Limiting Your Liability for Y2K Failures
 
November 9, 1999
 

January 1, 2000, is fast approaching and with it the threat of Y2K failures and lawsuits. In response to this threat, Congress enacted The Y2K Act and the Florida legislature enacted the The Commerce Protection Act to provide businesses and their directors and officers with the means to avoid or limit liability for Y2K failures. However, public companies, their directors and officers must act immediately in order to secure the protection afforded by these Acts.

The Y2K Act

The Y2K Act provides a "Y2K upset" defense in actions where a government entity seeks to impose a penalty for noncompliance with certain "federally enforceable measurement, monitoring, or reporting requirements." To raise a Y2K upset defense the defendant must be able to show through "properly signed, contemporaneous operating logs, or other relevant evidence" that:

• the defendant made a good faith effort to anticipate, prevent, and remedy the threat of the Y2K failure;
• noncompliance was unavoidable in the face of an emergency related to the Y2K failure, and was necessary to prevent the disruption of critical disruptions or services that could result in harm to life or property;
• upon discovering the noncompliance the defendant took immediate action to comply; and
• the defendant submitted notice to the appropriate federal regulatory authority within 72 hours from the time it discovered the upset.

The requirement of a good faith effort to anticipate and prevent any potential Y2K failures means that action must be taken prior to January 1, 2000, in order for the Y2K upset defense to be available. Businesses that have not already done so should immediately identify any federally mandated measurement, monitoring, or reporting functions that could be interrupted by a Y2K failure, implement a plan to prevent such interruptions; and maintain a detailed and contemporaneous record of their efforts at prevention. Further, businesses should record the circumstances surrounding any failure to comply with any such federal measurement, monitoring, or recording requirements, and ensure that written notice is sent by certified mail to the appropriate federal agencies within 72 hours of any failure to comply.

The Commerce Protection Act

The Y2K Act is not the only statute that limits liability and damages for Y2K failures; Congress expressly reserved the right of the states to impose stricter limitations on liability and damages for Y2K failures. Florida's Commerce Protection Act imposes such additional restrictions.

First, The Commerce Protection Act provides that plaintiffs may not recover any damages that may have been avoided as a result of any written or otherwise communicated disclosure made by a defendant prior to December 1, 1999, advising the plaintiff whether or not the defendant business' information technology products are Y2K compliant. The term "information technology product" means software and hardware that operates using date data; and "year 2000 compliant" means that the product is capable of correctly processing date data for all dates between February 28, 1996, and March 1, 2000.

Second, a business may avoid liability for direct economic losses by securing an assessment by a person having the technical skills to evaluate year 2000 compliance to determine actions necessary to make the business' information technology products year 2000 compliant or by conducting a date data test of the products, provided that based on the assessment or test the business has prior to December 1, 1999, a reasonable good faith belief that its information technology products are year 2000 compliant.

Third, The Commerce Protection Act provides that a director or officer of a business has absolute and complete immunity from liability for any damages caused by the failure of the information technology products of the business to be year 2000 compliant if the director or officer has either instructed the business (or has received written assurance from another officer or director of the business that the business has been instructed) to

• take steps to determine whether those products are year 2000 compliant
• develop and implement a plan of action to make those products year 2000 compliant
• inquire whether the information technology products of the entities on whose goods and services the business relies are year 2000 compliant.

While January 1, 2000, is fast approaching, prudent companies, and their directors and officers may limit or exclude their liability for Y2K failures by retaining counsel and taking action today.