Tech & Sourcing @ Morgan Lewis

The UK Financial Conduct Authority (FCA) announced on July 8 that the guidelines issued by the European Insurance and Occupational Pension Authority (EIOPA) on outsourcing to cloud service providers are not applicable to regulated activities (in this instance, insurance and reinsurance undertakings) within the UK jurisdiction.

The Business Software Alliance (BSA) recently endorsed principles for building trust in the Internet of Things (IoT), highlighting the need for a risk-based approach that (1) accounts for the various components, capabilities, users, environments, life cycles, and complexities of the IoT ecosystem, and (2) engages the corresponding stakeholders. Given the near boundless opportunities—and risks—deriving from its connectivity, a connected device should not be designed and managed in isolation.

The European Securities and Markets Authority (ESMA) published its draft guidelines on outsourcing to cloud service providers on June 3. Steven Maijoor, the chair of ESMA, indicated that the purpose of the guidelines is to “help firms understand and mitigate the risks that they are exposed to when outsourcing to cloud service providers.”

Although many companies are already revisiting contractual provisions relating to nonperformance, like force majeure clauses, as the coronavirus (COVID-19) pandemic continues to wreak havoc on public health and the economy.

In a prior series of posts, we discussed issues relating to intellectual property indemnification, including some exceptions, remedies, and allocation of liability. Given that these provisions often involve taxing negotiations and that many technologies have become intertwined, below we explore some nuanced—and frequently sticky—issues regarding third-party products and how they can be resolved.

In the wake of the reinvigorated call for equality and greater diversity and inclusion, many companies—largely through their procurement organizations—are taking the opportunity to revisit their diversity supplier programs, including assessing impact and reevaluating best practices for pursuing supplier diversity and tracking the impact of these programs.

Following the US Department of Justice’s recent recommendations to reform Section 230 of the Communications Decency Act (CDA) to provide incentives for online platforms to address illicit material on their platforms, two US senators have proposed the Platform Accountability and Consumer Transparency Act (PACT), legislation aimed at reforming Section 230 of the CDA.

In an ideal outsourcing relationship, technology transformation through innovation, continuous improvement, and future project work is never really “over.”

Earlier this month, we discussed the significance of the transformation workstream in outsourcing transactions and outlined important topics and points to consider when documenting the overall transformation methodology exhibit.

The July 1 enforcement of the California Consumer Privacy Act (CCPA) is one week away. Despite calls by the business community and trade associations to push back the enforcement date to January 2021 due to the coronavirus (COVID-19) pandemic and related disruptions to compliance efforts, the California state attorney general issued a press release on June 2 stating, “Businesses have had since January 1 to comply with the law, and we are committed to enforcing it starting July 1.”