© Copyright Acquisition International 2024 - All Rights Reserved.

Article Image - Spiders in the Web: The Risks of Online Crime to Businesses
Posted 2nd June 2016

Spiders in the Web: The Risks of Online Crime to Businesses

Running a business means taking risks. The biggest risk an entrepreneur can take is not to think about risks at all.

Mouse Scroll AnimationScroll to keep reading

Let us help promote your business to a wider following.

Spiders in the Web: The Risks of Online Crime to Businesses
Image

Spiders in the Web: The Risks of Online Crime to Businesses

Running a business means taking risks. The biggest risk an entrepreneur can take is not to think about risks at all. It is therefore wise to identify the risks that (the board of) a company is exposed to in order to control them where possible: risk management. This article will focus on one particular type of risk, digital risk.

Firms’ IT systems can be breached both from the inside and from the outside. For example, breaches can come from a network attack (hacking, distributed denial of service, DDoS), viruses (Trojan horse, time bombs, worms), cybercrime, human error, a failure of the IT provider or power failure. The consequences for an enterprise can be serious – inaccessibility of the network, loss or theft of (part of) the computer system, data destruction, data manipulation, leaking of confidential information or personal data and related privacy issues. What are the legal options to manage these consequences and to ensure the continuity, security and privacy of the network and information systems of the company?

Contracts and liability

Regarding digital risks, most business owners will immediately think of the security of the software and the quality of the hardware. However, you can limit digital risks and manage any potential negative effects in advance by means of good information and communications technology (ICT) contracts.

Entering a contract

For the different digital services (such as maintenance and operation of the network system, data processing and data storage) the company will conclude contracts with different ICT suppliers (providers, cloud servers, big software providers, such as Microsoft, Apple and Google). These contracts are often standardized. However, an enterprise does not have to accept such standard contracts unreservedly and it is advisable to negotiate the contents of such contracts. The contract has to provide clarity for both parties on several basic things: Who is responsible for what? Who has the power to do what? And what are the rights and duties of the parties involved in the service chain? Here, it is vital to observe the liability for claims of clients or third parties.

Besides negotiating the agreement, the use of your own General Terms & Conditions is highly advisable. Make sure that the General Terms are declared applicable correctly. If this turns out to be difficult, try to explicitly exclude specific provisions of your counterparty’s General Terms in the agreement, as they often contain far-reaching exemption clauses. Also, check whether the General Terms of the provider contain a unilateral changes clause and make sure that the General Terms can only be changed with your permission or include in any case a notification obligation on the part of the provider in the event of a change in service. Finally, it is important to make clear arrangements in a choice of law and choice of forum clause with regard to the applicable law and the competent court.

During the contract: Service level agreement and security

The performance of the contract can be implemented via a service level agreement (SLA), which is rather common practice in ICT. An SLA includes, among other things, agreements on the level of quality and availability of the services (technical and functional specifications).

An important risk which has to be considered in the SLA is the security of the ICT systems and the data of the enterprise, especially if work is performed in different locations or in the cloud. Therefore, make agreements on the improvement of the network protection not just by firewalls but also by means of encrypting and masking data. Authentication systems can provide the enterprise with extra protection against undesirable external factors, for instance, by the use of login codes, (changing) passwords and digital certificates. Also, define who will be responsible in the event of security breaches and thus for the damage of the enterprise, clients or third parties.

In addition, it is advisable to include a notification obligation on the part of the provider in the event of security breaches and other data leaks. You can also include in the agreement a back-up obligation on the part of the ICT provider, so that there will be an alternative besides your own back-ups.

An enterprise should of course also ensure the data privacy of clients and third parties in the network and information systems. The entrepreneur is responsible for correct storage and processing of personal data. Therefore, it is important to include in the agreement with the ICT provider who is or will remain the owner of the data, who has access to the data and/ or is allowed to use it. A (mutual) confidentiality clause and a penalty clause can be included in the agreement and serve as a means for the compliance with these agreements. A prohibition to transfer personal data to third parties may also be necessary.

After the termination of the agreement

To ensure the continuity of the enterprise, clear agreements must be made regarding the termination of the agreement and what will happen with the data and systems in the event of bankruptcy or the takeover of a supplier. Thus, for instance, make sure to avoid a “vendor lock-in”, by which the enterprise is not able to switch to another supplier because the data cannot be transferred (easily) to the new provider. Conversely, it is also important to determine what will happen to the data and systems if the enterprise does not comply with agreements, has outstanding bills, goes bankrupt or is otherwise in default. The enterprise is well-advised to include an obligation on the part of the provider to return the data in the event of the termination of the agreement.

International regulations

Obviously, all agreements must be in accordance with national and international laws and regulations. This may be rather complex if the enterprise contracts with foreign parties or the data will be stored on a (cloud) provider’s system, which is physically located abroad. The enterprise is thus well-advised to investigate who the contracting partners in the service chain are and where the data will be physically stored. By including investigative or monitoring powers, the enterprise can investigate whether the supplier complies with the applicable legislations so that the enterprise can also comply with its legal obligations.

Besides, the nationality of the persons whose data are digitally processed is relevant. For example, on grounds of the current European Data Protection Regulations, businesses from non-EU Member States have to provide an “adequate level of protection” for the storage and processing of personal data of EU inhabitants. A Thai business processing data of Italian customers in the US is also subject to this Regulation, even though there is no physical relationship with Europe. In this case there is a problem because due to the so-called “USA Freedom Act” (formerly, Patriot Act), the United States does not comply with the European regulations. Until recently, transfer of personal data was permitted if an American company committed itself to comply with the “Safe Harbor Privacy Principles”. On October 6, 2015, the European Court of Justice decided however, that the United States (American ICT service providers) could not provide an adequate level of protection for personal data. Currently, the European Union and the United States are working on finding a solution for this.

Meanwhile, for the protection of the privacy of EU-citizens, the European Parliament has drawn up a General Data Protection Regulation containing stricter rules and higher fines. It is expected to become effective in 2017.

Conclusion

Entrepreneurs do almost everything digitally, but the risks of digital business operations are often not fully taken into account. With this article, we have tried to create greater awareness of digital risks and offer suggestions to manage them. Your outside corporate counsel, who knows your business like no other person, will be able to provide advice so that you will be aware of potential risks and be able to cover them legally, if desired. Then you, as entrepreneur, will be able to confidently use all the opportunities provided by the digital work environment.

Company: Russell Advocaten
Name: Reinier W.L. Russell,
LL.M.
Email: reinier.russell@russell.nl
Web: www.russell.nl
Address: Reimersbeek 2
1082 AG, Amsterdam /
P.O. Box 87400
1080 JK Amsterdam
Phone: +31 20 301 55 55

Categories: Legal, Strategy


You Might Also Like
Read Full PostRead - Eye Icon
Fashion Startup: How to Market Your Brand and Acquire Customers
News
19/02/2024Fashion Startup: How to Market Your Brand and Acquire Customers

Starting a fashion brand in today’s competitive market requires more than just a keen eye for style. With countless emerging designers and established brands vying for attention, effective marketing strategies are essential for standing out and acquiring

Read Full PostRead - Eye Icon
4 Tips For Assessing Liability Issues When Acquiring A Small Business
News
14/08/20234 Tips For Assessing Liability Issues When Acquiring A Small Business

https://pixabay.com/photos/people-business-meeting-1979261/ A business acquisition, regardless of the seller’s size, comes with many strings attached. If you’re not prepared to untangle each and every one of those strings in order to ensure the tak

Read Full PostRead - Eye Icon
Enhancing Sustainability and Efficiency with Commercial Heating Systems
News
19/12/2023Enhancing Sustainability and Efficiency with Commercial Heating Systems

When it comes to heating systems on commercial premises, gas boilers remain the go-to option for businesses of all sizes and industries. These appliances offer the perfect balance of power, performance, reliability, and efficiency, while also allowing for besp

Read Full PostRead - Eye Icon
Moving Class Outside: Adjusting Academics
News
13/08/2021Moving Class Outside: Adjusting Academics

When you think of the typical classroom, you’re probably picturing brick walls, rows of desks, a chalkboard and a few decorations that match the subject being taught. Over this past year, though, the traditional classroom has been flipped. The pandemic sent

Read Full PostRead - Eye Icon
Uncloak Technology for Cutting-Edge Brand Protection
News
18/03/2024Uncloak Technology for Cutting-Edge Brand Protection

Uncloak Technology for Cutting-Edge Brand Protection In the ever-evolving terrain of the digital age, the realm of brand protection has witnessed a paradigm shift with the advent of Uncloak technology. This groundbreaking innovation has revolutionized the way

Read Full PostRead - Eye Icon
Building Trust in Digital Securities: Insurance’s Time To Step Up
News
10/02/2020Building Trust in Digital Securities: Insurance’s Time To Step Up

Assurely’s Co-Founder and Chief Insurance Officer, Ty Sagalow shares his views about the role insurance can play to advance digital securities.

Read Full PostRead - Eye Icon
Thornton’s Takeover: Ferrero Buys Majority
Finance
23/06/2015Thornton’s Takeover: Ferrero Buys Majority

Ferrero International have successfully completed a takeover bid for the UK-based confectionery store chain.

Read Full PostRead - Eye Icon
Nationwide Ranked as a Five-Star Business in Latest Corporate Responsibility Index
Finance
21/04/2015Nationwide Ranked as a Five-Star Business in Latest Corporate Responsibility Index

Nationwide has been awarded Business in the Community's highest five-star ranking in its annual benchmark of responsible business – the Corporate Responsibility Index (CR Index).

Read Full PostRead - Eye Icon
Economic Development Excellence
Finance
08/04/2022Economic Development Excellence

The Coega Development Corporation (CDC) is headquartered in the City of Gqeberha, Nelson Mandela Bay Municipality, South Africa. It is the developer and operator of the Coega Special Economic Zone (SEZ).



Our Trusted Brands

Acquisition International is a flagship brand of AI Global Media. AI Global Media is a B2B enterprise and are committed to creating engaging content allowing businesses to market their services to a larger global audience. We have 14 unique brands, each of which serves a specific industry or region. Each brand covers the latest news in its sector and publishes a digital magazine and newsletter which is read by a global audience.

Arrow