Posted
By

As the range of technology employed by the UK’s leading banks widens, the balance between cost-effectiveness and manageability of solutions becomes increasingly difficult to strike. 

Background

The banking sector in the UK has grown significantly through acquisition and amalgamation. The result is a market dominated by banking groups, which have not yet had the time, finances or inclination to set about harmonising the underlying IT infrastructure of their respective component parts. The table below highlights some of the key retail bank elements of the UK’s major clearing banks, alongside which it is necessary to consider the various additional investment bank, private client, credit card and other major business unit components that sit within the same group.

Continue reading

Posted
By

Part 2: How are Limits of Liability Evolving, with Respect to the Issue of Data Breaches?

Ten years ago, most “buyers/customers” expected their suppliers to absorb unlimited contractual liability if the supplier was responsible for a breach affecting the customer’s data. Today, while customers may continue to insist upon such a position at the beginning of negotiations, they frequently expect that market-leading suppliers will ask for some sort of limit to the supplier’s potential liability for data breaches.

When customers are forced to negotiate a liability cap applicable to breaches of data (including PII and PHI), they usually insist that such liability cap be an amount that is greater than the “standard” limit of liability under the Agreement (i.e., greater than the standard financial cap applicable other contract breaches).

Continue reading

Posted
By

Part 1: Contractual Protections With Respect to Data Breaches

Given the unrelenting, it seems, news reports of cyber attacks and data breaches affecting customer records and data, the issue of what are the appropriate contractual provisions that should govern data breaches in a contract between customers and suppliers remains timely, sticky, and constantly-evolving. Below are several observations regarding contractual language and protections with respect to data breaches, where a supplier has access to and/or could cause or allow a customer’s data to be breached.

  • Customers continue to insist upon strict terms and conditions requiring their suppliers to protect the customer’s confidential information, including with respect to the customer’s (i) data (i.e., information stored in equipment and software), (ii) Personally Identifiable Information (PII), and (iii) Protected Health Information (PHI).
Continue reading

Posted
By

There is no shortage of commentary on why mergers and acquisitions fail or do not live up to their projected potential. The percentage of failed or underachieving deals is astounding with some placing the failure rate over eighty percent.The reasons for this dismal outlook range from ill-advised strategic vision, misaligned expectations and poor execution to cultural clashes, fumbled integration, and (some would say) misguided management objectives.

Over the past decade I’ve observed another factor that contributes to these suboptimal results: poorly planned, constructed and executed transition services, especially in connection with divestitures and carve-outs. The two main factors contributing to deficient transition service arrangements fall into two general categories: (1) a flawed perspective on the importance of transition services; and (2) errant development and execution of the transition service regime.

Let’s explore each of these factors both in terms of how they arise and how they can be avoided, focusing first on what I refer to as the flawed perspective.

Continue reading

Posted
By

News of Alibaba’s cloud investment and a recent software park tour indicate that China’s IT services industry is evolving in its own way.

Alibaba Invades Silicon Valley

The “Amazon of China” is following Amazon’s playbook yet again with their investment in the cloud. Aliyun, Alibaba’s technology arm, already operates five Chinese data centers supporting 1.4 million customers. They cite high performance specs, such as the ability to process 80,000 orders per second during peak shopping season, and a successful defense against the largest recorded DDoS attack in China, which lasted 14 hours with a peak onslaught of 453.8 gigabytes per second.

Continue reading

Posted
By

The Internet of Things (IoT), whereby miniature computers are embedded into objects and devices and connected via the internet using wireless technology, offers many advantages, such as smart thermostats which have the ability to remotely monitor and adjust your heating at home, and medical devices / apps which are used by patients to enable remote monitoring (e.g. a dangerous change in a patient’s insulin levels).

Speaking recently at CES 2015, Las Vegas’ annual hi-tech trade show, the chair of the US Federal Trade Commission, Edith Ramirez, warned of a future where smart interconnected devices enable technology firms to build a “deeply personal” and increasingly detailed and granular picture of consumers that will subject consumers to highly targeted advertising of products and services, as well as leaving them vulnerable to data attack.  Ms. Ramirez said that smart devices could potentially collect data such as an individual’s health, religious and other lifestyle preferences, and asked “will this information be used to paint a picture of you that you won’t see but that others will?”  Data should only be gathered for a specific purpose, said Ms. Ramirez…“I question the notion that we must put sensitive consumer data at risk on the off-chance a company might someday discover a valuable use for the information”.

Regulators around the world are increasingly concerned to ensure that security and privacy issues are taken seriously by device manufacturers.  For example, the Article 29 Working Party (the independent European advisory body on data protection and privacy) issued an Opinion in September last year which reviewed the IoT and the specific data protection and privacy challenges raised by it, assessed the state of the applicable law (in Europe) and made a number of recommendations applicable to relevant IoT stakeholders. These include a call for IoT device, O/S and application manufacturers, and developers to apply the principles of Privacy by Design and Privacy by Default and to undertake Privacy Impact Assessments (PIAs) before any new application is launched in the IoT.

Continue reading

Posted
By

This is the second of two postings that outline key pricing protections you should consider negotiating with licensors of ERP software to provide flexibility and predictability in managing the ongoing license and maintenance costs associated with the software.  In the earlier posting, we discussed future option discounts, exchange rights, and maintenance locks and caps.  In this posting, we focus on shelving and termination rights, acquisitions and divestitures, and successor products.

Shelving / Termination Rights

Shelving and termination rights provide the ability to reduce annual maintenance spend on unused licenses by either “putting them on the shelf” until needed or terminating unneeded licenses altogether.  There are three basic approaches to shelving and termination rights.  In descending order of desirability, they are:

Continue reading

Posted
By

The licensing and implementation of ERP software is a major long-term investment for any company.  In addition to negotiating favorable upfront pricing for the software, it is important to build in pricing mechanisms that provide flexibility and predictability in managing the ongoing license and maintenance costs associated with the software.  This is the first of two postings that outline key pricing protections that you should consider negotiating with licensors of ERP software.

Future Option Discount

A future option discount provides a right to purchase additional software licenses at a specified price or at a specified discount off the licensor’s then current list price.  This right has a number of benefits:

Continue reading

Posted
By

As a thin guy, I used to subscribe to the philosophy of wearing large clothes to look bigger than I was.  What I actually looked like was a scrawny guy in ill-fitting clothes that were not overly comfortable.

Sourcing of IT and associated services may be falling into a similar trap.  Rather than using agreements that are the right shape or size, purchasing organizations are developing and rolling out standard templates that are supposedly broad enough to cover everything–unfortunately, they often do not cover any particularly purchase properly.  Specifically, we are seeing a proliferation of master service agreements (MSAs) that, largely speaking, come from an IT development context.  These are then begin applied to software licensing, professional services; and cloud services agreements–all of which are different transactions with different needs.

To illustrate, let’s review the application of an MSA to a Software as a Service (SAAS) offering.  As a threshold, the MSA contemplates project style initiatives, whereas the SAAS offering is by its nature on ongoing, recurring offering over a specified term.  Under an MSA, the buyer typically attempts to assert ownership of all developments; this is antithetical to the SAAS model where the supplier contributes IP to continually improve its offering.  Under the MSA, the buyer heavily negotiates the service levels; in SAAS, the service levels are the same for all like buyers–without such consistency, there is no shared offering and no cost benefit of the SAAS model.  We could go on, but the point is clear–a customer MSA is not likely to be a good fit for a SAAS offering.

Continue reading

Posted
By

Innovation is prized in the growing space of the Internet of Things.  But an innovative product design is not enough, and potential pitfalls abound.  As demonstrated in a report published by the Federal Trade Commission, privacy and security need to be at the forefront of developers’ minds.  Here are five lessons on what not to do when developing a connected product.

The Internet of Things (“IoT”) is an expanding ecosystem of everyday objects that are embedded with technology, allowing them to connect, communicate, and transfer information about users and their surroundings to each other.  IoT products boast beneficial effects such as increasing economic productivity and efficiency, encouraging robust innovation, and tailoring user experiences.  However, by virtue of being connected to the Internet, IoT products also carry privacy and security risks.  On January 27, 2015, the Federal Trade Commission (“FTC”) published a report focusing on privacy and security concerns for IoT devices sold to consumers.

Given the growing interest in how embedded computing advancements affect security and privacy issues, this Alert identifies what developers, investors, and entrepreneurs should avoid when entering the IoT market.

Continue reading