Tech & Sourcing @ Morgan Lewis

As a reminder, China’s new Data Security Law (DSL), which entails more expansive and restrictive requirements on data localization, mandatory security level certification, and severe penalties for unauthorized foreign transfer of data, will come into effect on September 1, 2021. The DSL will potentially affect all business operators in China, including multinational corporations. Our privacy and cybersecurity team recently published a more detailed analysis of the DSL. If you have any specific questions, don’t hesitate to reach out to your Morgan Lewis contact for assistance.

Read the full LawFlash >>

A recent judgment by the High Court of England and Wales in the case of Jamp Pharma Corp v. Unichem Laboratories Limited has held that agreements reached as part of contract negotiations for contracts governed by English law may be impliedly “subject to contract” without the need to expressly state that the discussions and documents are “subject to contract” prior to a formal executed agreement.

Planning for major service disruptions and disasters, such as prolonged power failures, fires, flooding, and other extreme weather events, is an important element of strategic technology and service agreements.

Changes to complex commercial contracts are inevitable. These contracts, such as large outsourcing agreements, typically include a master services agreement (MSA) and a high number of exhibits and attachments describing the scope, performance standards, financials, and other contractual requirements in detail. Some deals can end up containing over 50–75 documents (or more!) in total. Given their strategic importance, these agreements often require numerous amendments as the relationship evolves over time and changes need to be formally documented.

For UK companies choosing between hiring employees or using independent contractors, there are important legal risks that must be taken into consideration. In addition, agile and remote workforces are a hot topic as companies around the world are considering new ways of working following the COVID-19 pandemic. However, in the post-Brexit United Kingdom, the idea that people can work in any place at any time presents tax, data protection, and employment law challenges.

The European Cloud User Coalition (ECUC) published a paper (the Position Paper) on May 17 recommending, among other matters, the adoption of “model clauses” for the long-term compliant use of cloud technologies.

The European Securities and Markets Authority (ESMA) on May 10 published final guidelines on outsourcing to cloud service providers (ESMA Guidelines) to help firms and competent authorities identify, address, and monitor the risks and challenges arising from cloud outsourcing arrangements. Subject to a few clarifications, the ESMA Guidelines are broadly consistent with the draft guidelines.

The UK Prudential Regulation Authority (PRA) published a policy statement (PS7/21) and a supervisory statement (SS2/21) on clarifying and modernizing regulatory expectations of outsourcing and third-party risk management on March 29. The expectations in PS7/21 and SS2/21 are relevant to banks, PRA-designated investment firms, insurers, and branches of overseas banks and insurers and apply not just to “outsourcing” but also non-outsourcing material or high-risk service arrangements. The expectations apply at a legal entity level rather than at a group level (save for expectations on intragroup arrangements).

We recently noted that the UK Financial Conduct Authority (FCA) published the outcome of a review into the factors that determine failure or success when implementing technology change in the financial services sector and discussed the importance of this review for firms seeking to improve the operational resiliency of their technology change management process.

The UK Financial Conduct Authority (FCA) has published its findings on an extensive review into the factors which determine failure or success when implementing technology change in the financial services sector.