Protecting your data: pieces of advice from top business law firm
Setting up a company is a demanding task. From making sure your idea will work to the bureaucracy that unfolds before your eyes, it’s hard to make sure you have taken every legal step when it comes to the protection of your data, content and many others. This is why we asked our partners, Laurentiu, Laurentiu and Associates a few things about protecting your business.
Before we dive into the questions and answers, we would like to mention a few things about our partners. Laurentiu, Laurentiu and Associates is a full service business law firm, established in 2007, is a trusted partner of a significant number of prestigious national and multinational companies based in Transylvania and not only.
On the first day of Techsylvania 2017, Alexandra Cohuțiu, Managing Associate at LLA, started our series of hands on workshops with a very interesting subject, talking about “legal challenges for start-ups. From setting up the relationship with the investors to data protection”.
Today we share with you an interview with Alin Mihai Laurentiu, Managing Partner of LLA who has taken the time to answer our questions from his vast experience in the legal domain.
1. What legal steps should an IT company take in order to protect the IP and content of their early stage website?
Every business generates some type of IP, although not every business recognizes its IP or captures its value. The IP created by early-stage companies, especially those seeking venture capital funding, can often form the company’s most valuable asset. The Romanian law, like other jurisdictions, provides several legal mechanisms for protecting IP rights.
Thus, first of all, the Romanian law protects the IP rights of the creator of a computer program, if this computer program fulfills some specific conditions prescribed by the law. This prevents copying of the company’s computer programs, which fall in the definition provided by the law. However, the Romanian law on copyright does not protect the idea or the concept, before it is materialized in an actual computer program. Thus, until the idea or the concept is materialized in a computer program, other legal mechanisms can be used to protect it, such as NDAs concluded with the individuals who have access to the idea or the concept.
Furthermore, trademark rights protect the company’s brand, such as logos and trade names or any other brand identifiers which ensure the recognition of the company in the minds of its clients.
Once the IP of a company is identified, the company must ensure that it owns the IP rights. Very often the founders and early collaborators create content which generates IP rights before the company is actually incorporated and, in this cases, the IP rights are owned by the individuals, who created it, not by the company. Therefore, an early-stage company should make sure that there is a written agreement according to which all the IP rights for the content created before the incorporation of the company is transferred to the company itself. After the company is incorporated, as the company expands, it should ensure that all the agreements concluded with the providers contain IP assignment clauses that effectively transfer ownership of the IP rights developed by these providers for the company.
Nevertheless, regarding the content developed and delivered by the employees of the company, the Romanian law states that the IP rights for this content will pass automatically to the employer, if the computer programs are created according to the employer’s instructions. However, because often it can be difficult to prove to what extent the computer programs were created according to the instructions of the employer, such IP assignment clauses should also be included in the employment agreements concluded by the company with its employees, to ensure that the company owns all the IP rights.
2. If an entrepreneur hires a freelance developer to write the code, how can the former make sure that the delivered product is in its ownership?
As explained in the answer to the previous question, the Romanian law protects the IP rights of the creator of a computer program, if the content created falls in the definition provided by the law.
As a general rule, in those cases where an entrepreneur hires a freelancer developer to write the code, i.e. to create a computer program, the freelancer will be the owner of all the IP rights over the computer program it created.
Therefore, in order for the entrepreneur to gain ownership over the computer program created by the freelancer, the contract concluded between the entrepreneur and the freelancer should contain special provisions in order to ensure the assignment of all the IP rights owned by the freelancer regarding the computer program/programs it creates for the entrepreneur.
3. How important is data protection for an early stage IT company and how can it prepare to comply with the rules?
First of all, data protection is not dependent on the size of the company, it is not optional and more importantly any early stage funds and venture investors will look into it during the due diligence process.
For the moment, the rules that all the companies who collect, store and/or process personal data must comply are stipulated by the Romanian law and they refer, mainly, to the right of the individuals whose personal data is collected, stored and/or processed to be informed about the data collection, to access the data, to make amends to the data, to formulate oppositions etc.
However, after four years of discussion, the EU-Parliament adopted a new regulation in terms of data protection, the General Data Protection Regulation, that will apply directly to all EU-member states starting with May 25, 2018, Regulation which imposes new obligations on businesses, extends the definition of personal data to anything that can identify a user, either directly or indirectly (which means that even things like Cookies are classified as personal data), gives even greater rights to individuals whose data is collected, stored and processed, while failure to comply with these rules can trigger fines up to 20.000.000 EUR.
Therefore, it is important for startups in all sectors, not only IT startups, to be aware of what the data protection rules are, to correctly identify all the personal data they collect, store and/or process, whose personal data will be collected, stored and/or processed, how it will be shared, transferred or handled and if there are any special requirements for the kind of data they collect, store and/or process.
We want to offer special thank yous to Alin Mihai Laurentiu and the whole team for their support in organizing Techsylvania each year!
Laurentiu, Laurentiu and Associates is Silver Partner of Techsylvania since the first edition*