impact of certain international laws on the indian outsourcing industry

7/28/2019 Impact of Certain International Laws on the Indian Outsourcing Industry

http://slidepdf.com/reader/full/impact-of-certain-international-laws-on-the-indian-outsourcing-industry 1/65

Impact of CertainInternational Laws on the

Indian Outsourcing IndustryIIM-Bangalore

Conference on Management of Globally Distributed Work

Poorvi Chothani, Esq.

Correspondent to Cyrus D. Mehta & Associates, PLLC,New York (US Immigration & Nationality Law)

[email protected]

CP: 98209 39666

mailto:[email protected]

mailto:[email protected]



Monday, April 15,2013 2

Need for Protection Technological readiness of the

Indian BPO industry is very high

Regulatory frame work is inadequate BPOs deal with sensitive and/or

private data that needs protection

Internet instrument in flattening of the world – level playing field forknowledge and access to ideas*

Ref. Thomas Friedman‟s “The World is Flat”




Need for Protection

Legal lag behind technology

Outsourcing Industry is a great

economic advantage to India

Other, competing outsourcingdestinations are growing

The Right to Information Act inIndia will raise more privacy issues




The US and the EU do not havecomprehensive privacy or data protectionlaws, which affect the BPO and Information

Technology Enabled Services

Intellectual property

Corporate secrets

ConfidentialCustomer HealthInformation

Financial

Information Trade Secrets

Personal

Identifiable

Information• Name

• Addresses

• National IdentifyingNumbers

• Telephone Numbers• Birth Date

• Drivers Licenseinformation

• Credit History

• Court, and Trafficviolation records



The EC Data Protection Directive

(EU Directive) Recognizes privacy as a right

Data protection principles - limit theprocessing and transfer of personalinformation, including transfer of the

data to countries outside the EU



EU Data Protection Directive

The EU Directive Each EC Member State has to enact

laws in keeping with the EU Directive

For e.g. the EU Directive implementedby the United Kingdom Data ProtectionAct 1998.

Approved set of standard contractualclauses

EU Directive applies to the “processing” of personal data




Data Protection Principle

Restricts the transfer of personal dataoutside the EU Countries unless the other

country ensures an adequate level of protection

The “data controller” is liable for ensuringthat these principles are adhered to



Transfer of Data Under theEU Directive

Transfer to Countries with Adequate Protectionwithout additional adequacy requirements -Switzerland, Canada, Argentina and the UK

territories of Guernsey and the Isle of Man, allrecognized by the EU as offering adequate dataprotection.

European Court – recent holding – mere accessfrom non-EU country does not constitute

“transfer.”



Options to transfer restrictions

under the EU Directive Adopt Standard Contract Clauses

Unambiguous Consent to transfer – fromaffected individuals

Negotiated Protections – acceptable in the UK

Codes of Conduct

Direct Compliance/registration with EUAuthority

Some EU countries require that a copy of theexecuted agreement with the standardclauses be deposited with the regulatoryauthority – this is not the case in the UK.




Safe Harbor Framework

The Safe Harbor is a voluntary self-certification program.

It recognizes and implements principlesof the EU Data Directive.

Create a system of notice, opt-out, opt-

in for certain sensitive information,control of subsequent transfers, datasecurity and integrity systems




Penalties Under the EUDirective

Each Member States‟ national laws willdetermine the penalty

For Instance – Under The UK DataProtection Act 1998 – The RegulatoryAuthority who is The InformationCommissioner also imposes the penalty

Fines; and Document that infringes privacy to be

forfeited, destroyed or erased.




Some US Laws

Graham-Leach-Biley Act 1999 (GLBA)

The Sarbanes-Oxley (SOX) Act

The Health Insurance Portability andAccountability Act (HIPAA)




Graham-Leach-Biley Act 1999(GLBA)

Applies to financial institutions – toensure meaningful measures to protectcustomers' personal information.

Restricts the transmission of personaldata to third parties.

Transfer of data – includes actualphysical movement of data to a processor

located in another country as well as theremote access by the Overseas ServiceProvider.




GLBA contd.

Organizations must:

Develop, Implement and maintain a

comprehensive information securityProgram.

Program must include

administrative, technical andphysical safeguards appropriate tothe



The Sarbanes-Oxley (SOX)Act

Reactionary measure to US corporatescandals, has a significant impact on US

companies as well as auditing firms. To strengthen Corporate governance and

restore investors confidence. Companies must attest that outsourcing

firms have internal controls in place tocomply with SOX and other regulations.



Sarbanes – Oxley

Legislation is wide ranging and establishesnew or enhanced standards for all USpublic company Boards, Management, andpublic accounting firms.

Contains 11 titles, or sections, rangingfrom additional Corporate Boardresponsibilities to criminal penalties.

Requires Security and ExchangeCommission (SEC) to implement rulingson requirements to comply with the newlaw.



The Health InsurancePortability and

Accountability Act (HIPAA)

Establishes privacy protection for health careinformation.

HIPAA provisions apply to organizations thatoffer health plans, doctors, hospitals andother health care providers and in turn theMedical Transcription Industry

Limits the use of patient information

Would extend to the Offshored activity of theorganizations

s

http://www.bambooweb.com/articles/h/o/Hospital.html

http://www.bambooweb.com/articles/h/e/Health_care.html




http://www.bambooweb.com/articles/h/o/Hospital.html



HIPAA Contd.

Information may be disclosed to abusiness associate if

The data owner obtains satisfactoryassurance in a written agreement that

the information will be safeguarded

Data Owner will most likely requirebusiness associates to agree to the

same obligations that apply to thecovered entity.



HIPAA Compliance

Self-assessments, employee training, andincreased technological capacities

Administrative, technical, and physicalsafeguards Must reasonably safeguard

from any intentional or unintentional useor disclosure that is in violation of thestandard

implementation specifications or other

requirements of (the Privacy Rules). Business associate would have to comply

too.




Protection Act, (TCPA)

Restricts the use of the telephoneand facsimile machine to deliver

unsolicited advertisements. Prohibits the delivery of artificial or

prerecorded messages to residences

Once a consumer asks not to receivecalls from a particular company, thatcompany may not call thatconsumer.




TCPA & Related FCC Rules

Prohibits autodialed calls to emergencytelephone lines, health care facilities,paging services, cellular telephones, and

any service for which the called party ischarged for the call.

A National Do-Not-Call registry

It includes all telemarketers (with the exception of

certain nonprofit organizations) Covers both interstate and intrastate telemarketing calls

Consumers can place their telephone numbers on theregistry through one telephone call or one Web click.




Other US laws

The Fair and Accurate Credit Transactions Actof 2003 – Disposal of Records (affects almost

every business in the US The Federal Credit Reporting Act limits access

to credit histories and personal information.

US Patriot Act – Affects bank secrecy tocombat money laundering, terrorism andcriminal behavior.




Penalties

Each violation of The Children‟s OnlinePrivacy Protection Act invokes a penalty of $11,000.

Penalty – actual damages, statutorydamages up to $1000, punitivedamages per violation (no cap on class

action damages, attorney fees and civilpenalties up to $2,500




Penalties

HIPAA violations

Penalty of up to US$ 25,000; Knowing wrongful disclosure invokes

penalty of US$ 50,000 and/orimprisonment up to one year

False pretenses, the offender may befined up to US$ 1000,000 and/orimprisoned up to 5 years, the penalty isincreased respectively to US$ 250,000,and 10 years if the offense is committedwith intent to gain commercial advantagefor violating HIPAA.




Penalties

The penalties for violating GLBA are steep andcost up to $11,000 per day and $10,000

Penalties for violation of FACTA‟s rule of disposal, which affects most businesses,invokes actual damages, statutory damages,punitive damages per violation, attorneys feesand penalties up to US$ 2,500.




Relevance of US Laws toIndian Businesses

Extraterritorial reach?

Affect conduct of business (both

onshore and offshore). Stringent reporting requirements and

penalties.

Assumption of liability under contract. Choice of law of a foreign jurisdiction

automatically extends to liability.



Challenges to the OSP Industry

Indian laws - loopholes need to beplugged.

Lack of regulation and enforcement.

Exclusive regulation of theoutsourcing industry.

Lack of awareness of Data Security

and Confidentially Poor general awareness about data

security and confidentially.



Governing Law

Generally – Indian Law

India recognises and respects Choice of

Law, but not Ouster of JurisdictionClauses

Different laws for different aspects.

Local laws may preempt choice of law.

Contractual law may imply choice of foreign law.

US or State Laws and



US or State Laws andPending Bills

US States, laws or pending bills to: Regulate privacy and personal data;

Impose obligations on call centeractivities;

Try to minimize or ban offshoring of state contracts;

Some of these measures are protective of the US workforce.

Many of the bills may fail, be significantlydiluted or be challenged on grounds of constitutionality or found to violateinternational trade agreements.

US or State Laws and




US or State Laws andPending Bills

The United States Workers Protection Act

of 2004. The American Manufacturing Jobs

Retention Act of 2003.

The Call Centers Customer‟s Right to Know

Act of 2003.



US State Laws or PendingBills

A Texas bill prohibits the employment of foreign workers on state contracts.

Iowa has a bill that provides forpreference for call centers contracts to beperformed with US citizens or othersauthorized to work in the US.

Ohio bill requires any employer that

eliminates employment positions in Ohio andthose employment positions outside theUnited States to provide those employeesloosing their job with written notice of therelocation.

US State Laws or Pending




US State Laws or PendingBills

Connecticut bill:

Would require companies with a net jobloss of one hundred or more to Submit to the state‟s Development of

Economic and Community Development

A statement including the number of jobsthe company cut

Would also allow a citizen who believes hehas lost his job as a result of outsourcingto report the loss to the state for record-keeping purposes.

US State Laws or Pending




U a a o d gBills

Six states and US Senate haveintroduced legislation that would make

it mandatory for companies to makedisclosures about any activities, thatrelate to Offshoring.

Contain language that does not applyto private contracts but specificallyaffects state contracts.




State Bills

North Carolina

Washington Bills that require all contractors to disclose

where work on the state contracts will beperformed, which can figure into theevaluation of the bid.Oregon;

Minnesota; andMassachusetts Bills That Require Call Center Operators to

Disclose Their Location

Bills that curtail the granting of




Bills that curtail the granting of state contracts to Non-US

workers or restrict performanceof state contracts outside theUS

New York;

Massachusetts;

Texas;

Oregon; Pennsylvania;

Florida;

Maryland;

Missouri; and

Nevada

Vermont Bill – Example of



pLanguage in Bills

The General Assembly finds that the stateregularly awards contracts for services thatare vital to Vermont residents, and that adisturbing trend is developing nationally inwhich contractors and subcontractors underservice contracts awarded by stategovernments employ persons in foreigncountries to perform these vital services. Thegeneral assembly further finds that persons

performing these service contracts in foreigncounties are generally paid wages that aresignificantly below the minimum wages in thisstage, and that this trend of awarding servicecontract to performed outside the United

states is threatening to the jobs andlivelihood of Vermonters and all Americans.




California Privacy Laws

Law of Notice of Security Breach:Owner of personal information becomesaware of a breach of security mustdisclose the breach to every resident of

California whose unencrypted personalinformation was, or is believed to havebeen, accessed by an unauthorizedperson.

Privacy of financial information:Stricter than GLBA requiresaffirmative „opt-in‟ for sharing of information with third parties, provides

for „opt-out‟ for sharing with affiliatesunless in the same line of business






Online Privacy Act

Information sharing disclosure:Business having personal information

of a California resident must give listof categories of information sharedwith third parties with the names andcontact information of the thirdparties, OR provide a conspicuousprivacy statement with a cost free „opt out‟ prior to the disclosure.

Prohibitions on the



Prohibitions on theTransmission of Information Tennessee legislators introduced a measure

that would require a company to obtain theexpress written permission of a customerbefore sending any „financial, credit oridentifying‟ information to a foreign country.

In California proposed legislation that wouldrequire businesses to comply with very strictprivacy requirements when by sending anindividual‟s personal information abroad.

Much of these legislation is aimed at eitherblocking the transmission of an individual‟smedical records to a site overseas orpreventing a customer‟s financial informationbeing sent to a foreign country without their

express consent.

Protectionism-Implications



Protectionism Implicationsfor the US and the World

Create friction and hurdles incommercial activities

Effective measures to stifle meaningfuloutsourcing

US companies will be less competitiveand will put even more jobs in danger if they cannot benefit from service costarbitrage

Deterrent to American companies fromoffshoring medical, accounting,financial consulting or other

information-based services overseas




otect o s p cat o sfor the US and the World

Stringent laws will.

Restrictions restrict offshore callcenters because OSPs would be

unable to access most accountinformation to perform any usefultasks.

Absence of lsegal ramificationsdoes not alleviate the harm topublic image




for the US and the World The legislation banning state awards of grants,

loans, or tax credits to companies thatoutsource any labor or services would serveprimarily to alter the formula businesses use toevaluate the cost-effectiveness of offshoring.

Protectionist measures will only serve toalleviate Us job market issues for the immediatefuture.

Offshoring is a valuable tool for Americanbusiness and lawmakers who should beembracing it as a vehicle for innovation, notderiding it as the US economy‟s executioner.

Non-Delegable Responsibilities



Non-Delegable Responsibilitiesfor Offshored Work

Data protection laws, that are modeledon the European regime, are aimed atdata controllers or processors without

regard to any employment relationship.

Customer retains legal responsibility fortransgressions by the sourced processor

abroad.

Canada Legislation – affectsbusiness with the US



business with the US

Legislation similar to the EU Data PrivacyDirective. Canada‟s The Personal Informationand Protection of Electronic Documents Act,(PIPEDA) legislation is particularly important toUnited State interests.

PIPEDA creates a Privacy Commissioner.Citizens may bring complaints to theCommissioner who has the power to enforcethe Act in Canadian Federal Court.

The Act requires prior consent before

disclosure and prohibits disclosure withoutconsent. A strong „opt in‟ provision, the Actclearly covers businesses based outside of Canada who collect, use, or transfer dataincluding personal information aboutindividuals within Canada.

Choice of Law



Choice of Law This is subject to the conflicting views

Proper law identified in contracts – otherwise courts may impute the law of the country that has the closest andmost real connection to the contract

Indian and UK courts recognize expresschoice of law

US courts generally honor chosen law -but choice of law and jurisdictionfurther complicated because of differentstate laws

Enforcement of Foreign



Judgments

Acquiring a judgment in one country and enforcing itin another country is subject to principles of conflict of law

Section 44A of the Indian Civil Procedure Codegoverns the enforcement of foreign judgments in

India Foreign Judgments may be enforced in India

subsequent to court proceeding – may not requireleading evidence

An Indian judgment may be enforced in other

countries subject to local laws A foreign court judgment is enforceable in the

English courts subject to certain criteria

To enforce a foreign judgment, decree or order inthe US a suit must be filed before a competent courtin the US, which will determine whether to give

Alternate Dispute Resolution



Alternate Dispute Resolution- Arbitration

India is a signatory of the New YorkConvention,

Indian Arbitration Law - The Arbitration

and Conciliation Act, 1996 Deals with the enforcement of awards of

a foreign reciprocating territory

A foreign award is enforceable if the

Indian Court is satisfied and is notsubject to any of the exceptions willpronounce judgment on it followed by adecree

S i O ti i



Strategies to Optimize

Opportunities in the Face of International Laws

Suggested Best Practices for

Working Managers and Chief Executives




Non-tangible Essentials

Honesty

Flexibility

TransparencySupported by contracts that adequatelyaddress the risks associated with the

outsourced service, be it risk of OSP‟scapabilities of customers‟ complianceneeds

Contracts




Contracts

Effective andComprehensiveContracts

Clear andunambiguouscontracts

Flexibility in Contracts

Service Level Contracts

Employee Contracts

Limitations on Liability

Confidentiality Contracts Third Party Licenses and

Service Contracts

Service LevelBreakdown

Transition and ExitProcedures

DisputeResolution

Alternate DisputeResolution

Governing Law andJurisdiction




Contracts

Aspects of BusinessContinuity

Compliance withlegal andregulatoryrequirements

pertaining to the OSPs country

Customer‟s country

HR – TrainingRequirements

Confidentiality

Choice of law(may be morethan one to govern

different aspectsof the contract




Contracts Contd.

Adopting the EU model contractualprovisions in contracts to mitigate problemswith EU Directive compliance issues

Careful and clear allocation of responsibilityof the OSP and the customer for violationsof the rights of third parties and, indeed,liability for punitive damages.

Careful consideration before grantingcustomer indemnity in the contract.

Any liability agreement should include a cap.

Some Important Issues in a




pContract

Transfer pricing and permanent establishmentissues, non-solicitation, tax matters, personnelissues, infrastructure and technology ownershipare issues that should be addressed in the

contracts. IPR ownership when joint efforts create new IPR

Disaster Management Issues – Backup orAlternate Work Locations

Retain an attorney who is familiar with the legalprovisions of the customer‟s country Customershould inform the OSP about changes in laws orcompliance requirements

Management Related BestP i




Practices

Due Diligence by both parties

Commitment of negotiating representativeand Senior Management Staff to ensuresecurity and compliance

Regular and frequent monitoring of therelationship

Ensure that knowledge of compliancepolicies percolates through all operation

levels Technical and Physical Security of

Infrastructure

Operational protection measures

- No devices to save data locally

Practices




Contd.

Dedicated Physical Security Officerappointed by the OSP

Onsite Manager appointed by the customer

Dedicated and Trained (in the requirements)Compliance Officer

OSPs should configure a complex matrix or capabilities, scale, skills,

language, management and infrastructure when makingcommitments.

Practices




Contd.

Consolidate information formanaging business performance

Improve Business Intelligence

Periodically Asses internal controls

Record Management and Provisionsto Examine Audit Trails

Monitoring, Managing andTransforming the Services

Practices




Contd.

Standard Written Internal CompanyPractices to Enhance Security withRecorded Standard Operating

Procedures Manuals Disaster Recovery Plan

Insurance to cover risks of securitybreaches and/or loss of data

Insurance to cover risk of claims arisingout of the quality, timeliness and quantityof services

Employee certified security professionals

mp oyee e a e esPractices



Employee Background Checks

Centralized Data Bank of all BPO relatedemployees, helps identify prior violators (asinitiated by NASSCOM)

Need Based Dissemination of Information -Division of process, access and/or control

Technical Limitations on Access orCommunication of different processes

Standard Written Internal Company Practices to

Enhance Security with Recorded StandardOperating Procedures Manuals




Technological Best Practices

Encryption

Installing and Using Standardized

Technical Measures

In ustry Re ate BestPractices



Establishment of an Independent Governing Body

to regulate the industry Independent Certification About Security Standards

Some Certifying Authorities

British Standards Institute (BSI) – ISO 1799 or BS 7799

Det Norske Veritas (DNV)

Standardization Testing Quality Certification (STQC-Govt. of India)

KPMG

Ernst & Young

Self-Regulation and Compliance Training OSP should inform customer about any infractions to

mitigate damage

n us ry e a e esPractices




Card Holder Information Security

Program (CISP) Payment Card Industry (PCI) Data

Security Standard, to safeguardsensitive data for all card brands -result of a collaboration betweenVisa and MasterCard - createscommon industry security

requirements – endorsed by othercard services

Industry

Industry Related Best



Monday, April 15,

2013 62

Practices

Technology Regulation andCertification

COBIT – Control Objectives forInformation and related Technology(by ISACA) – based on ITIL

ITIL – (the IT Infrastructure Library)

- Office of Government Commerce(UK) is the most widely acceptedapproach to IT service management

Industry and the Indian



Monday, April 15,

2013 63

Government

Industry should lobby with theGovernment

to create an Indian Safe HarborAgreement

To provide regulatory authority and framework like SEBI and SEBI guidelines

The amendments to the IT Act should bein sync with global laws and trends.

Conclusion



Monday, April 15,

2013 64

Factors that nurture BPOs also spawn

crimes. Elaborate, onerous, technical security

measures reduce productivity and erodeemployee motivation.

Combination of Best Practices. US Protectionist Measures likely to have

an adverse effect upon both the US andthe global economy.

Laws will have to evolve to govern therunaway proliferation of outsourcing.

Fraud and Data Violations can occuranywhere in the world.



Thank You

Poorvi Chothani, Esq.

LawQuest

36, Maker Tower „F‟

Cuffe Parade

Mumbai 400 005

E-mail – [email protected] – 00 91 22 5654 1671