Tech & Sourcing @ Morgan Lewis

On June 4, 2021, the European Commission adopted its long-anticipated updated Standard Contractual Clauses (New SCCs) for use by organizations transferring personal data outside of the European Economic Area (EEA) to third countries that do not provide adequate protections in respect of personal data. For more information, read our June 10 LawFlash, New European Standard Contractual Clauses Adopted for International Data Transfers. In this post we look at some of the things that organizations will need to consider when updating their current standard contractual clauses (SCCs).

There are often misconceptions in connection with negotiating intellectual property (IP) development agreements with developers located in Russia. This post details five common misconceptions and provides tips for complying with applicable laws in connection with such agreements.

The European Securities and Markets Authority (ESMA) on May 10 published final guidelines on outsourcing to cloud service providers (ESMA Guidelines) to help firms and competent authorities identify, address, and monitor the risks and challenges arising from cloud outsourcing arrangements. Subject to a few clarifications, the ESMA Guidelines are broadly consistent with the draft guidelines.

The UK Prudential Regulation Authority (PRA) published a policy statement (PS7/21) and a supervisory statement (SS2/21) on clarifying and modernizing regulatory expectations of outsourcing and third-party risk management on March 29. The expectations in PS7/21 and SS2/21 are relevant to banks, PRA-designated investment firms, insurers, and branches of overseas banks and insurers and apply not just to “outsourcing” but also non-outsourcing material or high-risk service arrangements. The expectations apply at a legal entity level rather than at a group level (save for expectations on intragroup arrangements).

The United Kingdom’s Digital Regulation Cooperation Forum (DRCF) on March 10 announced in its 2021–2022 workplan that the UK Financial Conduct Authority (FCA) will join as a full member from April 1, 2021.

If you have been involved with SaaS agreements or agreements that are for, or are enabled by, cloud services, you have seen or even drafted provisions relating to the right to use data processed on or generated through the use of the cloud platform.

In November 2020, Massachusetts voters approved Question One, a ballot initiative amending the Commonwealth’s 2012 Right to Repair Law. The amendment provides that motor vehicles sold in Massachusetts “with model year 2022” will be required “to equip any such vehicles that use telematics systems – systems that collect and wirelessly transmit mechanical data to a remote server – with a standardized open access data platform. Owners of motor vehicles with telematics systems would get access to mechanical data through a mobile device application.”

Traders selling goods, services, and/or digital content online to consumers in the United Kingdom and the European Union need to comply with laws requiring the provision of certain information as part of the sales process.

The European Commission (Commission) published draft Article 28 standard contractual clauses (Article 28 Clauses) last month for use between controllers and processors when processing personal data in the European Union. Somewhat confusingly, these clauses share the same name as the new Standard Contractual Clauses for personal data transfers out of the EEA, which were also published in November 2020; however, the two are distinct.

The use of aggregated data by technology service providers is quite common in today’s landscape, and something that even traditionally cautious customers have become amenable to in the right circumstances and subject to proper limitations.