Outsourcing and data laws

[benlavic]

Hello,
I was wondering whether anyone could help me on a couple of questions about data protection laws, freedom of inforamation stuff. When firms outsources their work to firms outside the remit of these laws do the outsourced firms have to work to the local laws or to the place where the firm is based? The reason I ask is that have been general discussion at my firm whether this is a route we should look at, and I like to know if thsi will be a stumbling block or not.

Thanks

 

[kodr]

I believe you'd be best served by observing the laws at both locations.

I have seen people get in some very serious trouble by trying to ignore an inconvienant law.

Also, image the damage to your firm if it got out that you didn't follow your home countries consumer and ID protection, becouse it was more economical to apply country X's laws or policies.

Of course, I'm not a lawyer, so don't take my advice.

 

[dgillz]

The Freedom of Information Act here in the US was all about getting information from the Government. You are not generally entitled to get information on business dealings between 2 private parties.

In terms of which laws apply, I would imagine some do and some don't. For example minimum wage would not apply. However as the previous post stated, this is a question for a lawyer.

Software Sales, Training, Implementation and Support for Macola, eSynergy, and Crystal Reports

http://www.gainfocus.biz

 

[monkeylizard]

Not a lawyer, but most contracts I've ever seen, read, and/or signed all specifically state which jurisdiction will govern the contract. I know this typically applies to contractual law, but may also apply to other laws. I don't know.

(In U.S.) If there is a Federal law, you have to meet at least that level. HIPPA regulations for example govern the security and privacy of patient health care information, regardless of state boundaries.

Crossing international borders (IMHO).
If Company A has a project and outsources the project to company I (which is off-shore), then I would think it is Company A's responsibility to insure that Company I protects the data sent to company I by Company A at least as well as Company A does.

Monkeylizard
Sometimes just a few hours of trial and error debugging can save minutes of reading manuals.

 

[Corran007]

It depends. I would look into the details of what ever country you are looking at. I remember reading a couple articles on companys that got burned by outsourcing overseas to place where the laws were a great deal less stringent. And make sure you are really sure about it. Most companys are finding they are not getting quite what they had hoped. There has been some good research on what specific areas that overseas sourcing can benefit, which it can. If you are going to, i would recomned hiring a consulant who has done this before to help you get started. Mananaging overseas outsouricng is a bit different.

 

[lgarner]

I agree. Generally you are on the hook for meeting your data proteciton requirements. Due diligence on your part involves investigating the company that you'll be dealing with and ensuring that they treat data at least as securely as you do.

 

[benlavic]

Thanks for the replies, I'd thought we'd have to ensure that any outshoring was to the same level as our data protection level, but a collegue suggested otherwise. I hope that the need to do due diligence on this matter might make the idea not as attractive as I didn't fancy having to run audits for data protection in two different locations.

 

[eyeswideclosed]

We have discontinued outsourcing for a variety of reasons, this being one of the most important, and our short-term "savings" turned out to be long-term losses and delays, it was a dumb idea that we will not repeat.