individuals have the right to:
  • Access to their data/copies of data
  • Rectification of errors in data
  • Withdrawal of consent
  • Right to complain to relevant data protection authorities
• Individuals do not have the explicit right to:
  • Deletion/right to be forgotten
  • Object to processing
  • Data portability

PIPEDA has 10 key principles that guide how businesses should handle their users data. I have outlined them below.

1. Transparency (openness) = organizations are to document and make available to individuals in an accessible form information about their policies and practices relating to data management of personal information.
2. Meaningful Consent = Under PIPEDA organizations must generally obtain an individual’s consent when they process that individual’s personal information. People have the right to access their personal information held by an organization. They also have the right to challenge the accuracy of this information. As of January 1st, 2019 the Guidelines for Obtaining Meaningful Consent are in effect (GOMC). The GOMC is intended to improve the existing consent model under PIPEDA. The GOMC was jointly issued with the offices of Information and Privacy Commissions in Alberta and British Columbia.

The GOMC emphasize the following elements:

1. Key Elements being collected
   1. Personal information being collected
   2. With whom personal information is shared (parties)
   3. Purpose of collection, use and disclosure (collectively known as “processing”)
   4. Risk of collection, use and disclosure
2. Allow individuals to control the level of detail they get and when
3. Provide individuals with clear binary choices when asking permission to collect, use or disclose data (yes or no questions)
4. Be innovative and creative
5. Consider the consumer’s perspective
6. Make consent a dynamic and ongoing process
7. Be accountable: Stand ready to demonstrate compliance

 

1. Purpose limitation = organizations are required to identify the purposes for which information is collected before at collection itself. Indiscriminate collection without purpose is not permitted. Information may only be used for the purpose it was collected and not beyond that scope.
2. Data minimization = Information may only be collected as to fulfill the purpose of the objective of collection and not beyond it.
3. Proportionality = Overriding obligation that organizations may only process information for purposes that a reasonable person would consider appropriate in the circumstances.
4. Retention = (linked to data minimization) information may only be retained for as long as it is required to fulfill the purpose of collection
5. Accountability = Organizations are responsible for protecting personal information under their control including personal information that they transfer to third parties for processing. Organizations must identify an individual who is responsible and accountable for ensuring compliance with the privacy principles. This person is the ‘Data Protection Officer’. This is expressly required by PIPEDA, PIPA Alberta and PIPA BC. Interestingly, no sanctions exist for not appointing a privacy officer.
6. Safeguarding = Canadian privacy statutes contain specific provisions relating to the safeguarding of personal information. This includes provisions that require organizations to implement reasonable technical, physical and administrative measures to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, modification or destruction.

 
PLEASE NOTE:

• PIPEDA does not apply to personal information held by federal government organizations
• Not-for-profit, charity groups or political parties.

 
Appointment of Processors
Under PIPEDA any organization is required to use contractual or other means to provide a comparable level of protection while the information is being processed by a third party. The failure to have appropriate confidentiality agreements in place with third party contractors has been found to be a breach of the accountability principle.  These agreements do not have specific provisions or requirements. The industry standard is an acceptable metric (i.e. industry standard for health data).
Transferring Data Outside of Canada
PIPEDA generally permits even non-consensual transfer of data outside of Canada provided the organizations use contractual or other means to provide a comparable level of protection while the information is being processed by a third party. However, it is good practice and required by some jurisdictions (Alberta) that if an organization uses a data processor outside of Canada they specify the foreign jurisdictions in which the transfer is taking place and for what purposes the foreign service provider has been authorized to process data on their behalf.
Notice of Breach
PIPEDA underwent a number of amendments in 2015. This included a three-pronged notice requirement in the event of a security breach. The three include:

1. A report to the Office of the Privacy Commissioner of Canada
2. A notice to affected individuals
3. A notice to other organizations

PIPEDA’s breach notification provisions require an organization to notify affected individuals of a breach of security safeguards if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual. The notification must be given as soon as feasible after the organization determines that the breach has occurred. The contents of the notification to individuals will have to include:
A. a description of the circumstances of the breach;
b. the day on which, or period during which, the breach occurred or, if neither is known, the approximate period;
c. a description of the personal information that is the subject of the breach to the extent that the information is known;
 d. a description of the steps that the organization has taken to reduce the risk of harm that could result from the breach;
Failure to report a breach or to maintain records as required is an offence under PIPEDA, punishable by a fine of up to C$100,000.
Conclusion:
Businesses, especially startups, should proactively conduct an audit of their existing consent policies and practices in order to ensure they are compliant with the new GOMC. Businesses should be ready and prepared to demonstrate compliance with PIPEDA in particular relating to these new consent requirements. Periodic review and reassessment of best practices is also highly recommended.