On January 16, 2025, the US Department of Labor’s (DOL) Employee Benefits Security Administration (EBSA) released two pieces of guidance that, if finalized, would dramatically change the landscape for fiduciaries responsible for determining the value of stock in privately held corporations when engaging in a transaction with an employee stock ownership plan (ESOP). The first piece of guidance involves the long-awaited and highly anticipated “adequate consideration” regulations under the Employee Retirement Income Security Act of 1974 (ERISA), which apply when setting the price at which an ESOP can buy and sell stock. The second piece involves a proposed prohibited transaction exemption (PTE) that would create a safe harbor for selling shareholders and plan fiduciaries when engaging in an initial transaction with a newly established ESOP.

On January 20, 2025, a slew of executive orders issued by the new administration froze all pending proposals from the prior administration, including the proposed regulations and the proposed PTE. Previously scheduled to be published in the Federal Register on January 22, 2025, the proposed guidance was withdrawn, and its unpublished versions were removed from the Federal Register website until new administration can review and approve – or modify in whole or in part – the proposed adequate consideration regulations and the proposed PTE.

Given the removal of the proposed guidance from the Federal Register, the recently issued proposed regulations and PTE have no force or effect. We caution against using such information to guide current thinking on ESOP transactions.

Adequate Consideration Under ERISA

Background

The proposed adequate consideration regulations released on January 16 aimed to provide more clarity on valuing non-publicly traded employer stock acquired or sold by ESOPs in accordance with ERISA’s requirements. The acquisition or sale of qualifying employer securities is not exempt from the prohibited transaction rules under ERISA unless, among other requirements, the transaction is for adequate consideration. Current guidance (namely, the 1988 DOL proposed regulations) defines adequate consideration as a price not less favorable to the plan than the “fair market value” of the stock determined in good faith by the trustee or named fiduciary pursuant to the terms of the plan and in accordance with regulations promulgated by the DOL. Fair market value for purposes of the definition of adequate consideration is the price at which an asset would change hands between a willing buyer and a willing seller. The absence of clearer and more objective guidance regarding the definition of “adequate consideration” – other than the “I know it when I see it test” – has exposed ESOPs and their fiduciaries to expensive lawsuits over the years that challenge the valuation process or methodology used, the substantive value concluded, and/or both in ESOP transactions.

Proposed Regulation

The January 16 proposed regulations set forth a two-part test for adequate consideration: fair market value and a good faith determination of that value:

1. If the employer stock is not readily tradable, fair market value generally means the price at which the employer stock would change hands in an arm’s-length transaction between a willing buyer and a willing seller when the former is not under any compulsion to buy and the latter is not under any compulsion to sell, the parties are both willing and able to trade, and have reasonable knowledge of the facts relevant to the stock’s value.
2. Whether the fair market value has been determined in good faith entails independent plan trustees or named fiduciaries determining value in accordance with a prudent process designed to ensure a sound conclusion as to the stock’s fair market value in accordance with ERISA’s fiduciary standards of prudence and loyalty. Components of such a process include requirements that the fiduciary prudently:
   1. Select a qualified independent appraiser to prepare a written valuation report.
   2. Oversee production of a written valuation report based on complete, current, and accurate information.
   3. Review the valuation report to ensure that it may reasonably be relied upon.

It is further noted that the preamble to the adequate consideration regulations emphasizes the need for a “prudent” and good faith process to determine if adequate consideration has been appropriately determined. Unfortunately, while purporting to focus on fiduciary process, the proposed adequate consideration regulations go further to prescribe certain absolute requirements that should, in our view, be left to the appropriate fiduciary review and process, as opposed to dictated by regulation. A deep dive into such issues is beyond the scope of this alert, but it is noted that even if reissued and finalized in their proposed form, the adequate consideration regulations are not likely to make establishing new ESOPs easier, less costly, or subject to less litigation.

The proposed adequate consideration regulations include a revocation of the 1988 proposed rule, which was never finalized or withdrawn by the DOL. However, until reissuance of the withdrawn January 16 proposed regulations, they may not be used as the standard for review by the DOL, and fiduciaries and courts must continue – reluctantly – to rely on the 1988 proposed regulations for guidance.

Proposed PTE Safe Harbor

The proposed PTE establishes a safe harbor for fiduciaries buying, and shareholders (of the ESOP sponsor) selling, non-publicly traded employer stock in an initial transaction with a newly established ESOP. The safe harbor in the proposed PTE is subject to protective conditions designed to ensure that any transaction relying on the safe harbor complies with ERISA.

Specifically, any trustee that represents the interests of the ESOP in a transaction must be independent of the employer and solely responsible for determining the appropriate transaction purchase price for the employer stock. The independent trustee may rely upon a valuation of an appraiser so long as the appraiser is independent of the employer and the independent trustee determines that the appraiser’s advice is sound, prudent, and loyal to the ESOP participants. Lastly, the independent trustee and appraiser would be able to provide to the selling shareholders certifications to verify compliance with the exemption upon which the selling shareholders would be permitted to rely.

As drafted, the tick-list approach of the proposed PTE would almost certainly have unintended negative consequences if ultimately finalized. As drafted, such guidance clearly erodes any focus on a thoughtful, principles-based valuation process and provides a false sense of security dependent on detailed and burdensome checklist items rather than an understanding of the underlying requirements and goals of an ESOP purchase. Further transactions following such PTE “rules” may or may not actually serve to protect participants who are the intended beneficiaries of an ESOP implementation transaction. The PTE also calls into question those plan sponsors, fiduciaries, and sellers who acted in good faith under the terms of the proposed adequate consideration regulations (if issued), which would further vitiate the certainty that was sought upon the ESOP community’s clamoring for appropriate guidance in the form of regulations.

Ultimately, the new administration must now work its way through the proposed, and now suspended, regulations and PTE issued by the prior administration to determine what, if anything, will be kept on reissuance (if any). Practitioners, in the meantime, are left with the prior, antiquated guidance and significant uncertainty. This process has underscored the need for appropriate and thoughtful regulation that will allow employers to create ESOPs to benefit employees through an almost-solely employer-provided program.

McDermott’s employee benefits team will continue to analyze in detail both proposals, ready comments on both proposals for consideration by the new administration, and provide a detailed analysis and commentary upon their release for public inspection in the Federal Register.

The act of predicting what will become the dominating storyline of data privacy and cybersecurity in 2025 is a hazardous enterprise, as one is almost surely to get something wrong. Without fail, every year, regulators and the plaintiffs’ bar push data privacy and cybersecurity in a direction that seemed unlikely the prior calendar year. Yet, we are undeterred. After canvassing our global group of data privacy and cybersecurity professionals, below are the topics that we are watching most closely as we kick off 2025. While these may not be the headlines that dominate when we look back after 12 months, we anticipate that companies will have spent significant time in 2025 working through the developments below.

Website Tracking: Make Sure You’re Doing It Right

As we explained in our recent Cookie Deep Dive webinar, there has been an explosion of enforcement and litigation targeting the use of cookies, chat bots, session replay, and other technologies (collectively, cookies). Regulators in the United States have undertaken extensive investigations and imposed massive fines. Plaintiffs allege cookies constitute “wiretapping” under archaic laws such as the California Invasion of Privacy Act (CIPA), which permit statutory damages of $5,000 to $10,000 per violation. The trend of more plaintiffs’ firms asserting additional claims and increasing settlement demands is likely to escalate given the trend in recent CIPA jurisprudence. Fortunately, there was some good news for defendants in 2024. The Massachusetts Supreme Court, in a case argued by McDermott Partner Dave Gacioch, held that Massachusetts’ wiretapping law did not apply to cookies.

To mitigate these heightened risks, clients are focusing more on cookie management while still enabling marketing, analytics, and data monetization. Now is the time to audit practices, document procedures, and make a plan, because we see no end in sight to these risks heading into 2025.

Artificial Intelligence (AI): Because of Course

There may not have been a bigger story in 2024 than the proliferation of publicly available AI tools. And the race to regulate AI likely is still in its early stages. Generative AI (GenAI) provides incredible capabilities but presents a bevy of privacy and potential security risks. GenAI tools also pose novel issues related to intellectual property rights and data ownership. To fully grasp and balance the potential risks and benefits of GenAI, companies first must understand the types of data being used to train the model, the provenance of such data, and ensure that the company has the appropriate rights and consents to use that data. Keeping up with the AI curve can feel daunting, but we have developed a series of standard operating procedures, templates, and training materials that can make things less scary. McDermott’s Artificial Intelligence Law Center is a resource for those looking to dig into this cutting-edge issue.

PCI DSS 4.0: It’s Almost Here!

The Payment Card Industry Data Security standard (PCI DSS) 4.0 for credit-card processing is fully effective March 31, 2025. If a company accepts credit cards as a merchant, it has PCI DSS and card-brand obligations under its contracts with its bank and any third-party processors. The new 4.0 security obligations are some of the most robust and onerous of any framework, and they will have numerous implications for any company taking, processing, or storing credit or debit cards. Preparing for these changes will require significant time and effort. The transition to new PCI DSS 4.0 controls involves numerous new workflows, including the need for new policies, processes, and technology solutions. We recently examined how PCI DSS 4.0 will impact digital health and healthcare companies, especially as e-commerce models expand.

There are a number of challenges and obstacles to full PCI DSS 4.0 compliance, including the fact that many companies mistakenly believe that fully outsourcing credit card functions to a third-party payment platform exempts them from PCI DSS obligations. That is not true. If you are not sure about the state of your company’s PCI DSS compliance, now is the time to dig in.

Federal Privacy Regulation and Enforcement: What Comes Next?

What will the second Trump administration bring? Between chatter of shuttering entire agencies and shifting enforcement priorities, the one thing that is clear is that 2025 will see a change in the way that the federal government approaches its role in the consumer privacy arena.

One development we are watching is what is going to happen with the Consumer Financial Protection Bureau (CFPB). The CFPB recently issued a proposed rule seeking to bring certain data brokers within the scope of the Fair Credit Reporting Act (FCRA). The proposed rule would revise the definitions of “consumer reporting agency” and “consumer report” in Regulation V and modify restrictions on when consumer reporting agencies may furnish, and users may obtain, consumer reports. Comments on the proposed rule are due March 3, 2025, but what will be interesting to see is whether the rule making process will continue under the new administration.

State Laws: You Knew We Couldn’t Omit This One

Seven. That was the number of new state consumer privacy laws passed in 2024. That was on the heels of eight new laws passed in 2023. The smart money for 2025 is that there will be another half-dozen states that enact consumer privacy laws as we move closer and closer to a complete patchwork of state consumer privacy laws in the absence of a federal consumer privacy law (the likelihood of which, under Republican control, is low). It can be hard to keep up with all the changes and requirements of the different laws, which is why McDermott has an online resource to help you keep track. Our consumer privacy law map is regularly updated and is a free resource.

Another thing that bears watching, of course, is the progress of the new California Consumer Privacy Act (CCPA) regulations, which are in the public comment period. These proposed regulations are onerous and overbroad, and they seem destined for a legal challenge if they are finalized.

EU Data Act: Something Like We’ve Never Seen Before

Among the EU Digital Package regulations, the EU Data Act is quite likely to be the most challenging to implement. We anticipate that many clients will begin or continue their implementation work streams well into 2025. The three primary obligations of the EU Data Act include:

1. The obligation to provide an access mechanism by design and by default and, if technically feasible, to provide users with direct access to their data (Data Act, Art. 3(1)).
2. The obligation to provide users with indirect access to their data (Data Act, Art. 4(1)).
3. The obligation to provide third parties with data upon request from users (Data Act, Art. 5(1)).

When these obligations become applicable will vary based on a variety of factors, including jurisdiction and product type. However, they will phase in between September 2025 and September 2026. Given this time frame, we anticipate that many companies will focus significant effort on their EU Data Act compliance activities in 2025 if they have not already started doing so.

EU Cybersecurity Frameworks: Time to Revisit Past Practices

In 2025, businesses operating in the EU will need to focus their cybersecurity efforts to comply with either the Network and Information Security 2 (NIS2) Directive (the cornerstone of the EU legal framework for cybersecurity), the Digital Operational Resilience Act (DORA, a cybersecurity regulation for financial institutions), or the Cyber Resilience Act (a regulation applying to manufacturers of products with digital elements placed on the EU market). This framework imposes, among others, cybersecurity controls and obligations to report incidents, and it is backed up by potentially heavy fines and, in some cases, personal liability of members of boards of directors.

While the NIS2 Directive became applicable in October 2024, only a handful of EU countries (e.g., Belgium, Italy) have implemented the Directive through their legal order. In 2025, we expect other EU countries to do the same. The NIS2 Directive covers businesses from a broad spectrum of industries deemed highly critical – such as energy, health, and digital infrastructure – and critical. DORA becomes effective on January 17, 2025, and applies to financial institutions. For both DORA and NIS2, covered entities must implement measures ensuring supply chain security, including supply chain contractual terms with their direct suppliers/service providers.

Take a Deep Breath: It Will (Mostly) Be OK

Reviewing the above, it is easy to see how in-house privacy counsel could become overwhelmed. But for (almost) every problem, there is a solution. It begins with understanding whether any of the above laws apply to your business. Most companies have already some cybersecurity measures in place, so the project will inevitably entail conducting a gap analysis. At this point, companies will have to design methods to address and mitigate any existing gaps. McDermott has a variety of toolkits, templates, presentations, and other materials that can help companies address the privacy and cybersecurity challenges that they may face heading into 2025.

If you have any questions or would like to discuss anything contained in this article, contact your regular McDermott lawyer or one of the article’s authors.