Sourcing Speak

The UK government has issued a consultation on proposed changes to the Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246) (TUPE).

TUPE is the UK’s implementation of the Acquired Rights Directive (2001/23/EC) (ARD) and, broadly speaking, protects employees when the business or undertaking for which they work transfers to a new employer. Critics of TUPE (which revoked the 1981 TUPE regulations) have raised concerns that it ‘gold plates’ the ARD (i.e. it does more than is strictly required by the Directive) and is too bureaucratic. They also cite a number of practical difficulties. In November 2011, the UK government responded by publishing a Call for evidence on the effectiveness of TUPE, subsequently concluding that the gold plating aspects of TUPE should be removed and the operation of the regulation be made more practical.

What does this mean for outsourcing and other long-term service arrangements? The most significant change being proposed is the repeal of the regulations relating to “service provision changes.” The “service provision changes” provisions were introduced in 2006 in an attempt to avoid uncertainty as to when TUPE applied. The 2006 Regulation expressly states that TUPE applies at the end of a services relationship in the same way that it already applied under the earlier TUPE regulation to a “relevant transfer” at the outset. Thus, in certain circumstances (which have had to be clarified recently by a number of employment tribunal and decisions and appeals), an automatic transfer of the staff working on delivering outsourced services would take place under TUPE at the end of an outsourcing deal, regardless of whether the work is taken on by another third party as a successor to the original supplier or is brought back in-house by the customer.

We have written before on this blog about the visa issues that offshore service providers face when bringing talented resourced to the U.S. from other countries. Since there are a finite number of H1-B visas that can be issued each year, some service providers have sidestepped the limit by obtaining B-1 visas, which contemplate a more short term engagement than most outsourcing contracts envision.

In response to a host of immigration issues, the Senate has recently introduced a bill that would not only increase the number of H1-B visas that can be issued each year, but would also include an automatic increase to a maximum of 300,000 visas annually if there is sufficient demand. Currently, the United States has an H-1B visa cap of 65,000, and the proposed legislation would increase the cap to 115,000, with the potential to rise to 300,000.

The proposed legislation would certainly ease the visa restrictions on offshore service providers that are seeking to bring top talent to the United States. A recent report in the Economist has noted that there is an increasing trend in customers bringing offshored services closer to home in the United States, and this proposed legislation would make it easier for offshore suppliers to staff in the U.S. using foreign workers. In particular, the Economist noted that Infosys has opened new offices in the U.S. in order to accommodate its customer’s requirements for on-shore offices. With the trend of customers moving IT services back closer to home, the relaxed visa restrictions will put offshore service providers in a better position to win business with their top talent located in the U.S.

On 1 January 2013, over 4 years after the idea was first discussed, new Binding Corporate Rules (BCRs) for data processors were launched following a meeting of European data protection authorities.

BCRs are internal codes of conduct which companies within a group can “sign up to” regarding data privacy and security to ensure that transfers of personal data outside of Europe will meet European rules on data protection. Whilst BCRs have been an option for data controllers to ensure compliant transfers from Europe for some time, the introduction of BCRs for processors have been welcomed with open arms by both data controllers and data processors alike.

As a result of this change, processors, such as IT outsourcing providers, cloud providers and data centre providers, who implement BCRs will be able to receive data in Europe from their controller clients and then transfer that data within their group, outside of Europe, whilst complying with European privacy rules. For processors who choose BCRs to ensure compliance, this development could significantly reduce managerial time (and paper) spent negotiating often complicated, data protection safeguards for each and every data processing activity they carry out, whilst also doing away with the supervision associated with such contracts once they are up and running. At the same time, this development offers controllers’ clients comfort in the sense that controllers will be able to more simply demonstrate that their processing activities comply with European laws by pointing to an approved set of BCRs.