Welcome back for another week of What's Next, where we report on the intersection of law and technology. Today, we look at how the FBI's use of an online genealogy research website has raised a host of concerns over DNA privacy, and what's being done to address it. We also have an update on last week's Q&A with Fenwick & West's Mike Dicke since the SEC issued its securities guidelines mere hours after we sent the newsletter. We also have a look at the techie hiring trends in the legal field.

DNA Dilemmas

My fiancée watches a lot of the Investigation Discovery channel, so I've seen plenty about how DNA has opened up a whole new world of solving cold cases and finding justice. But in an increasingly privacy-conscious world, using DNA as evidence could have long-lasting ramifications—not just for individuals themselves, but for the family they share DNA with.

This has raised a host of privacy concerns over genetic data. In one particular case, the FBI uploaded genetic information from a cold case to genealogy research site FamilyTreeDNA—unbeknownst to the company—and was able to find a family connection to a previously unidentified body. Now, after finding out, the company requires law enforcement to register and provide documentation related to the nature of the case, which must constitute either a sexual assault or homicide.

The real future is in FamilyTree's opt-in/opt-out system: Users can adjust their preferences to opt out of being matched with any DNA information uploaded by law enforcement without it impeding their ability to use the service. This is largely consistent with standards from the European Union's General Data Protection Regulation and the incoming California Consumer Protection Act. FamilyTree founder and CEO Bennett Greenspan said 99 percent of the service's customers have chosen to remain opted-in to law enforcement matching.

Sounds simple enough, right? Perhaps it's too simple, says Jessica Lee, a partner and co-chair of the privacy, security and data innovations practice at Loeb & Loeb. While you can only opt in for yourself, DNA is inherently shared with family members. “You're not just consenting for yourself. You're also consenting on behalf of your family members. … So it's how do you kind of communicate the real implications of your choices? And that's a struggle companies have, whether it's genetic data or anything else,” said Lee.

This isn't the olden days, where genetic data would have been collected in-person in connection to a clinical trial or scientific research. Sites like FamilyTree, Ancestry.com, 23andMe and their ilk have made harnessing this data easier than ever before. So the question becomes: Where do the rights to give consent to genetic data usage actually apply? It's a question the courts have yet to answer in full. You can read more about this issue from Legaltech News' Frank Ready here. – Zach Warren

A Look at the SEC's Crypto Guidance

Wouldn't you know it: The very morning we brought you a conversation about the lack of recent guidance from the SEC on its approach to cryptocurrency, the agency went and released a heap of new guidance on that very subject.

Such is the news business.

In the wake of the development, we went back to Fenwick & West's Mike Dicke, the former SEC enforcement official we first bugged about the SEC's polices, or lack thereof, and hit him up for some insight about the new guidance. (You can read the full Q&A here.) Here's what Mike had to add:

So the SEC is out with its long-awaited guidance for token issuers. Does this guidance materially change what we know about the SEC's position on whether digital assets are securities?

The guidance issued by the SEC Division of Corporation Finance essentially synthesizes and puts a sharper point on numerous factors the SEC has discussed in enforcement actions and speeches, although there are some points that could be considered new. For instance, one new aspect is that the guidance talks specifically about how to judge whether tokens, which were once securities, when issued may no longer be considered securities in later transactions because the associated blockchain project has become decentralized or otherwise evolved away from reliance on the efforts of a key group of people.

But mostly, the guidance reaffirms that the SEC will continue to look to the Howey test, and that the inquiry into whether a particular offering or sale of a digital asset constitutes a securities offering remains a facts and circumstances examination of multiple factors. In terms of what specific, real-world factors are relevant, the new guidance discusses numerous scenarios and which way they cut in terms of finding a securities offering.

In my view, the April 3 guidance reaffirms that the SEC usually will view digital assets designed to raise funds to be used by a central management team in building a new venture as securities offerings. In other words, if you selling a token or digital assert to raise funds to develop or build something, you are likely engaged in a securities offering. And that's why for the past year most ventures that are raising funds to build projects through token sales have been counseled to do token offerings as securities offerings, under applicable exemptions from registration such as Reg D (to accredited investors in the U.S.) or Reg S (to overseas investors). Of course, it's worth emphasizing that it is crucial that the strictures of such exemptions are met, and that proper records are kept to prove that the offering met each of the requirements of Reg D or Reg S.

It's worth noting that as the SEC enforcement division works through its backlog of investigations relating to the 2017 and early 2018 ICOs, I think we will begin to see less new SEC and other regulatory actions involving token issuances and more focus on other areas involving digital assets. Such investigations and enforcement actions likely will include cases involving cryptocurrency exchanges, registered broker-dealers trading security tokens, funds holding digital assets, and derivate instruments whose value is tied to the price of particular digital assets. Questions the SEC likely will be grappling with include: what standards do independent auditors apply to audits of broker-dealers which trade digital assets that qualify as securities? What constitutes market manipulation of digital assert markets? How should fund managers value and report their holdings to investors, given the volatility and opaqueness of cryptocurrency markets? All of these questions are likely to be presented in the next wave of SEC enforcement investigations.

How much of what the industry knows comes from public statements and guidance, and how much comes from the agency's enforcement actions and positions the SEC has taken in litigation?

What we collectively know about the SEC's views on token issuances and related cryptocurrency issues comes from a combination of enforcement actions, public statements of SEC officials, and what defense lawyers and others have learned from one-on-one discussions with SEC officials. This later source is often overlooked but in some ways offers the most up-to-date insights about the agency's views on particular emerging issues in this space.

Of course, what's missing from this list is SEC rule-making. Many in the cryptocurrency industry have been clamoring for the SEC to pass specific rules to address when a particular token offering constitutes a securities offering, as well as rules governing secondary market sales of tokens, ETFs and related issues. I'm not surprised, however, that the SEC has failed to take steps to enact new rules in this space. The rule-making process is terribly slow and deliberate. With the rapid evolution of the crypto space, the rule-making process risks being overtaken by new developments in the industry.

Moreover, while I understand the frustration of the lack of clear rules in this space, I think that those wishing for specific SEC rules would likely be disappointed. The SEC inherently is a conservative organization and is uncomfortable making bold changes. And when it comes to investments offered to “main street” investors (to borrow Chairman [Jay] Clayton's phrasing), the SEC always is going to err on the side of investor protection.

Think back five or six years ago when there was a clamor for crowdfunding rules. The SEC's response, Regulation Crowdfunding, is so restrictive and modest that few entrepreneurs have raised meaningful capital under its provisions. I don't think anyone in the digital asset space wants to wait years for the SEC to write rules that end up stifling, instead of enhancing, the burgeoning cryptocurrency industry.

In terms of whether the April 3 guidance provides the requested “clarity” that so many have hoped for, I would say it helps, but falls short of actual “clarity.” –Ross Todd

Blockbuster Hiring in Blockchain Law

With blockchain, cryptocurrency and other technological innovations becoming an ever-greater part of the financial industry (JP Morgan recently announced it has introduced its own digital currency for internal use), more law firms are looking to snatch up lawyers with expertise in these areas. Major, Lindsey & Africa managing director Brian Burlant, who recruits for firms and in-house, told us recently that it's hard to keep up with the demand for attorneys who are knowledgeable about these emerging fields, in addition to digital privacy.

“What I am seeing in blockchain and crypto is that firms are cautiously making forays into this space, feeling out for talent, trying to assess where are the trends from their clients coming, so it is very much a work in progress and everyone expects the weight of business to increase,” Burlant said.

Blockchain's applications in supply chain, health care, and accounting extend far beyond the well-known and controversial cryptocurrencies such as Bitcoin and Ethereum, and are expected to grow. Privacy is also a growing practice area as the technology permeates consumer finance, healthcare, insurance and other industries.

“We have also seen lawyers entering this space from regulatory practices or government, specifically securities regulation and white collar/investigations practices, as regards to cryptocurrencies in particular,” he said.

A science and technology background, or at least familiarity, is a plus for anyone hoping to get a foothold in this growing specialty, but practitioners are not all science and tech majors: “For law students and those early in their legal careers, coupling a practical business approach with a working understanding of the technology is a good way to go. Emerging and Fortune 500 companies are taking the lead in applying these technologies; there will be opportunities in representing clients in both sectors.”

Demand is such that even lawyers from law schools outside the usual “Top 14” have been able to parlay specialized expertise into Big Law firms, he said. But he counsels, “don't focus on the crypto, focus on the blockchain. It will be a game changer.” – MP McQueen

On the Radar

The Replacement: A federal judge has named a new lead plaintiff in the securities litigation tied to Tezos' initial coin offering: Trigon Trading Pty. Ltd. The move came after the former lead plaintiff, Arman Anvari, who previously practiced at Latham & Watkins, Baker McKenzie and Perkins Coie, asked to bow out of the case earlier this year. Defense lawyers at Cooley and Baker Marquart identified pseudonyms they believe Anvari adopted on social media, which used anti-Semitic slurs in reference to Arthur and Kathleen Breitman, the husband-and-wife team behind Tezos. Read more from Ross Todd here.

Cashing In: Pinterest's initial public offering has generated $2 million in legal fees for the three firms involved in the deal: Cleary Gottlieb Steen & Hamilton; underwriter counsel Skadden, Arps, Slate, Meagher & Flom; and Potter Anderson & Corroon, a mid-sized firm in Delaware. The social media company disclosed the legal fees and expenses in an updated prospectus filed with the U.S. Securities and Exchange Commission Monday. Its stock is expected to begin trading next week. Read more from Xiumei Dong here.

Settlement Boost: Yahoo's class action settlement over a recent data breach has been bumped up to $117.5 million. The move came after a federal judge rejected preliminary approval of a settlement earlier this year. The settlement filed Tuesday includes a single fund from which $55 million would be available for out-of-pocket costs and $24 million in identity theft protection for class members. It also includes$30 million in attorney fees and $2.5 million in legal costs, a slight reduction from the original fee request. Read more from Amanda Bronstad here.

Correction: This story has been updated to correct Brian Burlant's title.