Behind the Scenes | January 2020

Behind the scenes

Content 2 Intro 3

Meet the team

5

Meet the team | New additions

7

Meet the team | Secondment

9

Game changers

11

IT trends

15

Not-to-miss events

Please direct any questions regarding the content of this practice update to:

1

Ole Horsfeldt

Tue Goldschmieding

Pia Mondrup Pedersen

Partner

Partner

Senior Outsourcing and IT Counsel

D +45 33 41 43 65 M +45 24 28 68 40 oho@gorrissenfederspiel.com

D +45 33 41 42 03 M +45 24 28 68 75 tgg@gorrissenfederspiel.com

D +45 33 41 43 67 M +45 27 80 40 03 pmp@gorrissenfederspiel.com

Intro

Happy New Year!

Dear clients and friends, 2019 was a record year for our firm and for our Digital Business practice group.

Revenues increased by more than 11%, Digital Business lawyers now number 18, and deal volume in terms of the number of transactions is up. A couple of years ago we thought outsourcing, as we know it, was dying. But yet we see clients embracing cloud services, digital transformation, and BPO outsourcing as never before. Cloud service agreements supported by our in team in 2019 exceeded 50 transactions and on this basis we are developing a standardised approach to advising on the commercial, legal, and regulatory approach to processing and assisting clients with cloud services. We call this approach our “cloud factory”.

Business growth is important, but even more so is attracting and developing talent, establishing career paths, and maintaining a fun and stimulating working environment (and while also maintaining a sound work/life balance). We have just added two new junior resources, Sibel and Anton – read about who they are in this issue of Behind the Scenes – and our senior attorney Mikkel Øskov Jensen is currently in his last months of a 7 months long secondment to Slaughter and May’s IT team in London. Mikkel’s story from London is also in this issue.

We are looking forward to 2020, where the now 1 year old EBA outsourcing guidelines will fully come into play, where we will introduce AI based due diligence tools and automated document assembly tools in Gorrissen Federspiel, and where digitization and reengineering of legal services will reach new heights – exciting times, if you like change!

Best wishes, Ole Horsfeldt

2

3

Meet the team | Digital Business As with business itself, our team is constantly changing.

This is due to the fact that at Gorrissen Federspiel, we value the experiences gained by working in different departments and with different tasks. Thus, our assistant attorneys rotate to other department halfway through their training.

This is how our team looks right now. It is a mix of partners, senior legal counsels, attorneys and assistant attorneys. (Christian Aaby Larsen and Mikkel Ă˜skov Jensen were not present for the photo).

4

5

Meet the team | New additions

Sibel Savas I began working at Gorrissen Federspiel in 2016 and joined the Digital Business team in 2018 during my final year in law school. In my opinion, working with IT law and outsourcing offers a great balance between contract drafting and applying commercial knowledge. Additionally, technology and digitization are areas in constant growth. I find it particularly interesting as I appreciate staying updated and learning about new technologies.

The desire to continuously improve and develop myself both professionally and personally is something that started long before joining Gorrissen Federspiel.

Prior to my studies I was a skilled equestrian and competed in international competitions. This took me to places ranging all the way from Aachen in Germany to Ontario in Canada where I excelled. Consequently, I was fortunate enough to be the first Danish youth rider in my field to receive merits in the professionals’ league. Although my skills are not what they used to be I enjoy occasionally getting back in the saddle.

My time as an equestrian meant I gained an international outlook from a young age.

Combined with my desire to improve academically and on a on a personal level I decided to enroll in a LL.M. programme in International Financial Law at King’s College London, where I graduated with distinction in 2018.

During my time at King’s College London I pursued my interest in the legal issues surrounding new technologies and the digital area. I especially found the legal perspective of cyber security interesting and as a result wrote my dissertation on cyber security as a boardroom issue. I also met some wonderful people from all around the world, many of whom I now consider friends. Besides the obvious advantages of having friends in Tokyo, Paris and USA, it also contributes to a valuable network in the legal profession.

Anton Birnbacher Prior to joining Gorrissen Federspiel, I was a student in the legal department of Maersk.

The commercial aspect of law and combining the right legal solution with a pragmatic business mindset is the main motivation and driver in my work. In addition, the international aspect is something I find truly exiting.

IT has always been fascinating to me. I was born in the early 90’s and consequently I have experienced the way our society has been transformed by it.

The constant change and innovation is what makes IT both exciting as well as highly complex – which is why I work with digital matters.

Besides the obvious interest in IT and law, I am a profound football fan. Before deciding to go to law school, I was a relatively talented football player, and did reach the second division in Denmark at my peak.

However I strongly believe I made the right decision in pursuing a career within law instead of football.

Playing football taught me some key values that I always try to bring to the table in my work. Besides collaboration and the importance of a well-functioning team in order to perform, the constant need for development and dedication to stay relevant is something I find fit really well in an ever changing and ever challenging digital landscape.

Besides football, I enjoy travelling. Visiting as much of the world as possible and enjoying the cultural differences is something I truly value. That said most of my spare time and money is currently invested in my upcoming wedding.

6

7

Meet the team | Secondment

International perspective Mikkel Øskov Jensen, Slaughter and May, City of London. Just one month earlier, I was sitting in my office at Gorrissen Federspiel, Copenhagen. Now my daily life takes place as a visiting lawyer at Slaughter and May.

scale – everything just seems bigger in London.

Life in London opens a wealth of opportunities and there is never a dull moment. The city is vibrant and offers a variety of activities, whether you want to hang out with the hipsters in Hackney, the up-and-comings in Islington and Angel, dine amongst the beautiful buildings in Marylebone or Mayfair or grab a beer with the celebrities in South Kensington or Chelsea. There is an abundance of museums, exquisite restaurants, charming pubs and exciting cocktail bars.

Slaughter and May is a well renowned English law firm and it is consideI have learned a lot from Slaughter red one of the five ”magic The take-away from this circle firms”. Gorrissen and May’s skilled partners, who whole experience? Well Federspiel has over the – it is not over yet, but I have been actively engaging with years built up a strong relahave already expanded tionship with Slaughter and me on the different matters. my professional horizon.

May’s IP/IT department I have learned a lot from and as a visiting lawyer, I Slaughter and May’s skilled partners, who have been actitake part in the daily work on the same terms as the rest vely engaging with me on the different matters. We have of the team. had in-depth discussions on the legal issues, they have Work in the IP/IT department is carried out in an inforshown me how to best pin down the important aspects of mal tone and the partners put great effort into instructing a transaction as well as talked me through the strategy the associates on the best way to approach the different they would suggest to apply. I have also strengthened my matters. The matters are broadly the same as what I am network in London both professionally and personally used to from Denmark, i.e. outsourcing, procurement of and, as is properly always the case when you venture out IT solutions, M&A assistance and strategic advice, howeand get a new broaderbroader perspective. ver, one thing is significantly different: it is on a different

”

8

Game changers

Digital trans Almost all companies are currently embarking on or have already begun a digital transformation journey that is fundamentally changing the business or important aspects of the business using new technologies such as artificial intelligence, robots, Big Data or Internet of Things (IoT).

In recognition of that fact, we have developed a Digital Transformation Legal Assessment advisory concept, which enable companies to quickly assess, predict, prevent and manage the many legal issues that invariably arise as part of a digital transformation and digital projects.

By establishing an overview of the 4 Ds (Digital Objectives, Digital Assets, Digital Means and Digital Relations) of a digital project or programme, we can provide a holistic analysis that covers the entire legal landscape of the company’s digital business and identifies those relations that determine how changes to the digital business affect other areas of the company. Accordingly, the Digital Transformation Legal Assessment includes more than a traditional legal risk assessment. It also helps to uncover new commercial opportunities through better utilization of the company's digital assets, such as customer data and intellectual property rights.

9

The Digital Transformation Legal Assessment can be applied on a single digital project (e.g. the development of an app) or an entire digital transformation program.

Any digital transformation project can be a daunting task for a company, and our experiences with the Digital Transformation Legal Assessment have been shaped by this insight.

Therefore, we have so far carried out Digital Transformation Legal Assessments in small steps in connection with concrete and specific projects rather than grand transformations of the entire company, and we believe, that for a number of companies, this is how a lot of the digital transformation is and will be carried out. Through the results with specific cases we still believe that there is an inherent value in carrying out Digital Transformation Legal Assessment for a large scale Digital Transformation. We are currently working towards realizing this aim.

We have started a network on Digital Transformation where we are keeping clients updated on specific topics and allowing for knowledge sharing. Please feel free to reach out to us, if you are not currently on the mailing list.

nsformation

Digital

Our methodology builds on the 4 Ds:

Objectives

Assets

Means

Relations

The business objectives pursued by the digital transformation

The assets that the company will utilize to achieve its digital objectives

The �tools� to activate the assets and achieve the objectives

The dependencies and relations between the 4 Ds

10

IT trends

Research project

Cybersecurity: Regulation and governance A significant amount of legislation has been enacted in later years by the EU and nationally in response to the threat posed to public and private institutions. Besides legislation there is a vast area of standards and soft law sources which set out further rules and obligations to consider, carry out and enact.

Accordingly, cybersecurity regulation is already complex and extensive. For society at large there is a considerable need for easy access to knowledge on the regulation in question in order to be compliant and thus build up a strong national cybersecurity defence. Such level of knowledge is a cornerstone to ensure adequate understanding, not only of the applicable safety obligations, but also of which authority is responsible and what are the formal procedures and practical measures that must be observed.

11

At Gorrissen Federspiel we wish to address this challenge, and together with Copenhagen Business School we will carry out a research project where we collect and systemize the relevant legislation and develop a model with corresponding tools for conveying the knowledge, including by way of legaltech tools. We have provided two attorneys from our teams (Søren Sandfeld Jakobsen and Mathias Mølsted) with time to dive into a research project. Søren is, besides being attorney at Gorrissen Federspiel, a professor at Copenhagen Business School.

Through our efforts in legal and commercial research, we hope to bring Gorrissen Federspiel into a league of its own in this crucial and vastly growing area of the law, which impacts almost every modern business.

Research project ▪ The research project lead is Søren Sandfeld Jakobsen, PhD, attorney in his capacity as professor at Copenhagen Business School.

▪ Funding by Centre for Cyber Security for attorney Mathias Mølsted.

Mapping of legislation and requirements for regulatory compliance

▪ Gorrissen Federspiel achieves in-house knowledge on legal, technical and commercial aspects of cybersecurity in a league of its own.

Assessing technical abilities and threats in light of current legislation

Develop model for conveying knowledge

Research on cybersecurity (GF and CBS)

Mapping need for training and knowledge in private companies

12

13

IT trends

GDPR Trends – Companies now focus on audit The GDPR has now been in force for almost a year and a half and most companies are now getting ready to implement control mechanisms to audit the GDPR compliance programs implemented during the last years.

The majority of issues identified during the implementation of the GDPR compliance programs have now been solved and focus has shifted from “what do we need to do to be compliant” to “what do we need to do to stay compliant”. Therefore, many companies have now started to focus on how to control compliance and document that the initiatives, which the company has invested in to ensure GDPR compliance, actually work.

There are lot of different ways to manage auditing internal compliance.

Our advice is to build a control framework one department at a time starting with the high-risk departments, such as HR and IT. The control framework must ensure that the departments are producing the necessary documentation to document GDPR compliance, e.g.:

In addition to all the paperwork (i.e. the documentation constituting the control framework), the companies are also focusing on making internal audits to see if the employees actually know how to work with the GDPR and assess if further awareness initiatives are required.

What we have found during the internal audits that we have assisted in is that the employees are aware of how the GDPR affects their work tasks, but they may not be aware of the more general principles of compliance. We have therefore also identified a need to repeat general GDPR awareness training.

To assist our clients with this next step of compliance, we have developed an audit framework ensuring responsibility and accountability in the organisation for ensuring audits are conducted, both internally and in respect of audit of suppliers. We are implementing this framework in very different organisations and we take a pride in making it fit our clients’ organisational needs to ensure the clients have an efficient GDPR audit framework.

(i) that risk assessments are made for all new IT systems and suppliers, and (ii) deletion is not only performed but is also logged and that the department has a documented procedure for auditing the deletion log.

14

15

Not-to-miss events Please see our upcoming events listed below. We strongly believe that knowledge is power and that sharing is caring – so come and join us to charge your information batteries and meet other sharp minds within digital business.

6 February 2020 | 13.00 - 16.00 Seminar on Mitigation of Tech risks in M&A deals 12 March 2020 | 14.00 - 16.00 Dataprotection in outsourcing agreements 26 March 2020 | 14.00 - 16.00 Tax in outsourcing 2 April 2020 and 11 June 2020 | 8.30-10.30 GDPR Breakfast Club 30 April 2020 | 14.00 - 16.00 Data ownership, regulation and contractual considerations

For more information about any of the events and/or to register, please send an email to mkb@gorrissenfederspiel.com.

16

Axeltorv 2 1609 Copenhagen V Denmark T +45 33 41 41 41 Silkeborgvej 2 8000 Aarhus C Denmark T +45 86 20 75 00 gorrissenfederspiel.com