Managing (the Inevitable) Incidents, Threats, Claims, and Crises

Welcome to the Bulletproof Your Marketplace Podcast, where we break down the strategy, stories, and insights from my book Bulletproof Your Marketplace, one chapter at a time. Whether you're a founder, legal counsel, or trust and safety leader, or anywhere in between, this series is built to help you navigate risk and scale with confidence. In each episode, we'll dig into a chapter of the book, explore the key themes, and give you actionable takeaways to help make your marketplace safer, stronger, and more sustainable. On this episode, I'm joined by Jimmy Toy, who is currently Chief Legal Officer at Artichore Group. Jimmy, thanks for joining me. So, to kick things off, can you introduce yourself a little bit more, and talk about your experience in history, working with various marketplaces or digital platforms? Yeah, absolutely, and first of all, thanks Jeremy, really in honor to be on the podcast, I appreciate it. Absolutely. I'm happy to share my experiences and learnings from my background in this area. So, I'm Chief Legal Officer of Artichore Group, we're a public company in Australia that owns the online marketplaces for artists, rent bubble and tea public, where artists can upload their art, and sell their products printed with their art to their customers all around the world. We also have other platforms, but those are the main ones that people have heard of. And we deal with a lot of user-generated content, over tens of thousands of images that are uploaded to our platforms each day. So, as you can imagine, there are issues with people uploading things they shouldn't, or trust and safety is a big issue. So, my area of expertise is legal policy and governance, and dealing with a lot of the trust and safety issues that arise on our platforms from the user-generated content. Excellent. So, in this episode, we're going to talk about managing incidents, threats and the dreaded legal claims. And so, super high level, kind of getting, it would love to get your reaction on, kind of, why do you think this topic is important for founders or leaders leadership teams of marketplaces? Yeah, I think I see a question because I think the tendency of founders and leaders in marketplaces, you know, very commercial-minded, your entrepreneurial. The last thing you want to do is think about the legal issues, or legal risk and liability. It's not the sexiest topic, and it's also just a drag, you know, you want to think about innovation and getting your products to market and your customers. But, I think my main message would be, it is an area you should pay attention to because it's not if, but when you're going to have an incident, especially when you have a global platform that's open and you have user-generated content. Right, right. It's funny. I mean, that's, I think, if there's one thing I'm quoted on the most, it's me, it's always saying it's not if it's when. And it's so true, but I think sometimes doesn't actually ring true until something happens, and then there's always that Monday morning quarterbacking where it's like, man, why weren't you guys doing this or doing that? I think that's why it's all the more relevant and important to have people like you talk about these topics who deal with them kind of on a daily basis, or hopefully not on a daily basis, but just right virtue of the size, right, more than once. So let's kind of fly the helicopter down a little bit and talk about the chapter, kind of what were your key takeaways for our themes from this chapter that you think that founders or leadership teams should really pay attention to? I think being prepared is a main theme. Being authentic is a main theme as well. If your mistakes, you're going to happen when you host global platforms with user-generated content, your digital platform, your marketplace, things are going to happen, things are going to get through your screens, you know, not being reactive, but being proactive. You want to be both. There's a time to be either one of those things, but you want to get ahead of things, you want to prepare, you want to know who to contact when a crisis happens, whether that's litigation, whether it's a media, media crisis, and then that way everyone knows what to do, and you're not being completely reactive when something happens, and everyone scrambling, and there's a big time constraint, and you have articles being published about you, and a lot of questions being asked, and upset customers. Yeah, for sure. I think that, you know, the crisis is kind of the worst case scenario, right, whether it's a media crisis, et cetera. One of the things that I've kind of focused on for much of my career is really trying to map out, you know, the crisis is at the end. The litigation is probably at the very end, but the crisis. But before that, I've always experienced that there are ways in which a platform can prepare by understanding the different channels where they'll learn about this, where they can gather information, and be prepared for the media circus, or the litigation, or the claim. And so one of the things I think that I really wanted to focus on in this is really understanding the various ways you're going to learn about an incident, having kind of a process for collecting and storing, and really understanding when it comes to insurance, right, because at the end of the day, if there is some big incident that's costly to the platform, the last thing you want is for the platform to have to put the bill for it when you've got insurance policy that frankly had you kind of notified in time. And so I guess I wanted just to get your thoughts kind of just on the insurance, the notification, that process prior to the crisis, but more when you learn of an incident and kind of your thoughts on the importance of kind of having those clear processes and procedures. Yeah, super important topic. So I think one of the themes that comes out in every chapter of your book is being ready and being proactive and monitoring to get ahead of situations that arise. So everyone knows what to do. And I'll tell you from experience, the last thing you think of is knowing, finding your insurance carriers, and when something happens. And you may not even think that it rises to the level of a claim, because sometimes the claim definition in your policies is very technical and you'd be surprised sometimes what actually falls in that category. So having great insurance brokers is if you have an insurance policy, which, you know, every company, if you're a founder, you have a, you have an internet platform or a marketplace, you should have your full insurance coverage. So go contact a broker. If you have good brokers, they'll help you with that notification process. They'll help you set up parameters. You can build that into your policies, processes, and procedures so that again, you're ahead and everyone knows what to do when a crisis happens. Whether that's litigation is a common area where you want to be covered by insurance, either your cyber policy or DNO policy. So you have to understand that you need to notify your insurance carriers. Otherwise, they're going to try to limit coverage. Right. And I think that's the worst case scenario, right? As you pay all this money for these insurance policies and then because you've missed a deadline and you haven't notified them that they don't cover it, right? You've basically wasted your money. Interestingly, and I can imagine at a, at platforms of your scale. And with my experience with some of my clients, you know, there are, when you hit such a big scale, you have, you know, like as you mentioned, tens of thousands, hundreds of thousands of tickets, customer contacts, what we'll call incidents like lowercase i, right? That doesn't, that we don't think rises to the level of an insurance claim. And even if it did, it was, you know, it's a $100 claim or something like, right, it's never going to materialize or evolve into litigation. One of the things that I've done rather successfully is with the insurance company in order to avoid our kind of subjective judgment about what qualifies as a reportable incident or potential claims is we've gone to the insurance companies and we said listen, we're going to give you every day all of our tickets. And you can sift through them. And as far as I'm concerned, any customer inquiry contact, you name it is, is going to be included. And it's almost like calling the insurance companies bluff because like no, no, no, we don't want all of that. And then we say, okay, then we need to establish very clearly. And in some cases, I've gotten the insurance companies to say if you are contacted by a lawyer or a law firm or there is a threat of actual legal action, then that is what we want to know about. Not even an injury that, you know, customer reported. And so we've managed to narrow down the world of potential incidents or reportable incidents, the insurance company. Because the reality is, is this is a huge area, I think, where there's, you know, it's subjective, it's judgment. And, you know, these things can fall through the cracks very, very easily. And so I think it's imperative that you, you know, I want to say, call the insurance companies bluff, but explain to them, they can have all the information if they want to cover your, you know, your own behind. But I think they'll quickly say, okay, let's come to some common ground. I don't know if you've had any experience with that or, you know, kind of how you've navigated that, especially with the volume that you all see. Yeah, I know it's that's a really funny and interesting area because dealing with insurance companies and claims that I think is an art in and of itself. It touches so many other aspects of the business. So we had a similar experience, you know, we have user generated content. So we get a lot of takedown notices. Under a lot of insurance policies, they take down notice would qualify as a claim. So, you know, because it's often legal threats in their claims being made. So, you know, in some initial discussions with say a new carrier that we bring on, they might say, well, okay, we want to know about all those. And then, you know, we did what you did, we say, okay, well, here's what that's going to tell is going to be. This minute, they're all routine. People may make a thread or say there's a claim, but really, they just want the content removed. And if you do, if you're a responsible platform, you do that promptly, you follow the law, you respect people's intellectual property rights and people's rights, then those things are going to go away and they're never going to materialize into something that actually reach a deductible or be covered under, they need to be covered under the policy. And so one of the things that we settled into was providing quarterly reports. So with certain threshold criteria. So one thing you mentioned, if there are external counsel, if there are legal counsel contacts, that could be an escalation criteria that might have something end up on this quarterly report. You don't put everything on the quarterly report, but it's just a list of a bunch of things that the insurance company can ask more questions about if they want to, and then we fulfilled our duty to notify them in a timely manner. Yeah, yeah, I think that's right. In your experience, I guess this seems to fall within your responsibility or your bailiwick, but I'm curious if there are takeaways or lessons that you would kind of impress upon leadership teams, not necessarily yours, but leadership teams out of this chapter kind of similar to the question before. But things that you really want a founder, for example, to know about this chapter, for example. Yeah, I think of being proactive as one. We talked about that already. You talked about a dark corner of this area that no one thinks about, and that's insurance coverage. And that's a great thing to call out because people won't really be thinking about that and getting the most of their coverage. And then I think the only thing that we didn't talk about yet that I think is really important for founders to know in the crisis area is media response. Seeing media-- so when you have a big platform, everyone knows about, you're going to get some media attention. And you're going to get attention from groups, like interest groups. But when you respond to those things publicly, whether it's on social media or giving a statement to a journalist, it really is an opportunity to correct errors, to tell your story and what your company is about and to show your accountable. If there's any error, show the authenticity that you talk about. And show that you're sorry about that. Be a front. Say what you're going to do to fix it. If you didn't make a mistake, at least set the record straight on what your platform is about, what your company is about, and what you see and for. And then you can keep reinforcing that message. And every time something media and query comes in, or there's a crisis, seeing it as an opportunity to get your story out there and show that your company does the right thing. Yeah, I think that that's really important because-- I think the main reason is 20, 30, 40 years ago-- probably not quite 40-- but I think that you would think that some negative media story would bury a platform or really hurt its reputation. And perhaps that was the case. I think that now, though-- I think people understand that bad things happen on the internet and the internet is not pure. And so I think the key number one is any sort of media inquiries that you respond, that you engage. I think this interesting psychology behind both no comment and not answering, because people fill into blanks. And you don't want people to do that, because they're not going to fill it in accurately, for sure. And then looking at it as an opportunity, even if there's no liability, culpability, whatsoever, it's an opportunity to not get defensive, but maybe talk about all of the things that you do in trust and safety. And all of these things that you do to protect your users, protect your creators, et cetera. And I don't even mean this is all public, so you can Google it. But there's no shortage of public statements that were issued when I was general counsel. And we had a little formula. And one was to talk about how to high level our focus on trust and safety and the health and well-being of our community. We would then talk about address the issue. And we would be sympathetic. We would be human, which I think, again, 30, 40 years ago, companies particularly, tech companies weren't human. And then we would talk about all of the things that we do. So the last thing you would walk away with when you read that was maybe that we could do more always, but at least you understand it without being defensive and being defensive about the specific incident. Here's all the things that we do. And I was very proud of all the things that we did. So it was something that I really always wanted to get out there consistently. But the point is, I think you're right. I mean, there's a real opportunity to engage now, right? Again, when you think about negative reviews and negative comments, there's a huge opportunity for companies to engage publicly. Not to say, sorry, we messed up. What can we-- how can we make it right? Sometimes that's the right answer. Also, hey, we're sorry about your experience. Please contact us so we can talk through it or we can make it right or we can help, right? Even if you end up never talking offline, I think that's really powerful to see a company actually respond and be empathetic and engage. And I think that that's the reputation that you want. And so I think that the media response as you said, I mean, it's just a huge opportunity. I think especially with younger founders and leadership teams somewhat inexperienced, I think they keep some up at night, and it's the worst case scenario. But the reality is-- and I hate to say it like this, because I would never want to paint a bad incident in a good light. But at the end of the day, to some degree, it's free publicity. And so you can turn this into a positive, a negative incident into something neutral or positive. I wouldn't say a good-- but you can write it wrong publicly and you can address the needs of your users. So I think that's a really key point. Well, Jimmy, I really appreciate your time. I really appreciate your insights into the chapter. And that wraps up our dive into this chapter of Bulletproofer Marketplace. If you haven't already, grab a copy of the book on Amazon. There's a lot more detail and context in there. And if you found this episode helpful, share it with your team or a fellow marketplace operator. Thanks for listening and stay bulletproof out there.