The legal ABCs of outsourcing

Computerworld - When a Saudi Arabian company outsources the management of its software to a U.S. application service provider (ASP), whose laws apply if the servers go down and critical information is lost?
Uptime, or the time that information technology software and equipment is up and running, isn't the only consideration for companies that seek to outsource any part of their IT backbone.
Attorney Scott Nathan, a partner at the Boston-based law firm Gadsby & Hannah LLP, said the legal considerations when hiring an ASP are more than making a service-level agreement (SLA) that guarantees 99.9% uptime. Where disputes are to be resolved, which laws apply and disaster recovery are all important elements of a binding agreement.
Nathan, speaking at the Websourcing 2000 conference in Boston last week, laid out the basics for companies that need to protect their data when someone else is in control of it.
One common problem, he said, is that service-level agreements are often just revamped versions of marketing material, with vague and sometimes inflated promises. Companies need to consider carefully what they expect of their ASPs and work that into a contract, keeping in mind that there is no one standard legal format for setting up such an agreement.
Another important but often unforeseen legal problem is which jurisdiction applies when there is a problem. Nathan gave the example of a company that publishes content defaming a competitor on its site. If the competitor downloads the information in Idaho, local law may apply, even if the servers are in Virginia and the company responsible for the content is based in New York.
"Boise in winter is not fun," he quipped, and being deposed in Boise in winter is even less pleasant.
Insuring data is a critical and often overlooked aspect as well, Nathan said. Some states consider data a tangible asset, and therefore a company can sue to recover damages. Some states, however, don't consider data a tangible asset, and companies need to protect themselves.
Few insurance companies offer insurance for data loss, but they are out there, Nathan said.
Related stories:

• ASPs, intellectual property group to set service dispute guidelines, May 3, 2000


• Definition for ASPs emerging, April 24, 2000


• ASP market to soar, study says, Aug. 9, 2000