Welcome to this week's edition of Inside Track. I'm Law.com in-house reporter Stephanie Forshee. Tips? Comments? Thoughts about in-house careers? Reach me at [email protected] or on Twitter: @InOtherNewsNow.

First up, the Academy Awards were this past Sunday. It was a relief to most of us that there was no Best Picture mixup this year, but Oscar winner Frances McDormand's award was temporarily stolen, so you can decide for yourself if that was a win. My colleague Caroline Spiezio spoke to the Academy's general counsel John Quinn leading up to Hollywood's biggest night. Oh, and speaking of center stage, my colleague Sue Reisinger explored how GCs should navigate the growing conversation around the #InclusionRider.

➤➤Want to receive Inside Track as an email. Sign up here.

What's happening -

Let's get straight to it. It turns out I'm not the only one upset that “I, Tonya” didn't see more Oscar love. Although the Academy's general counsel (and Quinn Emanuel founding partner) John Quinn was tight-lipped about his top choice for Best Picture, he admitted to my colleague Caroline that he enjoyed “I, Tonya.”

About that stolen Oscar. Quinn wasn't directly involved but says “one of our lawyers” was on the scene and did “get involved with the police.”

Here are a few other fun facts from one of the best connected Big Law attorneys in Hollywood …

➤ Cool Gig. First, how did Quinn end up as GC for the Academy? Well, he started as an outside litigator on IP issues and the rest is history. The previous GC retired and asked if he wanted the job.

➤ Symbol of Achievement. In the interview, Quinn lifted the curtain on preventing the sale of old Oscar statues. (Don't worry. I had no clue that was a thing either.) Quinn told Caroline: “When a recipient receives an Oscar, they go back into the green room and before they get the Oscar, take possession of it, we include an agreement with the right of first refusal, that before they transfer it to someone else, they agree to offer it to the Academy for $10.”

➤ Attendance Record. And, if you're wondering if Quinn attends the Oscars, yes he does. (We've got a pic of him on the red carpet!)

He goes every year, but had to skip out early that time his wife went into labor on Oscars night. We'll give him a pass. It's also interesting to note that whenever he attends the show, he always carries the ABC contract for the event in his pocket “in case there's some issue that comes up.”

#InclusionRider. Also on Oscar night, many of you might have heard about an inclusion rider. Here are a few ways such a set of contract provisions could play out, according to interviews my colleagues Cogan Schneier and Sue Reisinger conducted this week.

One attorney told Sue that she expects entertainment companies won't specify an exact quota of diverse hires in these riders, but rather incorporate language asking for “reasonable efforts” to be made for inclusion.

There are other ways, though, to demand diversity. Walmart's GC Karen Roberts told Sue recently that the retailer has put increased focus on expecting diversity from outside counsel, suppliers and vendors. Other legal departments have made similar moves.

Who started it? My colleague Cogan spoke to Cohen Milstein Sellers & Toll lawyer Kalpana Kotagal who has been working for months to write the language for such provisions. She told Cogan that if she were in the C-suite at “a big industry player,” she'd drill down in two ways. “I'd be looking at how I can tap into the existing pipeline—because it exists—of women directors, of people of color directors, folks in the LGBT community, on screen and off screen … [and] I'd be reaching out for stories and content that reflects the diversity of the American experience.”

Overheard -

● Just as soon as Facebook announced it was rolling out a new messaging app, BlackBerry filed suit, claiming patent infringement. Facebook's deputy GC Paul Grewal released a statement, and it was not kind to BlackBerry:

“BlackBerry's suit sadly reflects the current state of its messaging business. Having abandoned its efforts to innovate, BlackBerry is now looking to tax the innovation of others. We intend to fight.”

Question of the week -

Do you have a pressing question you'd like answered? If so, send it my way.

This week's question:
My technology company has perfected a new product that requires the collection of biometric information about customers. I'd like to roll out the product into the European market. What kinds of laws do I have to be concerned about in E.U. countries around data privacy and facial recognition technology? Does the GDPR have any impact on my ability to bring this product to Europe?

First, congratulations on your company's new product. We hope that it has a successful rollout. To that point, the biggest statutory hurdle in the E.U. is, of course, the GDPR.

Under the GDPR, privacy is a fundamental right and the protection of biometric data is specifically singled out as a category of personal information requiring heightened levels of protection. Biometric data is defined broadly as “personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allows or confirms the unique identification of that natural person, such as facial images or dactyloscopic data.”

Generally speaking, processing sensitive personal data i.e. biometrics is prohibited unless there is explicit consent of the individual or the processing is for some other specific purpose as delineated by Article 9(2). Consent or a legal reason to process biometrics is not enough, though. Article 35 of the GDPR requires companies processing high risk data—biometrics—to conduct privacy impact assessments. In the event that the privacy impact assessment shows a high level of risk to the data subjects and there are no mitigating measures in place, the GDPR requires the company to consult with the supervisory authority. Note, the GDPR is extremely stringent and any violations of its rules could result in fines of up to 4 percent of your company's profits.

Another consideration for your product rollout in the E.U. is that the GDPR permits Member States to impose additional conditions and/or limitations on the collection and use of biometric information. Germany, specifically, has the Federal Data Protection Act (BDSG) which aims to align itself with the provisions of GDPR. The BDSG, though, goes beyond the scope of the GDPR and limits the permissible purposes for processing special personal data without explicit consent.

Beyond Germany, other E.U. countries have enacted various forms of biometric regulations. Portugal's Data Protection Law and, by reference, its Labor Code, limits the collection of biometric data to instances where the purpose is clearly stated and agreed to, and where the collection is not excessive for the purpose given. The Netherlands, through the Dutch Personal Data Protection Act, purports a sweeping definition of personal data that no doubt includes biometrics and institutes similar purpose and consent requirements as the GDPR. Similarly, the UK and France have both amended their Data Protection Acts to closely mirror the privacy and data protections as set forth in the GDPR.

The bottom line: Biometric data is an exciting new technology. It's “cutting edge,” more (or less) secure, and it provides so much convenience.

The caveat: biometric data is as much a liability and risk as it is a tool.With that being said, it is imperative that your company check, double-check, and triple-check to make sure that you are in compliance with the GDPR and the potentially more stringent regulations of the E.U. Member States.

— Erin Illman, CIPP/US, partner, and Niya T. McCray, CIPP/US, associate, atBradley Arant Boult Cummings.

Don't miss -

Tuesday, March 13. Global Leaders in Law will hold a roundtable in Madrid titled “Changing Corporate Culture.” It will also hold a session on “What to Do If Your CEO Resigns” in Sao Paulo the same day. GLL is an invitation-only membership group, offering GCs a global platform for in-person collaboration to exchange ideas, receive advice and guidance from peers. For more information, contact Meena Heath at [email protected].

Wednesday-Thursday, March 14 – March 15. The Corporate IP Counsel Forum will soon be in New York, where counsel from GE, Intel, Microsoft and more will discuss the issues impacting IP strategies. More info and a full list of panelists here.

Thursday-Sunday, March 15-18. The Hispanic National Bar Association will meet in San Francisco for its Corporate Counsel Conference. The theme is INNOVATE and the conference aims to get members “ahead of the curve,” according to the HNBA website.

Wednesday-Friday, March 21-23. Good Lawyers to Great Lawyers, A Strategic Professional Development Retreat will take place in Orlando. The ACC Foundation's event will focus on strategic professional development and coaching. In-house lawyers from Petco, Abercrombie & Fitch, Wintrust Financial and Venture-Science will be present.

On the move -

Homecoming. He's back. Michelin's top lawyer Dan Sanders (above) is returning to private practice after 20 years at Michelin. He told Corporate Counsel that the only firm he seriously considered is Nelson Mullins Riley & Scarborough, where he worked in the mid-90s.

Ironman. Consumer banking company Sallie Mae, as SLM Corp. is known, has named a new general counsel. Nicolas Jafarieh will lead the legal department after spending roughly a decade with the company. Oh, and by the way, he's a triathlete.

Golden Arches. After decades in the company's legal department, Gloria Santona is leaving McDonalds for Baker McKenzie. She will be of counsel at the firm.

Credibility is everything. Attorney Jobe Danganan is in his first week at fintech company Credible. He comes to the consumer finance marketplace from Sindeo, a marketplace for mortgages.

Quote of the week -

“The Court should abrogate its Mad Men-era rule that today gives preferential treatment to giant online-only retailers at the expense of local brick and mortar stores.”

Deborah White, general counsel for the Retail Industry Leaders Association and president of the Retail Litigation Center, announcing the groups' filing of an amicus brief in the Supreme Court case South Dakota v. Wayfair.

Are you enjoying Inside Track? Check out new briefings from Law.com writers on employment law, IP, class actions and more. Click here to learn more and sign up.