© Copyright Acquisition International 2025 - All Rights Reserved.

Article Image - Spiders in the Web: The Risks of Online Crime to Businesses
Posted 2nd June 2016

Spiders in the Web: The Risks of Online Crime to Businesses

Running a business means taking risks. The biggest risk an entrepreneur can take is not to think about risks at all.

Mouse Scroll AnimationScroll to keep reading

Let us help promote your business to a wider following.

Spiders in the Web: The Risks of Online Crime to Businesses
Image

Spiders in the Web: The Risks of Online Crime to Businesses

Running a business means taking risks. The biggest risk an entrepreneur can take is not to think about risks at all. It is therefore wise to identify the risks that (the board of) a company is exposed to in order to control them where possible: risk management. This article will focus on one particular type of risk, digital risk.

Firms’ IT systems can be breached both from the inside and from the outside. For example, breaches can come from a network attack (hacking, distributed denial of service, DDoS), viruses (Trojan horse, time bombs, worms), cybercrime, human error, a failure of the IT provider or power failure. The consequences for an enterprise can be serious – inaccessibility of the network, loss or theft of (part of) the computer system, data destruction, data manipulation, leaking of confidential information or personal data and related privacy issues. What are the legal options to manage these consequences and to ensure the continuity, security and privacy of the network and information systems of the company?

Contracts and liability

Regarding digital risks, most business owners will immediately think of the security of the software and the quality of the hardware. However, you can limit digital risks and manage any potential negative effects in advance by means of good information and communications technology (ICT) contracts.

Entering a contract

For the different digital services (such as maintenance and operation of the network system, data processing and data storage) the company will conclude contracts with different ICT suppliers (providers, cloud servers, big software providers, such as Microsoft, Apple and Google). These contracts are often standardized. However, an enterprise does not have to accept such standard contracts unreservedly and it is advisable to negotiate the contents of such contracts. The contract has to provide clarity for both parties on several basic things: Who is responsible for what? Who has the power to do what? And what are the rights and duties of the parties involved in the service chain? Here, it is vital to observe the liability for claims of clients or third parties.

Besides negotiating the agreement, the use of your own General Terms & Conditions is highly advisable. Make sure that the General Terms are declared applicable correctly. If this turns out to be difficult, try to explicitly exclude specific provisions of your counterparty’s General Terms in the agreement, as they often contain far-reaching exemption clauses. Also, check whether the General Terms of the provider contain a unilateral changes clause and make sure that the General Terms can only be changed with your permission or include in any case a notification obligation on the part of the provider in the event of a change in service. Finally, it is important to make clear arrangements in a choice of law and choice of forum clause with regard to the applicable law and the competent court.

During the contract: Service level agreement and security

The performance of the contract can be implemented via a service level agreement (SLA), which is rather common practice in ICT. An SLA includes, among other things, agreements on the level of quality and availability of the services (technical and functional specifications).

An important risk which has to be considered in the SLA is the security of the ICT systems and the data of the enterprise, especially if work is performed in different locations or in the cloud. Therefore, make agreements on the improvement of the network protection not just by firewalls but also by means of encrypting and masking data. Authentication systems can provide the enterprise with extra protection against undesirable external factors, for instance, by the use of login codes, (changing) passwords and digital certificates. Also, define who will be responsible in the event of security breaches and thus for the damage of the enterprise, clients or third parties.

In addition, it is advisable to include a notification obligation on the part of the provider in the event of security breaches and other data leaks. You can also include in the agreement a back-up obligation on the part of the ICT provider, so that there will be an alternative besides your own back-ups.

An enterprise should of course also ensure the data privacy of clients and third parties in the network and information systems. The entrepreneur is responsible for correct storage and processing of personal data. Therefore, it is important to include in the agreement with the ICT provider who is or will remain the owner of the data, who has access to the data and/ or is allowed to use it. A (mutual) confidentiality clause and a penalty clause can be included in the agreement and serve as a means for the compliance with these agreements. A prohibition to transfer personal data to third parties may also be necessary.

After the termination of the agreement

To ensure the continuity of the enterprise, clear agreements must be made regarding the termination of the agreement and what will happen with the data and systems in the event of bankruptcy or the takeover of a supplier. Thus, for instance, make sure to avoid a “vendor lock-in”, by which the enterprise is not able to switch to another supplier because the data cannot be transferred (easily) to the new provider. Conversely, it is also important to determine what will happen to the data and systems if the enterprise does not comply with agreements, has outstanding bills, goes bankrupt or is otherwise in default. The enterprise is well-advised to include an obligation on the part of the provider to return the data in the event of the termination of the agreement.

International regulations

Obviously, all agreements must be in accordance with national and international laws and regulations. This may be rather complex if the enterprise contracts with foreign parties or the data will be stored on a (cloud) provider’s system, which is physically located abroad. The enterprise is thus well-advised to investigate who the contracting partners in the service chain are and where the data will be physically stored. By including investigative or monitoring powers, the enterprise can investigate whether the supplier complies with the applicable legislations so that the enterprise can also comply with its legal obligations.

Besides, the nationality of the persons whose data are digitally processed is relevant. For example, on grounds of the current European Data Protection Regulations, businesses from non-EU Member States have to provide an “adequate level of protection” for the storage and processing of personal data of EU inhabitants. A Thai business processing data of Italian customers in the US is also subject to this Regulation, even though there is no physical relationship with Europe. In this case there is a problem because due to the so-called “USA Freedom Act” (formerly, Patriot Act), the United States does not comply with the European regulations. Until recently, transfer of personal data was permitted if an American company committed itself to comply with the “Safe Harbor Privacy Principles”. On October 6, 2015, the European Court of Justice decided however, that the United States (American ICT service providers) could not provide an adequate level of protection for personal data. Currently, the European Union and the United States are working on finding a solution for this.

Meanwhile, for the protection of the privacy of EU-citizens, the European Parliament has drawn up a General Data Protection Regulation containing stricter rules and higher fines. It is expected to become effective in 2017.

Conclusion

Entrepreneurs do almost everything digitally, but the risks of digital business operations are often not fully taken into account. With this article, we have tried to create greater awareness of digital risks and offer suggestions to manage them. Your outside corporate counsel, who knows your business like no other person, will be able to provide advice so that you will be aware of potential risks and be able to cover them legally, if desired. Then you, as entrepreneur, will be able to confidently use all the opportunities provided by the digital work environment.

Company: Russell Advocaten
Name: Reinier W.L. Russell,
LL.M.
Email: [email protected]
Web: www.russell.nl
Address: Reimersbeek 2
1082 AG, Amsterdam /
P.O. Box 87400
1080 JK Amsterdam
Phone: +31 20 301 55 55

Categories: Legal, Strategy


You Might Also Like
Read Full PostRead - Eye Icon
Global Oil Price Fall Set to Impact on US Auto Industry
Finance
11/02/2015Global Oil Price Fall Set to Impact on US Auto Industry

Low oil prices will contribute to upside potential for the U.S. automotive market in the near term, according to a recent report from IHS Automotive, part of IHS, Inc

Read Full PostRead - Eye Icon
Navigating Dutch Business Culture: Advice for Expanding Your Business Operations to the Netherlands
Corporate Social Responsibility
23/05/2023Navigating Dutch Business Culture: Advice for Expanding Your Business Operations to the Netherlands

Around 400 companies each year set up their Business in the Netherlands, coming from Europe, North and South America, and Asia - and continues to be a place of choice for business expansion.

Read Full PostRead - Eye Icon
Team Sport Acquisition of Pole Position Indoor Karting
Finance
Read Full PostRead - Eye Icon
SASE – The Security Fabric of The Future
News
05/02/2024SASE – The Security Fabric of The Future

The rise of cloud computing, the pervasiveness of mobile devices, and the widespread adoption of remote work have rendered traditional network security architectures obsolete and ineffective. To address these evolving threats and safeguard their valuable asset

Read Full PostRead - Eye Icon
Risk Management and Organisational Effectiveness
Leadership
05/01/2022Risk Management and Organisational Effectiveness

Magnifor Consulting is an innovative risk leadership consultancy firm working shoulder-to-shoulder with its clients to maximise the value of uncertainties.

Read Full PostRead - Eye Icon
Things To Consider When Choosing Legitimate Money Lenders
Finance
15/10/2020Things To Consider When Choosing Legitimate Money Lenders

Fintech ventures have changed the borrowing system, making it more accessible and reliable. This revolution has made private money lenders pose a constant threat to traditional banks. However, the current economic climate and popularity of this business have m

Read Full PostRead - Eye Icon
AEREON Acquires Abutec
M&A
13/06/2016AEREON Acquires Abutec

AEREON today announced the acquisition of select assets of Abutec including the Abutec brand.

Read Full PostRead - Eye Icon
An Inside Look at AI’s Most  Outstanding Strategic  Communications Team
Strategy
26/06/2017An Inside Look at AI’s Most Outstanding Strategic Communications Team

As the head of strategic communications firm Sharon Merrill Associates, Maureen Wolff has received more than her share of 3 a.m. phone calls from anxious CEOs and board members. And she remembers every one of them. The arson at a document storage facility.

Read Full PostRead - Eye Icon
Tax Becomes the Talk of the Town
Finance
28/05/2015Tax Becomes the Talk of the Town

Survey for 10th Annual Domestic Tax Conference C-suite, boards, investors, media and legislators all interested in tax.



Our Trusted Brands

Acquisition International is a flagship brand of AI Global Media. AI Global Media is a B2B enterprise and are committed to creating engaging content allowing businesses to market their services to a larger global audience. We have 14 unique brands, each of which serves a specific industry or region. Each brand covers the latest news in its sector and publishes a digital magazine and newsletter which is read by a global audience.

Arrow