Indeed, whether a restaurant is seeking to increase table turnover, retain patrons by fostering a soothing ambiance, or liven a festive gathering, music plays a crucial role. No resource has greater value when it comes to establishing a desired mood for a particular restaurant setting. Perhaps the most obvious examples are sports bars, where music from TVs highlighting action in the game provides a fitting soundtrack to the hustle and bustle of a lively crowd.

At the other extreme are steak houses and fine dining establishments. Here, the desired sonic mood is one that establishes a sense of calm and relaxation, one befitting a larger proportion of mature patrons. Falling between sports bars and steak houses is the neighborhood pub, which varies in nature and where the demographic is more mixed. Examples include college bars and restaurants, where indie pop or alternative music ratchets up the energized ambiance.

No matter the desired mood, numerous studies have established that music is central to creating the proper atmosphere — and driving profits. To cite a sampling:

• • A recent CNN article showed that people chewed food nearly a third faster when listening to high-volume, fast-tempo music, potentially increasing table turnover. Also according to CNN, a French study observed that as decibel levels increased, men not only consumed more drinks but also finished each drink in less time.
• • A study published by the Journal of Culinary Science & Technology determined that food tastes best to diners when 1) classical music is softly played, and 2) there’s the presence of subtle background “chatter.” The same study showed that the absence of music detracted significantly from the dining experience, with patrons describing something as innocuous as the “clink” of cutlery as unacceptably noisy. Music, of course, serves to mask such noise.
• • A Scottish study published by the Association for Consumer Research found that diners increased their expenditures by 23% when slow-tempo music was played. Most of the additional spending went toward the drink bill, which grew 51%. Because drinks are typically a high-margin item, the increase in profits was especially significant. Of course, it’s up to individual proprietors to determine whether profits are enhanced by fast table turns or by encouraging patrons to remain for long periods of time. Music can be a powerful tool in achieving either goal.

To facilitate such uses of music, Broadcast Music, Inc. (BMI), provides the necessary licensing to comply with copyright statutes for the use of more than 7.5 million musical works. Operating on a non-profit-making basis, BMI distributes approximately 84 cents of every dollar it collects to its roster of songwriters, composers and publishers. In essence, the organization serves as a “middleman” between restaurants and owners of intellectual property. “Organizations like BMI — performing rights organizations — are advocates of a system whereby people are compensated for their work,” says Casey Monahan, Director of the Texas Music Office, an adjunct to the Texas State government. “It’s extremely important, not only for restaurants but really for everybody in the country, to understand the value of, and the significance of, intellectual property.”

Originally published on Tuesday, December 17, 2013
3793 views at time of republishing

How do the creators of the music you play fit into your business plan? They are small business people who earn their living from the product they provide just like any other suppliers, and the copyright law, which protects their product (music), was enacted to help them continue to provide it. That’s why businesses that play music need a license to do so under Federal Copyright Law.

What is a music license?

A music license provides copyright clearance to play music in a public setting, which under copyright law, is considered anything outside a normal circle of friends and family.

Why are there federal laws to protect songwriters and composers?

Very simply, so that they will continue to create music and the cycle of art and commerce will continue to grow. Songwriters help businesses and businesses help songwriters. Without compensation for songwriters, who don’t draw a regular paycheck for their work like other employees, the quality and quantity of music available for business and pleasure will quickly disappear, and, we will, eventually, have silence.

Who provides these licenses?

There are three performing rights organizations (PROs) in the U.S. that provide music licenses – Broadcast Music, Inc. (BMI), ASCAP and SESAC. Each represents a unique repertoire of music and grants blanket permission to play the copyrighted music they represent so that business owners don’t have to contact copyright owners directly, which saves time and money for both businesses and songwriters. Licenses with all three PROs provide businesses with copyright clearance to play virtually all of the music heard around the world every day.

For BMI, which operates on a non-profit-making basis, the process goes like this: once a business licenses and we receive their fee, we distribute all of the moneys received, less operating expenses, as royalties to our more than 600,000 affiliated songwriters, composers and publishers (copyright owners) based on radio, TV, cable, the Internet, concerts and logs provided by businesses that track and report the music they play. This performance data provides the most accurate snapshot of all of the music played publicly and the size of the audiences that hear it. This ensures that the songwriters, composers and publishers who do have public performances get paid accurately.

It is important to note here that many songwriters are not the artists who record their work and the payment they receive from the sale of these recordings is minimal compared to the artist’s share. This means that the fees that businesses pay on public performances are all that allow many songwriters to continue creating new music for all of us to enjoy. It is also important to note that the cost of a BMI music license for a hotel is typically less than $7 a day, which means that for the cost of a couple of drinks, all of your guests can be entertained.

Do I need a license to use radios and/or TVs?

The use of television in public areas of hotels often raises questions about copyright law and music licensing – even for broadcasts of sporting events. Some may wonder what a sports telecast has to do with music. An analysis of a typical game, however, reveals an abundance of copyrighted music throughout the broadcast. Music is everywhere, including in program openings, half-time programs, highlights, commercials, and breaks in the action. While television networks, local TV stations and cable networks secure public performance licenses for the music they use in their programs, those agreements do not authorize the re-transmission of such broadcasts to the public.

Public performances of radio and TV are specifically addressed in Title 17, Section 110(5)(B) of the U.S. copyright law which states that any food service or drinking establishment that is 3750 square feet or larger, or any other establishment, other than a food service or drinking establishment, that is 2000 square feet or larger, must secure public performance rights for TVs or radios if any of the following conditions apply:

For TV, if the business is using any of the following:

1. more than four TVs; or

2. more than one TV in any one room; or

3. if any of the TVs used has a diagonal screen size greater than 55 inches; or

4. if any audio portion of the audiovisual performance is communicated by means

• of more than six loudspeakers, or four loudspeakers in any one room or adjoining
• outdoor space; or

5. if there is any cover charge.

For radio, if the business is using any of the following:

1. more than six loudspeakers; or

2. more than four loudspeakers in any one room or adjoining outdoor space; or

3. if there is any cover charge; or

4. if the business is playing the radio (or any other type of music) through their phone line while customers wait on hold.

What happens if I use music without a license?

Penalties for copyright infringement are outlined in the federal copyright law and are not set forth by the performing rights organizations. The judge presiding over a copyright infringement case is given wide discretion in awarding statutory damages, which can be high — from $750 to $30,000 for each copyrighted song performed without a license, and up to $150,000 per work if the infringement is found to be willful.

How can I get a music license?

Most BMI music users apply for a license online. You can visit our website at www.bmi.com/licensing, read the answers to frequently asked questions, review the license for your business category, then click and follow the directions to become licensed to play the more than 8.5 million musical works that BMI represents.

Originally published on Thursday, March 20, 2014
2324 views at time of republishing

Objective: To describe recordkeeping practices of beef grinding activities in retail establishments.

Study Results: We surveyed 125 establishments and where available, reviewed grinding records. We found that less than half of establishments kept grinding records. Only 22% of records had all data needed for effective traceback (e.g., grind date and time, lot number of the source beef).

Chicken Handling Practices Study

Objective: To describe restaurant chicken preparation and cooking practices and kitchen managers’ food safety knowledge concerning chicken.

Study Results: We interviewed managers of 448 restaurants; inadequate chicken preparation and cooking practices were commonly reported. Forty percent of managers said that they did not always assign certain cutting boards for raw meat (including chicken) only, 29% said that they did not wash and rinse surfaces before sanitizing them, and over 50% said that thermometers were not used to determine the final cook temperature of chicken. Only 43% of managers knew the temperature raw chicken needed to be cooked to.

Egg-Handling Practices Study

Objective: To identify the prevalence of high-risk egg-handling practices and establishment policies in restaurants that serve breakfast all day.

Study Results: We interviewed kitchen managers and observed egg handling practices in 153 restaurants and found that risky egg handling practices were common. Fifty-four percent of restaurants pooled raw shell eggs not intended for immediate service, a practice not recommended by FDA. Some of these pooled eggs were held for 6 hours (the FDA-recommendation is 4 hours). Nearly 26% of restaurants reported storing eggs at room temperature. However, eggs were generally cooked to a temperature above the FDA-recommended final cook temperature of 63ºC.

READ MORE CASE STUDIES HERE

Originally published on Wednesday, June 17, 2015
1938 views at time of republishing

Unfortunately, hotels and hotel companies have been, and continue to be, tempting and frequent targets for data thieves.

Why are hotels of such interest to information thieves? Several factors could be to blame. One may be that hotels do such a large amount of business through credit and debit card transactions, and payment card fraud is a favored type of identity theft crime among cyber criminals and those to whom they sell their stolen information. Another may be that hotels frequently must tie their data and computer systems together with the computer systems of others, such as the major hotel brands and, at times, outside vendors or contractors. High employee turnover and, in many cases, poor employee training in security practices may also contribute to the vulnerability of hotels to data thieves.

Wyndham’s Data Incidents

Arguably the most notorious set of hotel data breach incidents happened to Wyndham Worldwide Corporation during the period of 2008-2009. Here’s how those incidents unfolded:

In April of 2008, foreign hackers gained access to Wyndham’s computer system through a single computer in one of Wyndham’s franchised hotels that an employee at the property had connected to the internet. The internet connection permitted the hackers to intrude into the hotel computer. This computer was also connected to Wyndham’s property management and reservation system (all Wyndham franchised hotels are required by contract to utilize Wyndham’s management and reservations system). This pathway was used by the hackers to gain access to Wyndham’s own servers
at its data center in Phoenix, Arizona. Once inside Wyndham’s system, the hackers obtained administrator passwords and access codes. At that point, the intruders had a ready pipeline to reach individual Wyndham franchised hotels that were connected to Wyndham’s central servers.

Within approximately a month, the hackers had used Wyndham’s computerized connections with its franchised hotels to compromise the computer systems of 41 different properties. Unfortunately, it took Wyndham a number of months to recognize that the intrusion had occurred.

Even more regrettably, the hackers returned twice more in 2009. Wyndham believed that the security vulnerabilities that had allowed the 2008 attack to occur had been remedied, but they had not. The second cyber attack on Wyndham resulted in the compromise of information from 39 franchised hotels; the third, 28 hotels.

The hackers, believed to have been operating from Russia, stole guest credit and debit card account information. In total, over 600,000 accounts were compromised in this series of breaches. By no means do these incidents qualify to be among the largest data breaches on record, especially compared to a few of the more recent highly publicized incidents, such as the 2013 pre-Christmas cyber attack against Target, in which over 70 million individuals were affected, or the more recent EBay data breach, which is said to have impacted over 233 million people. Nonetheless, the potential for payment card fraud as a result of the Wyndham breach has been estimated to exceed $10 million.

The consequences to Wyndham have been serious and seemingly endless. Initially, just after the incidents occurred, Wyndham issued notifications to all affected individuals. Such notifications are required by the data breach notification statutes of 47 U.S. states. The notification process was extremely expensive, in part because Wyndham first had to obtain contact information for the affected people based only upon credit card account numbers. Wyndham also provided a year of credit monitoring to affected individuals, at the company’s cost. In addition, Wyndham was required to spend time and resources attempting to satisfy a number of state consumer protection regulators and state attorneys general that it was adequately responding to the breaches.

As notifications were being processed, the franchised hotels began receiving notices from their credit card processors that the major credit card companies would be imposing assessments against the hotels, as merchants, for recovery of fraud costs associated with the breach incidents. The hotels turned to Wyndham and sought indemnification for these assessments. Ultimately, Wyndham bore the legal costs of challenging the majority of the credit card brand assessments and obtaining reductions in the fines.

Wyndham’s woes over the breach incidents were only just beginning. In April of 2012, the Federal Trade Commission brought a lawsuit against Wyndham in federal court, alleging that Wyndham had failed to observe adequate security practices concerning personal consumer information, and that these failures amounted to unfair and deceptive trade practices. The Commission’s complaint quoted the privacy policy which appears on Wyndham websites, which stated that Wyndham would use commercially reasonable efforts to protect the personal identifying information of its customers. The
complaint then went on to allege that Wyndham had failed to employ reasonable industry practices to safeguard guests’ data. Wyndham asked the court to dismiss the lawsuit, arguing that the Commission had overstepped its authority to regulate by claiming to have the right to enforce unwritten, unspecified data security standards against companies. Over a year after it was filed, the court denied Wyndham’s motion to dismiss in early 2014. The trial court specially certified the question of the FTC’s jurisdiction so that it could proceed immediately to appeal before the Third Circuit Court of Appeals.  On August 24, 2015, the Third Circuit issued a decision affirming the trial court’s holding that the FTC had the power sue Wyndham, and thus the enforcement action will proceed.

If that were not enough, in May of 2014, a Wyndham shareholder brought a derivative action lawsuit against Wyndham. The claims in that lawsuit focus on the fiduciary liability of Wyndham’s board of directors for the data breaches themselves as well as the ensuing Federal Trade Commission lawsuit. The complaint alleges, among other things, that Wyndham failed to disclose the incident to shareholders in its financial filings in a timely manner. Wyndham has already filed a motion to dismiss the shareholder complaint, but no decision has been issued on that motion as of the time of the writing of this article.

The fallout and consequences to Wyndham from these events have been dire. Adverse impacts to Wyndham include harm to its image and reputation, the cost of notification of consumers and credit monitoring, legal fees and loss of goodwill among consumers, among other things.

What Can Be Learned From the Wyndham Breach Incidents?

Security experts and analysts are becoming more vocal in warning consumers and corporate America that data intrusions are unavoidable. It is becoming the accepted industry wisdom that a determined hacker can get into virtually any system, regardless of how well it is protected. Therefore, it is difficult to say that a good lesson to take away from the Wyndham data incidents is that hotel companies should attempt to make themselves invincible against cyber attacks. Moreover, hotels often have certain inherent vulnerabilities to data theft, including the requirement that their computer systems must often be tied to those of entities which they do not control. There is no easy solution to this circumstance.

Rather, industry experts, as well as lawmakers, are beginning to call for faster and better intrusion response as a defense – through implementing closer monitoring and tighter protocols to detect breaches earlier, and having detailed and rehearsed cyber incident response plans, to name a few. Data breach response plans should include, among other things: creation of an incident response team (company officers, general counsel, outside data breach response counsel, information technology
personnel, communications personnel, risk management personnel, etc.); a game plan for analyzing and containing a breach incident, including identification of forensic assessment and response firm; and, a plan for notifying affected individuals and government agencies where required. Speed in responding to an exposure or theft of information is a key component to reducing a company’s exposure after a breach. The Wyndham incidents underscore that delays in identifying breaches and shutting down exploited system vulnerabilities, in notifying affected people and consumer protection agencies, and in
notifying shareholders, can all lead to higher levels of exposure.

One way to mitigate some of the breach-related costs similar to those incurred by Wyndham is to carry cyber protection insurance. The use of cyber insurance is widely increasing as data breach incidents become more frequent and more broadly reported through the media. Cyber policies come in a wide variety of forms and costs. The scope of coverage and exclusions from coverage must be carefully assessed to make sure a company has reasonable protection in exchange for its premium payments.

In the end, hotel owners, management companies and brands may not be able to avoid becoming the victims of cyber attacks, much in the same way that Wyndham and its franchised hotels became victims. What hotel companies can control, and should strive to prepare for, is their readiness to respond.

Originally published on Monday, 09 June 2014
2722 views at time of republishing

Many employers are unaware of the significance of the I-9 Form. This two-page form, once considered to be a “simple hiring form,” can carry hundreds of thousands of dollars in potential liability, as well as possible criminal penalties for managers and owners, if a company fails to comply with the strict I-9 rules.

In recent months, there has been a significant increase in the number of I-9 audits conducted by the immigration agency. Officers from Immigration and Customs Enforcement (“ICE”) are appearing at local companies, requesting to see copies of all I-9 forms, for all current employees, as well as those terminated in the past three years. Employers are only given 72 hours to comply.

By the time the ICE officers appear, it is often too late to rectify any errors made on the I-9s, which could result in steep financial penalties. Minor technical errors on the form (including failure to complete all required boxes, entering information incorrectly on the form and failure to sign the form) can add up quickly, as fines for simple paperwork violations will range from $110 to $1,100 per I-9 form, depending on the severity of the errors. If illegal workers are discovered as part of the I-9 process, the potential for criminal penalties will arise.

As restaurants have notoriously high employee turnover, the potential for even higher fines is present. To avoid a panic moment, the time to review your company’s I-9 compliance efforts is now—before an audit is initiated. To assist you in this regard, below is a list of basic I-9 tips:

1. Avoid unnecessary liability. Enlist the assistance of counsel to help you audit your restaurant’s I-9s now, and continue to self-audit at least once a year.
2. Be accountable. Choose an I-9 captain to oversee the I-9 process.
3. Do it right: Make sure all I-9s are completed timely and in person (never accept a copy of a document).
4. Avoid document abuse. Never ask for a specific document from your new hire: Always give the new hire the I-9 instruction sheet and allow them to choose the documents they wish to produce (i.e., don’t ever say, “I need to see your license and social security card” or “where is your green card?”).
5. Be consistent. If you maintain photocopies of supporting documents, be sure to do this for all employees.
6. Set reminders. Create an I-9 tickler system to remind you of upcoming expiration dates (for new hires with expiring employment eligibility).
7. Stay organized. Keep your I-9 files separate from personnel records.
8. Be up to date. Make sure you are using the current version of the I-9 form.
9. Avoid a last-minute scramble. Have a response plan: Who will you call if a government agent initiates an audit? Remember, you only have 72 hours to comply.
10. Educate your team. Make sure your team of hiring managers is well informed on the current I-9 rules and conduct regular training to minimize mistakes.

The bottom line is compliance. Restaurants are often popular targets for I-9 audits, and the fine potential can be substantial. Now is the time to educate yourself on the I-9 rules, and take a look at your compliance plan. Getting ahead of this may save your company a significant amount in potential penalties and legal fees.

Originally published on Tuesday, 17 December 2013
2587 views at the time of republishing