| |
 |
|
Paul A. Leboffe
|
Are
you offshoring your product development or thinking about
doing so?
Today I ask Paul Leboffe, Partner with the law firm
Davis Wright
Tremaine LLP, to address important intellectual property
issues arising when products are developed offshore.
Anthony: First, would you
clarify the distinction between Outsourcing and Offshoring?
Paul: While these two terms
are sometimes used interchangeably, “outsourcing” typically
refers to sending projects to a company in a foreign
country. For example, XYZ, an enterprise software company,
might contract with a company in India to develop an
application for one of its software programs. In contrast,
“offshoring” typically refers to opening a branch office in
a foreign country and hiring your own employees there.
Microsoft, Dell and a host of other large technology
companies have done a significant amount of offshoring, but
so have small, emerging growth companies. Depending on the
size of the project, and a company’s growth strategy,
offshoring can be a great strategic alternative for small
companies.
For the balance of my comments, I will generally be
talking about outsourcing, but most of the legal issues
relevant to outsourcing also apply to offshoring. In either
case, it is very important to talk with professionals who
have been through the process before.
Anthony: What are the main
legal concerns with outsourcing?
Paul: There is a range of
legal issues that arise with outsourcing, and you should
consult with an attorney who has worked with clients engaged
in outsourcing as part of your analysis in determining
whether outsourcing is right for your company. If I had to
briefly summarize some key legal issues related to
outsourcing, I would focus on what I call the “Three P’s” –
Privacy, Piracy and Property. I can explain each of these
briefly:
Privacy rights generally refer to an individual’s
right to control the distribution of his or her personal
information. Privacy has long been an important issue in the
US, but it has become even more important with the use of
the Internet and the ability to access and transfer personal
data. Consequently, the US has adopted more stringent
legislation to protect individual privacy. For example, the
Health Insurance Portability and Accountability Act (HIPAA)
requires special treatment of patient medical records. This
includes the treatment of payment and process information –
something that has been outsourced in recent years.
Insofar as privacy is important in the US, it is even
more important in Europe, and European laws are therefore
more restrictive than those in the US. The European Union
Data Protection Act of 1998 is the best example of such a
law, and it has caused some companies to incur substantial
time and expense with compliance. Accordingly, if you are
going to outsource or offshore to Europe, you will want to
be very familiar with local laws.
In contrast, privacy rights in Asia – where there is no
personal “expectation of privacy” – have historically been
more relaxed than those in the US and Europe. But that does
not mean that you can run roughshod over the rights of
individuals in those countries, especially if the
information processing that you are outsourcing will include
data of US or European citizens.
While privacy is an important individual issue, piracy
is an important company issue. Piracy refers to the
misappropriation (unauthorized use) of proprietary products,
such as software. To be certain, piracy is an issue all over
the world. Anyone who followed the Napster case and the
resulting fallout can see that. Some countries, however,
have been more successful than others in limiting piracy
within their borders. Obviously, a company cannot stop
piracy, but, if piracy is an important consideration, a
company can elect to outsource to countries where laws
against piracy are more strictly enforced.
This brings us to the issue of property, meaning
“intellectual property” that is the lifeblood of any
technology company. The US and Europe have well-developed
laws regarding patents, trademarks and copyrights, and
almost all of the European countries are members of key
treaties, such as the Berne Convention and the Madrid
Protocol, which help to standardize the level of protection
afforded to copyrights and trademarks.
In contrast to the laws in the US and Europe, the
enforcement of laws protecting copyrights and trademarks in
Asian countries, on the other hand, is relatively new and
continues to develop. Accordingly, a substantial amount of
commercial software developed in these countries remains
subject to piracy. It was estimated that in 2003, more than
90% of all commercial software was subject to piracy in
certain regions. Some companies consider this a big problem,
whereas other companies believe that there is no local
“resale” market for software in those regions, so they do
not believe that the threat of piracy is a decisive issue.
Regardless of whether you are outsourcing to a company in
Europe, Asia or elsewhere, it is important to know the local
laws as well as local customs – meaning whether the laws
are, as a practical matter, enforceable. Even if there are
laws on the books, they are of little value to you if they
are either unenforceable, there is no “implementing
legislation” in the local country, or it will take years and
years to seek justice. These might be key factors in your
decision whether or not to outsource certain projects.
Anthony: Are there certain
types of activities that are safe to outsource, and why?
Paul: As a company decides
whether or not to outsource, it should also consider which
projects it can outsource, and which projects it should
complete itself. Conventional wisdom dictates that any
mission critical projects, core technology or key
programming should be done internally rather than be
outsourced. Due to the variable enforceability of foreign
laws, and the cost of enforcement, startup and emerging
growth companies should consider outsourcing only non-core
technologies, such as customer support, network monitoring,
and application software maintenance. Once a company grows
to the point where it can bear the costs of litigation, then
it might consider offshoring critical technologies. But
until that point in a company’s development, it generally
remains risky.
Anthony: How does the US
legal landscape affect outsourcing?
Paul: Outsourcing and
offshoring have not been warmly embraced by much of the US
for fear of losing American jobs to foreign countries. When
most Americans think of outsourcing and offshoring, they
think of the American automobile industry and how thousands
of US jobs have been sent overseas. Additionally, technology
workers are concerned about skilled technology jobs being
lost to foreign countries.
Whether these fears are based in fact or fiction, they
are fueling a substantial amount of legislation designed to
keep more jobs in the US. As of mid-2004, there were more
than 180 proposed pieces of legislation at the state level,
and more than a dozen pieces of federal legislation targeted
at limiting American companies’ ability to send work to – or
open offices in – foreign countries. Most of this
legislation will not find its way into law, but companies
considering outsourcing must be aware of such legislation
and its effect on their business. Once again, this is a good
reason to include an attorney in your planning process as
you evaluate offshoring opportunities.
Anthony: Can you describe
scenarios leading to the loss of Intellectual Property
and/or Trade Secret information?
Paul: The piracy of
intellectual property, which was discussed above, is
typically an external threat: someone outside of your
company misappropriates your technology without paying you
for it. But companies considering whether to outsource
projects must be sensitive to internal threats as well.
Historically, these threats have taken the form of
disclosure by former employees or extortion by the
outsourcing company’s employees. Recently, an Ohio company
outsourced the processing of medical records information to
a company overseas. Two disgruntled employees from the
outsourcing company threatened to release the records on the
Internet unless they were paid a sum of money. This type of
extortion puts a company in a real bind because the company
can not only lose key intellectual property, but it can, in
the case of medical records, be subject to civil and
criminal penalties.
Anthony: Can you highlight
some of the most important intellectual property issues in
the context of outsourcing?
Paul: There are too many
issues to cover here, and so I must recommend that a company
seek the assistance of US counsel that can work with local
counsel in the foreign jurisdiction where the company is
considering outsourcing. That said, it is clearly important
to include an attorney early in the process because there
are some key differences between US and foreign laws that
might affect a company’s ability to protect its intellectual
property. Take patent law as an example. The US follows the
“First to Invent” rule, whereby you can show patentable
information in public but you still have one year after
exposing such information before you must file your patent.
Europe, on the other hand, generally follows the “First to
File Rule,” which means that the first person to file the
patent owns the patent rights. That means that, once you
expose your patentable information, then anyone can patent
it if they file before you. While some countries have
exceptions for inadvertent disclosure, they remain the
exception rather than the rule. What is an example of the
practical import of this? You might want to think twice
about flying to Europe to show your patentable intellectual
property to a venture capital firm there.
Anthony: Would you share
some of your favorite legal pointers for outsourcing?
Paul: If I only had one minute
with CEOs to give them some key guidelines to consider in
making their outsourcing decisions, I would share the
following pointers:
- Get an attorney involved in the process early.
- Do not outsource mission critical projects.
- Be particularly careful with personal information,
medical information and information regarding security
(e.g., encryption software), as these are all strictly
protected by US laws.
- Structure your contracts with outsourcing companies to
shift as much liability to them as possible for breach of
privacy, security and other laws.
- Consider the maturity and the sophistication of the
outsourcing country’s legal system.
- Ensure that the outsourcing company’s employees are
subject to a Confidentiality Agreement and a Non-Compete
Agreement to the extent permitted by law.
- Conduct detailed background checks of the outsourcing
company – and its employees – to the fullest extent
possible (there are typically local companies that will do
this for you).
Bio
Paul Leboffe is a Partner in the San Francisco Office of
the law firm
Davis Wright Tremaine LLP.
Representative Experience
Strategic advisor and outside general counsel to emerging
growth technology companies.
Corporate and finance law, including federal and state
securities, intellectual property licensing, mergers and
acquisitions, and general business transactions for
technology companies.
Strategic advice regarding business plan development and
seeking of venture capital and angel funding.
Intellectual property licensing and protection, primarily
for companies in the following sectors: computer software
and/or hardware, electronic design automation, and eCommerce/Internet.
Strategic advice regarding capital structure, stock
issuance – including stock option plans – and private equity
financings, including convertible securities and secured
transactions.
Corporate mergers and acquisitions, including stock and
asset transactions and recapitalizations.
Formation of various entities, including Limited
Partnerships, Limited Liability Companies, S Corporations
and C Corporations for technology companies and investors.
Other commercial agreements, such as non-disclosure
agreements, independent contractor agreements, separation
and release agreements, and commercial leases.
Prior Experience
Partner, White & Lee LLP, a Silicon Valley boutique serving
technology clients
Executive Vice President & General Counsel, Sports
Universe, Inc., an eCommerce company
Associate, Sonnenschein Nath & Rosenthal
Publications and Presentations
Speaker at seminars on venture capital transactions,
corporate governance, business acquisitions and intellectual
property issues.
Memberships and Activities
California State Bar Association
MIT/Stanford Venture Lab Member
Software Development Forum Member (former Executive
Council Member)
Education
J.D., Syracuse University College of Law
Visiting Scholar, Hastings College of the Law
B.S., Cornell University
|