Category: Articles

“Vertical Agreements” And Free Competition: The Risks For Companies

[vc_row][vc_column][vc_column_text]

Recently there were published, two decisions of the Competition Commission, following an ex officio investigation in the production and placing on the market of margarine and butter. By virtue of these decisions heavy fines have been imposed on the companies involved, which also cover almost the whole of the relevant market, for illegal “vertical agreements” with their distributors.

Vertical agreements are the agreements among undertakings operating at different levels of the production or distribution chain (e.g. producer – wholesaler or retailer – distributor). Unlike horizontal agreements (which mean agreements among competitors), vertical agreements are not considered illegal per se under antitrust laws. Thus, they are not exempt from national and European legislation to protect free competition.

The conclusion (even tacitly) of vertical agreements on terms that unlawfully restrict competition, raises heavily fines (up to 30% of the company’s gross annual revenue from the products concerned by the infringement – cumulatively for each fiscal year with an infringement).

Here are the “risky” terms that most commonly appear in similar agreements:

(a) Resale Pricing

Often, companies want to determine the sales prices at which the distributors resell their products. Such an (explicit or “covert”) contractual term is not permitted because it, definitely, restricts intrabrand competition and gives rise to sanctions.

The justification often put forward by companies is both well-known and serious: the introduction of a single resale price precludes the possibility of selling products at lower cost (in order to avoid actions falling under Antitrust law). But it has, rightly, been rejected by the case law.

Only the recommended or maximum value reference is allowed. Provided, however, that there is no commitment from distributors to meet them.

(b) Geographical Restriction of Sales

Often a ban on sales by the distributor to customers outside the specific geographical area assigned to it is agreed. What is critical here, is the distinction between active and passive sales.

It is considered permissible to prohibit active sales (i.e. sales requiring the active customer approach on the part of the distributor) outside the area reserved exclusively by the producer company. Instead, the distributor should always remain free to conduct passive sales (i.e. responding to customer’s spontaneous approach) even outside its exclusive area.

(c) Restriction On Competition

The non – competition clause is permissible only if its duration does not exceed five years and the market share of each party does not exceed 30%. If these conditions are not met, the relevant clause is examined on a case by case basis.

The European legislator has recorded all the above terms as “hardcore restrictions”, the existence of which, in agreements between a company and its distributors, is considered illegal.

Conclusion: It is crucial that prior to developing a company’s commercial policy on the vertical agreements that it is interested in entering into with distributors-wholesalers-retailers, it should be preceded by close cooperation with the legal counsel of the company. It seems to be the only way to avoid the risk of imposing severe fines that may even threaten the very existence of the company.

Konstantinos Kornilakis
Partner

Υ.Γ. The article has been published in Greek, in MAKEDONIA Newspaper (November 11, 2018).

November 13, 2018
Blockchain: a revolution in safety
[vc_row][vc_column][vc_column_text]

Blockchain is one of the most promising new technologies of the future.

Blockchain has been around for quite some time now, but the markets only became aware of this technology because of the “bitcoin madness” let’s call it.

Blockchain is the technology that, until this day, is mostly used to facilitate the creation and movement of cryptocurrency from one individual to another.

In this article we will approach the matter theoretically and refrain from making references to the actual technical parts. We will try to explain the concept that is blockchain by approaching the subject only from the view of financial transactions.

Without Blockchain

In order to make a transaction in an environment other than blockchain you most likely have to go through a third party that both you and your counterparty trust. Don’t think about it from the perspective of technology: black screens and white signs only programmers with black T-shirts can read.

Let’s say you want to transfer a sum of money; to do so you have to order a third party to make the transfer for you. That third party will most likely be a bank, since till this day in the West very few people can envision a world where not banks but other entities will be holding their money. In Asia, on the other hand, Alipay and WeChat have a huge chunk of the market of money in their role as the third party in most everyday financial transactions.

In any case, entities (banks or other) that hold money for or receive money from persons are selling the service of transferring money. To be more precise after these entities confirm that the sender of the payment has available funds they identify the receiver of the payment and deposit the money in its account, while withdrawing the same sum from your account. But of course, this service costs. At the same time, depending on the specific banks involved in the process and the countries they reside in, this transfer can take a few days to go through.

So now we have two problems, both resulting from the involvement of the third party/intermediary: (i) there is a fee owed to that third party and (ii) it takes time for the transfer to actually go through.

This is where blockchain comes in.

The innovation of blockchain

Blockchain resembles a database. Of course that, on its own, is not revolutionary. The innovation is that, while databases have traditionally been centralized, blockchain is decentralized. This means that there has until now always been a need of a “central authority” (a third party, as described above) recording and verifying data transactions happening on those databases. This is not the case with blockchain.

The need for third parties to intermediate transactions has until now seemed like the only way: parties who wish to transact cannot blindly trust each other. Thus, a need for verification/insurance from a prestigious third party emerged.

But what if the transaction had no risk at all? What if the verification of data was automatic? What if there was a way to ensure that even if the slightest of the data represented by one of the parties did not check out, the transaction would be automatically blocked and no risk regarding what was communicated would be assumed?

What blockchain does is exactly that.

The Mechanics

As promised, a visualization of blockchain technology:

(a) Blocks

Each block contains a single piece of information, in the form of a code. That code gives a specific ID to each block. To better understand it, let’s say that code is a letter of the alphabet. In this case, one block would contain the letter A.

(b) Chain (chainm of transactions)

Blockchain consists of a series of blocks, each one containing a single piece of information on the “inside”, and ID and the “IDs” of the blocks that come before and after them on the sides “touching them”, like so:

This “function” makes sure that no one can hack the code contained in blocks, because if you hack one block (which would on its own take a ridiculous amount of time), the ID of that block would change (since the IDs of blocks depend on and adjust to the code in the block). So if you hacked Block B, it would no longer be called B. But Block C would still witness that block B should come before it. Now if you hacked block in order for it to witness that not Block B, but the block with the new ID (taken after block B was hacked) was the one that came right before it, then the name of block C would change and so on…

For a blockchain to function (for a transaction to be valid, as we will see below), the chain has to at any point verify itself.

One might say that you could try and hack all the blocks in the chain and all the copies of the chain (see below), but, with blockchain technology being as strong as it is today, there is not enough time and computational power in the world to do so.

(c) Introducing a different way to record transactions.

Those chains of blocks are much like a ledger in accounting. They record all transactions, all debits and credits. A simplified example would have as follows:
1. X has 10 (Block A)
2. Y has 2 (Block B)
3. X gives 10 to Y (Block C)
4. X has 0 (Block D)
5. Y has 12 (Block E)
A blockchain can simultaneously tell us how much (money) there is and where it is (who has how much). So it truly does not matter what is represented by any party that wishes to transact. We do not have to trust anyone regarding the truthfulness of any representations -not someone we know or don’t, not a third party. We do not even have to trust blockchain. Anything recorded in a blockchain is a fact.

Any transaction not verified by blockchain is not valid. Anything not validated do not actually happen (technology will not allow an invalid order for a transaction to create and add a new block in the blockchain). Those safeguards result in creating the safest, till this day, environment to transact in.

In our example, if X tried to give 20 to Y instead of 10 in step one above, blockchain would not allow the transaction to go through, simply because X does not have 20 to give.

But how can blockchain know? Well … it does not exactly know. But thanks to the principles following, all persons in the network do know and their knowledge alone ensures that the blockchain is valid and protected, through a distributed and decentralized system, which up until this day seems unhackable.

The principles behind blockchain

All the essence of blockchain, what renders it the most secure environment to transact in, is its principles:

(a) Open Ledger Principle

Everyone in the environment of blockchain, under circumstances, can see all the data (open and public information), but they cannot actually make up the information, because they can only have bits and pieces of it. Thus, everything is public and private at the same time!

(b) Distributed Ledger Principle

The open ledger principle on its own would not go far without the distributed ledger principle. The latter ensures that anyone who wishes can hold a copy of the ledger (chain of blocks).

(c) Shared Ledger Principle

When you wish to make a transfer through blockchain, you have to make that intention of yours public. The network will immediately see the declaration of your intention. At this point, the transaction is still unvalidated, and thus not yet part of the blockchain – it has not yet created a new entry in the ledger, a new block, so it has not yet taken place. Blocks are created and added to the blockchain only through mining.

All the above principles can only reassure anyone who chooses to transact using blockchain. Just imagine how much easier it would be to hack a central authority (eg a bank), than the thousands that may have a copy of the ledger (hack all the blocks of the blockchain and all the copies of the blockchain held by all the peers).

Mining

Anyone can mine. Miners are persons that choose to hold a copy of the ledger. What they do is compete amongst each other (amongst those who hold a copy of the same chain) in order to be the first to validate a transaction and put it in the ledger (make a new entry – add a new block).

Mining comes in two steps:
- Validation: miners essentially check that a transaction is valid according to the data already validated and in blocks.
- Connecting that new block to the chain: to connect a new block miners have to “find a key” that will mathematically allow them to add that new block. Imagine it like solving an extremely complicated riddle by using computational power.
The first to validate a transaction and add a block to the blockchain gets a financial reward.

Application of blockchain

The very concept behind blockchain technology is unconceivably groundbreaking. Theoretically, if applied, it will eliminate the need for any middle man, including banks, even governments, while simultaneously ensuring that transactions are as secure as can be!

Many governments have felt uncomfortable with all those changes happening. Some more than others: China has “banned” the trading of bitcoin altogether.

With bitcoin having almost reached USD 20.000 per bitcoin at its peak, billions of dollars have exchanged hands without anyone having any record of those transactions, without any banks having gotten any fees, without governments having any control over the exchange rates in order to protect their currencies. And all that happened because just one application of blockchain became popular!

Recently, the World Bank launched a new debt instrument (bond-i) that is blockchain operated. In Cyprus big law firms accept payment in bitcoin, and the relevant laws are in the making.

Blockchain is not a technology for the dark web, but a technology for all of us. Today.

To that new reality that blockchain is leading us to we all (and of course businesses and lawyers) have to adapt.

And soon!

Lida Koumentaki
Junior Associate

P.S. A shorter, Greek version of this article has been published in MAKEDONIA newspaper (November 4, 2018)
November 9, 2018
Cyber and Internet Risk Insurance

[vc_row][vc_column][vc_column_text]

Cyber and Internet Risk Insurance: The Importance of every Company and the Role of the Legal Advisor

Coverage of the risks arising from the implementation of e-services and from the use of the internet constitutes a new insurance product. This product is expected to show strong growth in the coming years due to the continued development of technology. Further use of the internet and of social media, as well as the development of cloud computing, are parameters that highlight the importance of this new product. In addition, its aid factor is the very low – in proportion to the use and dissemination of Internet services – the number of companies and businesses that currently have insurance against this particular category of risks.

The Necessity of Cyber and Internet Risk Insurance

It has now been accepted that the development of technology as well as the wide use of the internet, form the ground for the development of criminal behavior, either through negligence or fraudulent one. Such criminal behavior is found both in the professional field and in the context of the privacy of citizens. Indeed, they are growing daily, as they are favored by the loopholes in the regulation of internet use. They are also favored by the corporate entities’ low insurance coverage of cyber and internet risks.

In this context, it should also be borne in mind that today:

(a) the protection of personal data and privacy is a fundamental human right, while

(b) a rigorous legislative environment is built both in the European Union and particularly in Greece on the use of the Internet and cyberspace and, more specifically, on the protection of the personal data of persons and users of electronic services.

However, it is generally recognized that the gap between e-reality and its legislative/ regulatory environment constitutes an additional risk for businesses. E-reality is changing, evolving and growing rapidly, while legislative initiatives attempt to follow cyber developments late and often incomplete.

Consequently, there is no doubt that insurance against cyber and internet risks is now a necessity. This necessity concerns large companies, which are major targets for malicious actions. It also concerns smaller companies, which are more vulnerable to malicious actions and more vulnerable in dealing with the damage that can be caused by such.

Choosing the Right Insurance Product

In this corporate environment of the constantly evolving and changing e-reality, it is crucial to choose the appropriate insurance product against the specific category of risks.

This choice can no longer be made based on the less expensive premium. Instead, this option should be part of an integrated corporate policy. This policy should aim to tackle offending/criminal behavior that have to do with the use of the internet and e-services. The concern for both the planning of an integrated corporate response and of the choice of the appropriate insurance product can only be the responsibility of the legal entity’s legal advisor.

However, generally speaking, each company has to plan its reaction to cyber and internet risks and consequently to choose the appropriate insurance product, taking into account its object, the degree of penetration of electronic services in its operation and the type and the range of personal data it processes.

The Insurance Market in Greece

While checking the insurance programs offered by the insurance companies operating in Greece, one shall find wide variations and discrepancies in the coverage against cyber and internet risks. Specifically, it is noted that the largest insurance companies in Greece:

(a) either do not provide insurance plans for such risks,

(b) either includes coverage against specific risks within the framework of the electronic equipment insurance and as an optional and supplementary coverage of business insurance, i.e. not providing a specialized insurance program,

(c) or have introduced specialized and innovative insurance programs, which combine insurance against these insurable risks with the provision of legal, technical and advisory services, forming a single package.

It is therefore clear that, as far as tackling the dangers arising from the deployment of e-services and the use of the internet, the tools do exist.

The company’s responsibility towards its entity, its partners or shareholders, its employees, and third parties is to choose the most appropriate tools. Additionally, the company is required to incorporate these tools into its Cyber Risk Management plan to address these breaches. Accordingly, the responsibility of the lawyer – legal counsel of the company is the evaluation of the offered insurance products and the assistance in choosing the optimal solution. In addition, the duty of the lawyer – legal counsel is also the maximum possible safeguard of the company through the control of the insurance contract. Finally, in the event of the insured risk occurring, the duty of the lawyer – legal counsel extends to the formation of a substantiated claim of the insured company for the fulfillment of the obligations of the insurance company.

Petros Tarnatoros
Senior Associate

Υ.Γ. The article has been published in Greek in MAKEDONIA Newspaper (October 27, 2018).

November 1, 2018
Cyber Attacks And The Role Of The Legal Advisor
[vc_row][vc_column][vc_column_text] “There are only two types of companies: those that have been hacked, and those that will be”, said on 2012 the then FBI Director Robert Mueller.

Despite the digitization of information and the use of electronic networks to deal with transactions and operations, it is obvious that most companies in Greece are not aware of the risks they face as well as their customers’ data from cyber-attacks.

The legal consequences of data leakage due to cyber-attacks are always serious. On the one hand, the injured third parties are entitled to bring legal proceedings against the company for the leakage of their data while on the other hand, the competent authorities must impose the fines provided for by law.

The Νetwork And Information Security Directive

Most are now aware of the General Data Protection Regulation 2016/679 (also known as GDPR). Few, however, are aware of the Network and Information Security (2016/1148), which also had to be incorporated into the domestic law of the Member States in May 2018.

With the above-mentioned legislation, the European Union strengthens its attitude towards corporate responsibility for failing to protect and secure data management. Both of these laws provide for unfavorable consequences for the company for data leakage.

The Role of the Legal Advisor

The duty of the Legal Advisor is to ensure the correct implementation of legislation and best practices, to mitigate the consequences of any breach and, in particular, to harmonize the entire company to comply with the Incident Response Plan, which every company must have. A Response Plan to Cyber- Attacks indicatively includes:
- The composition of the crisis management team and when / how it is activated.
- The heads of the action groups, and when / how they are alerted.
- The person who decides (and the decision-making deadline) for the total shutdown of the company’s networks or the continuation as an attempt to identify the origin of the cyber-attack.
- The documents that will document the time of cyber-awareness and the actions that have taken place.
- The communications officer who (possibly) will handle the communicative part of the revelation.
Your legal advisor knows what actions are required to make clear to the authorities that the company has done its best on both preventive and post-data leakage as well as to collect the appropriate evidence. The role of the legal advisor is also critical for the preparation of a report that will clearly and easily identify the causes of the leakage and the persons responsible for such.

Also, the company’s legal advisor will identify the most likely sources of risk and will be able to negotiate the content of the proposed insurance contracts and eventually recommend the conclusion of the appropriate insurance coverage contract against cyber-attack.

All the above actions of the legal advisor (internal policies, Response Plan, Insurance Coverage), but mainly the alignment of the company with everything that is provided to this respect, can only result in the increase of the trust of its clients and associates towards it.

Lambros Timotheou
Partner

P.S. The article has been published in MAKEDONIA Newspaper (October 21, 2018)
October 24, 2018
Companies Vs Investors / Banks: Balance Of Interests

[vc_row][vc_column][vc_column_text] The financial data of the companies, the current circumstances each time, as well as the business plans often create the need to look for funds: more often in the form of a company’s capital strengthening and / or its financing.

The Expectations of The Parties

Business interest leads to the search for “cheap” funds (in the sense of the least possible financial burden). What is important is, on the one hand for no significant commitments and collateral to be, while on the other side for the repayment period (when it comes to lending) to be long.

Investors (most commonly individuals, funds, venture capital, etc.) and, just recently banks, are always looking for

a) the maximum possible return,

b) the earliest possible return of the investment,

c) the maximum possible collateral.

Collateral

Contractual undertakings and securities (guaranties, liens on mortgage, mortgage, pledges) have lost a significant part in the value scale of investors and banks. It is no longer the basic, and certainly not the only, security they are looking for. They often require (and, as a rule, achieve) important commitments from the company – contrary to their own interests and needs. The threatened sanction in the case of breach of these commitments is a kind of penalty (in the case of investors) or the recognition of a relative reason for terminating financing and claiming immediate return (in the case of banks).

Restrictions, Commitments and Obligations

The restrictions, commitments and obligations imposed are, generally, diverse. They may concern the company, its business activities, its management and its shareholders. Access to books and close monitoring of the company’s financial data is the minimum. It is quite indicative that one may (in the view of recent experiences) refer to the need for the investor’s or, as the case may be, the (bank) creditor’s assent in cases such as the following:

(a) Approval of the business plan.

(b) The composition of the Board of Directors (with the ultimate objective of the involvement of investors’ representatives in it).

(c) The major decisions making (e.g. merger, demerger, division, interim dividend and dividend distribution, return of capital, purchase, sale, lease, rental and leasing assets, entering into significant commitments, provision of securities, and so.).

(d) Third party financing either directly (e.g. loans) or indirectly (e.g. guarantees).

(e) Amendment of core provisions of the Articles of Association.

(f) Change in equity [transfers of shares either between shareholders or to third parties, including the provision of shares to executives as incentives, for example stock option (!)].

(g) Insurance of the assets of the company and ban on the transfer of the insurance indemnity, and so on.

The Multi-functional nature of Commitments

The undertaking of obligations and commitments such as those mentioned above, operate on three levels:

(a) The investor (or the Bank, as the case may be) feels the (really necessary for them) security in order to proceed with the useful, and sometimes critical, investment or financing of the company.

(b) The company, its management and its shareholders should be ready to accept control, limitations and / or (worst case) veto rights in their significant business decisions.

(c) The company on the one hand and the investor (or, as the case may be, the Bank), on the other hand, are linked with extremely strong ties throughout their co-operation, which cannot be broken without dramatic or even extreme adverse effects.

The Enforcement of Commitments

The commitments undertaken by the company are likely to prove problematic in a dual way – especially when the terms are imposed by a bank that finances:

(a) The ability to take business decisions is transferred by the company, even partially, to (middle or senior) bankers, who are neither entrepreneurs nor have significant knowledge of the subject. Most important: they never hold a real risk for their choices, they never compromise their own personal property.

(b) The freedom of the company, its management and its shareholders are limited regarding the implementation of its plans. The company binds to the creditor bank. No significant business decision can be taken without the consent of the latter. The bank even has the (normally uncontrolled) option to block or endorse any business move and any other funding. It also has the option to finance the company’s business itself – thus gaining a dominant position among its funding sources.

The Balance of Interests

In the context of a free economy like our country’s economy, nobody is obligated to conclude a contract and / or to accept specific unfavorable contractual provisions.

In the case of searching for funds, the strong party is not, normally, the company: It will be often “drawn” into concluding contracts and to undertaking extremely problematic commitments.

It often seems, logically, utopian to talk about “balance of interests”.

There is only one thing for sure: The company shall not be “heard” when it attempts , in the near or distant future, either to discuss on the “small print” or to reproduce the assurance of its creditor (bank, fund or venture capital): “Come on, do not pay attention: these are typical – we are here for you” …

Stavros Koumentakis
Senior Partner

P.S. This article has been published in MAKEDONIA Newspaper and makthes.gr (October 14, 2018)

October 17, 2018
Company’s Capital Enhancement: Partnership With An Investor

[vc_row][vc_column][vc_column_text] An option to finance a company’s investment plans (either it is a startup or not) is its capital enhancement. When the entrepreneur has funds and chooses to invest and keep his course alone things are, generally, simple. Thus, sometimes he is forced or chooses to partner with an investor looking to his enhancement and support. The investor can be either an individual or a business venture (eg venture capital).

How An Investor “Enters” Into A Company

An investor’s entry into a corporate scheme (let’s limit it to a Société anonyme) can be made in different ways. The purchase of existing shares or the participation in the share capital increase are the most common ones. There is, in addition, the case of a bond loan convertible into shares when the lender exercises its relative right to convert its financial claim into shares.

Investor’s Participation In Capital Enhancement

In each case of an investor’s entry into the share capital of a company, some of the first issues to be clarified are:

(a) if the shareholding shall be a minority shareholding or a majority shareholding,

(b) what will the amount to be paid by him be, and

(c) what will be the percentage of the share capital to which his participation shall correspond.

Please note that some percentages of the share capital are assessed as critical for the operation of a Société anonyme, with the clarification that when we refer to majority shareholding as a mean of participation, we may face the issue of the company’s acquisition. Additionally, the investor will always aim to an increased number of shares, while the entrepreneur to the less possible. From the legal perspective, there are always the appropriate tools to implement the object of the (participation) agreement.

Common Objective And Investor’s Assurance

The main reason for any investment (either of a high or of a low risk) is earning business profits.

The profit (: common objective) is interwoven, among other things, with the successful implementation of the business plan, which has been agreed between the entrepreneur and the investor. It also corresponds to the percentage of the share capital each one of them holds as well as to the policy for the distribution of profits.

The investor always claims, in order to safeguard his interests:

(a) close and multilevel monitoring of the operation of the company (including the legal and financial aspects of the company’s operation),

(b) participation in the administration and formulation of the (company’s) strategy,

(c) a veto right in critical decisions,

(d) shareholders’ commitments (e.g. limitation or prohibition of the transfer of shares) and so on.

Exit strategy

The investor often seeks a binding agreement with regard to earning his profit and to withdrawing from the investment. This agreement (also known as the “exit strategy”) includes, among other things, the time, the conditions and the amount the investor expects to receive at the time of withdrawal.

Contractual Framework

For the success of such a venture, it is necessary to have secure contractual commitments, an extraterrestrial shareholder agreement and / or statutory amendments. A crucial parameter for the success of the whole venture is always the detailed and accurate recording of everything that has been agreed, the rights and obligations of each party. In any case, it is desirable that the parties involved do not appeal to third parties for the interpretation and implementation of the agreements, at any time in the future.

Stavros Koumentakis
Senior Partner

P.S. This article has been published in Greek in MAKEDONIA Newspaper and portal makthes.gr (October 9, 2018)

October 9, 2018
Startups: Financing, Risk and Sustainability

[vc_row][vc_column][vc_column_text] Startups: business ventures (emerging and usually promising) in the early stages of their operation. In Startups the subject of activity is almost always highly original, pioneering but also high risk-high reward.

Startups Financing

A business idea, as innovative, dynamic and promising as it may be, needs capital to be translated into a business venture and profit. Such capital, sometimes less and other times more important, may come from the savings of the “startupper” or from its close environment.

Thus, the case of financing coming from the startupper’s close environment is not the most common one. Alternatively, financing comes from:

(a) Business Angels. “Angel investors” are the ones who, first and above all will believe in the innovative idea and will agree to fund it. Angel investors will undertake high risk, acting individually or organized into an angel fund.

(b) Venture Capitals. It is an organized fund of investors, with high-level professionals. In addition to capital, experience and knowledge in strategic, development, sales, administration, operation, marketing, and other issues, are also provided.

(c) The Crowdfunding platforms. The “crowd” funding will come from the use of an on-line platform. The participants fund the idea with small amounts each. In Greece there is a relevant legislative provision thus with limited implementation to date.

(d) Banks. This is not a common ase in our country, as banks typically look to finance existing businesses long established and with good-standing financial data.

(e) The European Union. These funds are channeled directly or through programs managed at national level.

(f) Business Incubators. Business Incubators usually provide support at a practical level (premises, furniture, equipment, administrative support, contacts) or/ and short – term support and financing.

Risk

It is not reasonable for a young, optimistic and promising entrepreneur to expect the financing and support of an investor (or of a simple lender) without being ready to take the risk. And the specific risk concerns the provision of adequate collateral (personal or real – when available). It also refers, most commonly, to the commitment of an important part of the business and of his business freedom. This can be translated into a transfer to the investor of a part of the company’s share capital, into accepting drastic restrictions on making business decisions etc.

Startups’ Sustainability

The interests of the contributor / investor and the entrepreneur are partly identical and partly conflicting. The sustainability of the start-up is a common goal. The rapid and lucrative exploitation of the business idea as well. What will happen, however, if there are conflicts over the range of powers of each party? How to deal with the investor’s claim for collateral or with the pressure to restrict the business freedom of the startuper who is also the owner of the idea?

In a country where 50% of startups fail within three years, the assistance of appropriate consultants is proving critical. Especially from a legal perspective.

Stavros Koumentakis
Senior Partner

P.S. This article has been published in Greek in MAKEDONIA Newspaper and portal makthes.gr (September 30, 2018)

October 2, 2018
Voluntary Benefits In The Context Of Modern Labor Relations

[vc_row][vc_column][vc_column_text]

Voluntary Benefits: “What is, ultimately, in force?”

The offer of benefits to an employee, in addition to the agreed salary

(whether this is the statutory or higher than that), is a practice of several employers, which in the last years of the deep economic crisis tends to become an established practice.

These benefits are classified as “voluntary” and may be a certain amount of money, a benefit in-kind (e.g. vouchers for supermarket purchases, food, meals during work) or even an expenditure on behalf of the employee (e.g. conclusion of a group insurance contract and payment of the premiums).

As a result of this practice, the employee receives the salary agreed with the employer and in addition, actually, earns more “income” during the employment relationship, which is valued at the amount of the benefit offered. The fact that these benefits are paid in the course and because of the employment relationship, often gives rise to a confusion as to their nature and, in particular, to whether they can be characterized “salary” for the employee.

The answer to this question is not simple and has repeatedly addressed the Greek courts at the highest level. However, it should be noted that this question has, even beyond the legal, also a business- and of course economical dimension, as for many entrepreneurs the adoption or not of such a choice, is a central question.

An initial response to these questions is attempted here.

Is it an Employer’s Right Or Obligation?

In principal, the offer of these (voluntary) benefits takes place in the context of the exercise of the employer’s freedom to give to the employee “something extra” to the salary that has been contractually agreed upon. Thus, the employer (should) be able to discontinue the offer of each voluntary benefit at any time and without providing any reason while the employee cannot be able to raise a claim for the continuance of such offer.

However, it is possible that the offer of a voluntary benefit become a business practice (custom) due to its continuous and long-term granting and to its acceptance by the employee, which results in a tacit agreement between the employer and the employee that the benefit is part of the latter’s salary. In this case, the employer is obliged to offer the benefit and can no longer stop granting it unilaterally.

However, if the employer, at the beginning of the offer of a benefit, makes it clear to the employee (e.g. in the employment contract) that he reserves his right to discontinue its grant at any time, without justification and without the agreement of the worker, thereby formulating the so-called “reservation of liberty”, it cannot – in any event – be considered that the benefit has a salary nature and therefore the employee will not be entitled to claim its payment.

Employer’s “Reservation of Liberty” And “Withdrawal Clause”:
The Distinction of the Legal (And also Economical) Consequences of Each

The Arios Pagos (Supreme Court of Cassation) for the first time its decision with the no. 1174/2017 separated the concept of the “reservation of liberty” from that of the “withdrawal clause” which the employer may enter at the beginning of the granting of a voluntary benefit.

In the case of the “withdrawal clause”, the employer may discontinue the benefit by exercising the right to withdraw by a unilateral declaration addressed to the employee. As a result, both the “reservation of liberty” and the “withdrawal clause” allow the employer to unilaterally discontinue the offer of the benefit.

There is, however, a substantial difference between them: Entering a “reservation of liberty” rules out the creation of a business practice (custom) and thus implicit contractual commitment of the employer to provide a benefit and the employee’s corresponding claim for its payment. On the other hand, entering a “withdrawal clause” does not function in the same way: the employee’s entitlement to the benefit is born thus the exercise of the right of withdrawal results in the loss of that claim for the future.

As soon as the worker becomes entitled to the benefit, this amount should be taken into account for the purposes of determining both the severance allowance and also any other benefit of the employee provided by law and for the determination of which the amount of the salary paid is taken into consideration (indicatively: ad hoc bonusses). As the choice of one or other clause has direct financial consequences for the burden on the business, the particular value of this distinction is easily understood.

The Real Dimensions of Voluntary Benefits in Labor Relations

More and more companies, burdened by the unreasonably diverse charges on business nowadays, seem to face voluntary benefits as a means of limiting their contractual obligations towards their employees and hence saving (or potentially saving) costs. The procedure followed is more or less common for both the current employees of the company and for those in recruitment: both are required to accept as a fixed remuneration a certain amount, which is however split down to the statutory minimum wage (which will be mentioned in the employment contract) and to the remaining amount that (explicitly or implicitly) will be offered to the employees as one of the above-mentioned types of voluntary benefit.

On the one hand, the current employees agree to sign an amendment to their contract of employment, in which the reduction of their salary to the statutory minimum is recorded, while the ones in recruitment agree to sign a contract of employment accepting the statutory minimum salary as a conventional salary. Both categories of employees aim at more permanent compliance with the additional voluntary benefit, which will complement the amount of the agreed salary.

Voluntary Benefits: Its Tax Treatment

As far as taxation is concerned, the legislator does not deal with the voluntary benefits in a consistent way. In principle, the general taxing rule applies for their taxation, if their value exceeds € 300,00 per year. However, the sub-cases of how to determine their value, but also the explicit exceptions to the rule, are several (and related to the amount of benefits per category envisaged), so that the employee must search in which sub-case the benefit he receives is categorized in order to know if he will be taxed for this benefit. A typical example of this is the coupons for food (i.e. the widely used coupons for the supermarket), which are not taxed if they do not exceed € 6,00 per day, or € 120,00 per month.

For the tax legislator, therefore, the legal characterization of the benefit is irrelevant, but the amount of the benefit is particularly important.

By Way Of Conclusion

The choice of companies to offer voluntary benefits under employment contracts (whether offered freely or freely withdrawn) is increasingly adopted in the context of a reasonable effort to derive a legitimate benefit or to reduce unfair costs. In any case, particular attention should be paid to the wording of the relevant provisions and clauses in order for the maximum benefit to be achieved and for the risk to be minimized.

The contribution of the lawyer (and in this case) also legal advisor is particularly important.

Evdokia Kornilaki
Senior Associate

[/vc_column_text][/vc_column][/vc_row]

June 24, 2018
Cyber Risk: The Role Of The Legal Advisor
[vc_row][vc_column][vc_column_text]

Cyber Risk: Does It Concern Everyone Or Exclusively The “Elite” And “Famous People”?

“Many people working in cybersecurity will tell you that it’s not a question of whether a company shall suffer a cyber-attack but of when it will suffer it in any form. Whether you have been cyberattacked and you have not been aware of it or you have been cyberattacked and you know it, or you will be cyberattacked sometime in the future”.

This is Martin Felli’s statement (CLO of JDA Software, one of the world’s largest software companies for logistics companies) to Dominic Carman, who conducted a special survey for Kroll.

What Felli says is in fact an explanation of the statement of former FBI Director Robert Mueller who had already since 2012, stated that: “There are only two types of companies: those who have been already hacked and those that will be hacked in the future”.

Despite the continuous digitization of all kinds of information and the use of electronic networks to carry out all sorts of transactions and operations, it is more than obvious that most companies in Greece are not aware of the risks they run themselves as well as their customers’ data from of every kind and form of cyberattacks.

But why should your legal advisor deal with this issue? Isn’t it a matter of IT?

In order to attempt a satisfactory answer to this question, we must set our sights to the recent past …

Τhe Disclosure Οf Loss Οr Leakage Οf Information Αnd Its Consequences-General.

The demonstration – disclosure of a loss or leak of information of any nature (whether it is a customer’s personal data or business secrets) starts with admitting publicly this leak. Such public action can be made either to the general public or to a limited circle of persons and legal entities whose data has been lost or leaked due to the cyberattack.

In either case (: admitting publicly or limitedly a cyberattack) the legal consequences are always serious. Third injured parties are entitled to bring proceedings against the company that has suffered a cyberattack while the competent authorities have to impose the fines provided by the existing institutional framework. The extent of the damages to be awarded and the fines to be imposed will always be directly proportional to the extent of the leakage and the severity of data lost or hucked.

In both cases (: in the first one immediately, in the second on time) the inevitable publicity attracts media’s interest and causes, inevitably, a serious damage in the company’s prestige and reputation. This second consequence of a cyberattack is similarly severe (sometimes even more) than the legal consequences of such disclosure (lawsuits, administrative fines, criminal liability).

“There Has Not Been A Thorough Investigation Of The Causes Of the Leak Of Information”: Yahoo Case

Relatively recently (in 2016), Yahoo has revealed two separate incidents of data hacking by hackers who have gained access to data for a billion users (the number actually causes vertigo). The first incident occurred in 2014 and was initially kept secret. But when 2016 a second violation took place the company was forced to make a total disclosure.

The shock to the business world of the United States was so great that a detail perhaps went unnoticed: The first to resign was Yahoo’s Head IT (: as expected) but the second was the Chief Legal Advisor. Why, though, this second resignation?

The Special Commission appointed by the Yahoo Board to investigate leakage circumstances, both in 2016 and 2014, considered that the whole group of Yahoo’s Legal Advisers failed to investigate thoroughly the causes and circumstances of the breaches in 2014. Notwithstanding the fact that it also had the data and conditions to do so. This particular failure by the legal counsel team had as a first result that no substantive measure was taken, and that, as a final and yet dramatic (result) to allow the widespread violation of 2016.

What was the duty that Yahoo’s Chief Legal Advisor omitted? What is the responsibility of the Legal Advisors of a company?

The Changes Brought In The Global Business Environment By The EU Regulation GDPR And The NIS Directive

In 2016 the European Union legislated two major legal instruments: the General Data Protection Regulation 2016/679 and the Network and Information Security Directive 2016 / 1148).

Many people are already aware of the first of them (GDPR). However, the second is ignored, despite the fact that it must also be incorporated into the domestic law of the Member States from May 2018. Member States are obliged to identify by November 2018 the operators and service providers of basic services (who now have increased responsibility for maintaining high security measures).

These laws will affect (more precisely: they already affect) directly and in one way or another all the companies that process Personal Data of European citizens. It is emphasized that they affect not only European companies but also non-European Union entities that process Union citizens’ data.

In Europe (as in North America earlier in the past), something important is changing in relation to the assessment of the risks posed by electronic data processing. The attitude of the legislative and auditing authorities appears to be abrupt and significant. With the above-mentioned legislation, the European Union is spearheaded on the issue of corporate responsibility for failing to protect and securely process information that in one way or another is processed by the companies.

Both laws, apart from all their other consequences and the multiple regulatory compliance parameters they create, are also adding further adverse consequences in the event of a cyberattack that may result in data leakage.
The Role Of The Company’s Legal Advisor

In this context of the rapid (but at the same time important) changes in business behaviors and practices brought by the current legislative trends, the role of the Legal Advisor of a company proves to be extensive and, at the same time, crucial.

The Legal Advisor of a company, as the head of the team concerned, owes to design, supervise and test in advance an Incident Response Plan for the case of a cyberattack.

Perhaps it seems strange that a lawyer and not the IT Manager is at the head of such an effort. However, only in this way can there be effective protection of the company’s interests against the consequences of a possible loss or leakage of data.

In the technical part it is obvious (and self – evident) the assistance of the specialists who will identify the type of invasion, the exploitation weakness, the identification of the volume of data leaked, etc. However, the main concern of the Legal Advisor will not only be disclosing to the management and the responsible employees of the company, but also ensuring the best implementation of the laws and best practices, mitigating the consequences of any breach and, in particular, harmonizing all the departments of the company in the implementation of the Incident Response Plan.

Your Legal Advisor (ought to) know those provisions (before cyberattack) and the actions required (after cyberattack and data leakage) to:
- Make clear to the competent Audit and Judicial Authorities that the company has done the best on both preventive (before cyberattack) and post-data leakage.
- Identify the causes of the leakage, the persons liable, the existence of willful deception or fault that contributed to the leakage of the information in a clear and understandable way (to non-experts).
- Creating optimal conditions and evidence for seeking to punish perpetrators and / or those responsible for the attack before the competent authorities and bodies.
- Manage the communication of the consequences of the disclosure of data loss / leakage due to cyberattack.
The Legal Advisor of the company will identify the specific risks for each of his client companies according to their activity and their exposure to data processing (gap analysis). In cooperation with IT, the Legal Advisor will investigate possible cybercrime scenarios and prepare an Incident Response Plan that will be simple and comprehensible to all executives and departments of the company and, in particular, to a judge who may eventually deal with it later.

To be clearly understood, let’s take a simple example: The lawyer who defends a client for medical negligence does not need to be a neurosurgeon. It is enough to be prepared to understand the philosophy and sequence of the protocol that his client ought to follow in order to respond to the disputed incident. The Legal Advisor of the company, having understood the technical issues with the valuable help of IT, will “translate” in a comprehensible manner the necessary actions and processes so that they are simple and easy to understand by both the Company’s Management and the employees and by third parties (auditing and judicial authorities).

It is particularly notable that already in the US and Great Britain, the top law firms have developed their own Cyber Security Division to provide all the services required (legal and IT).

The Issue Of Cyber-Security And Its Integration In The Company’s Regulatory Documents

On the initiative of the Legal Advisor, the Cyber Security issue must be integrated in the company’s regulatory documents (Internal Working Rules, Internal Rules of Operation, Policies for Data Processing and / or Computer Management etc.).

For illustrative purposes only it has to be noted that an Incident Response Plan should contain (indicatively – among others):
- Who are the heads of the action groups, when and how they are alerted.
- Who decides and within which time framework the (eventually) total shut down of the company’s networks or attempts to resume operations to identify the origin of the cyberattack.
- Who is the external partner (who may) be involved in system monitoring.
- What and of what nature are the written notices and reports that will be the proof of the time of awareness of the cyberattack and of the actions that took place.
- Who is responsible for communication and PR (who may) have to manage the communication part of the disclosure.
Does The Legal Advisor Have To Deal ALSO With The Insurance Against Civil Liability?

In the same context, the Legal Advisor of the company will accurately identify the most likely sources of risk and will be able to choose the right insurance against civil liability plan in relation to cyberattack. This in contravention of the usual business practice, when the cheapest offer is chosen and the first text / draft insurance contract to be sent by the selected insurance company (which may cover on the one hand absolutely unnecessary risks while on the other hand not cover what is absolutely necessary).

The Link Of The Company’s Good Repute With Its Protection

All the above actions of the Legal Advisor (: existence of clear regulatory documents, policies, Incident Response Plan, Insurance Coverage etc.), but mainly the alignment of the company and of its executives with what is provided can only have the effect of increasing the trust of customers and collaborators towards it.

Given that we all want to work with trusted partners, the (regional) benefits of the company are more than obvious: customers see that they are dealing with a serious business partner rather than a “little store”.

Creating The Conditions To Prevent an “Internal” Cyber Attack

Over the past few years, we have been facing business-secrets violations by (dissatisfied or not, active or retiring) company’s executives in the context of their long-term or opportunistic planning. Our case law has dealt with some individual cases, until now, where executives either wanted (simply) to harm their employer’s company or their personal enrichment or their transfer to a competitor-along with the business secrets of their previous employer.

The protection of the company by its (malicious) executives, although not automatic or self-evident, is, to a very large extent, feasible, with significant leverage in the existing institutional framework and the Constitution. (http://koumentakislaw.gr/en/blog/articles/enterprises-and-confidentiality/)

So, what happens when cyberattack comes “from the inside”, that is when the offender is an executive of the company? Is protection and deterrence possible? Is it possible (in the non-desired case) to detect the origin and identify the offenders so as to make an (internal) example of them and for (future) deterrence?

The Legal Advisor is the one who must create the framework and the background of business secrets. It is precisely in this same context (in close co-operation with the IT section) that he must create the conditions to prevent an “internal cyberattack”, which could seriously damage the interests of the company he represents. He is the first to “raise” the alarm but also the one who should urge the company to establish appropriate policies and procedures for the safe use of the company’s networks, electronic communications, the control of access to the company’s systems and records by its executives.
By Way Of Epilogue

The resources available are always limited. The need for their rational management is more than obvious and (also) in relation to the maximum possible protection from Cyber Risk.

If there is no rapid and thorough identification of the needs and potential risks for the particular company, it is likely that the company’s resources be “spent” in a way that will not be the optimal one.

Your Legal Advisor can lead you to a more rational and efficient use of available resources and also take the responsibility for coordinating all stakeholders.

Even if you do not choose to assign to him the specific projects, please just search for his assistance. You can be sure that the result will be infinitely better.

Lambros Timotheou
Partner

[/vc_column_text][/vc_column][/vc_row]
April 26, 2018
Companies And Confidentiality
[vc_row][vc_column][vc_column_text]

The Importance Οf Securing Confidentiality

Every company faces a lot of challenges to become and remain healthy, but also to maintain the high standards it has possibly achieved in terms of operation, efficiency and profitability. Maintaining (and, more importantly, increasing) its market share in the geographic areas of its activity requires a series of obstacles to be overcome daily.

Achieving and maintaining healthy entrepreneurship is always not only a requirement but also an everyday challenge. One of its prerequisites is to ensure that the information that the business identifies as confidential will be maintained as such and, among other things, will not diffuse into competition.

In some, special cases, the obligation to preserve the confidentiality of the information that is handled by the company is imposed by the institutional framework (see below on personal data). In these cases, the consequences do not refer to the smooth operation and development of the company. The consequences may refer to indefinitely high fines and penal sanctions!

Persons Liable For Confidentiality

The obligation to preserve confidentiality is an obligation that everyone has. Without exception!

As the worker or the company’s usher is not excluded the same way (obviously), the executives, the senior management, the CEO or even the main shareholder are not excluded. It is important, however, to stress that this obligation also includes any third party with whom confidential information is shared, e.g. a close associate or consultant of a business.

Form And Way Of Notification Of Privileged Information

The form of the information is of no importance for its protection: It may be documents, electronic files, even for oral information disseminated to a specific number of persons and pertaining to a particular company or group of companies.

Additionally, the way of knowing the information covered by the confidentiality obligation is also meaningless. It may be information that (e.g.) an executive has become acquainted with while performing his/her duties at his workplace or even outside such (e.g. at the client’s premises). It may still be information about matters handled by the person responsible for such, colleagues, business associates or consultants of the company. Finally, there may be information on issues related even to customers of the latter.

Privileged Information

Information covered by the confidentiality obligation may refer to commercial know-how (commercial information: e.g. customer and supplier lists, cost accounting and price calculations, sales strategies, marketing methods, and so on) and / or technical know-how (expertise, technical information). They may relate to the methodology, procedures, planning, data, development and results of any business activity, process, research, product output or service provision. They may relate to procedures, policies, documents of auditing authorities related to the company. It may, in the end, concern any issue of importance for the company.

Particularly, On Personal (Personal and Sensitive Information) Data

Thus, some of the protected information may even be related to personal data – personal and sensitive information. This scenario adds more obligations for companies as provided by the current institutional framework (EU / 1995/46 Directive incorporated by Law 2472/1997) as well as by the new Regulation (EU / 2016/679) which will be implemented as of 25 May 2018 and beyond – regardless of whether or not the (expected) law which implements it be adopted.

However, it is not only the additional obligations of companies that are being created by the existing and the new institutional frameworks with regard to personal and sensitive data but also, especially, the threatened sanctions in case of non-compliance and / or violation (for all these issues please refer to the relevant article “Personal Data Protection and Companies”)
The Obligations Of Executives And Partners

Contracts that associate all employees and external partners with a company (must) include provisions that restrict the use of information that come to their knowledge during and solely in the context of their cooperation with the company. And even more: (they ought to) regulate the obligations of employees and associates during the period after the expiration of their cooperation (e.g. return of forms, documents, notes, deletion or return of electronic files) as well as the sanctions for breach of their (contractual and post-contractual) obligations (usually high penalties – in addition to general claims for compensation).

Particularly, Decision 1/2017 Of The Arios Pagos (Supreme Court of Cassation)

This decision has been a landmark on the specific issue.

By virtue of this decision, it has been accepted that constitutionally protected rights (including the rights of the employees) such as the confidentiality of letters and communication (article 19 of the Constitution), the inviolability of private and family life (article 9C) and the protection of personal data (article 9A C) be limited on the basis of the constitutionally guaranteed principle of proportionality (article 25C).

Therefore, in the context of this decision, the right to legal protection (article 20 par. 1 C) and of the freedom to conduct business (articles 5 & 106 par. 2 C) of an employer / company could prevail over the abovementioned rights of the employees.

However, what was, practically, the meaning of the limitation of the constitutionally guaranteed employees’ rights in the framework of this specific and of other similar cases?

There has been recognized the Employer’s right (whose above-mentioned constitutional rights were deemed to prevail, in the particular case and under the particular circumstances) to:
- Monitor the electronic (professional and personal) correspondence of its employees as it is imprinted on the computers and on the other means of its company
- Draw the deleted mail from these computers that constitute its property
- Record the data obtained from the computers of its company and, in particular,
- Exercise its legal rights on the basis of data contained in the personal or professional correspondence of its employees which took place through the company’s computers even if they had been deleted in the meantime.
There is no doubt that this decision is extremely important: The Company does not remain (legally) unprotected against malicious employees who, under the guise of their constitutionally protected rights, attempt to harm it for their own benefit.

When Does The Confidentiality Obligation Recede?

The confidentiality obligation recedes:
- when the information to which it refers is public (and a priori) known
- when there is an obligation to disclose this information arises from the existing institutional framework or is imposed by a competent authority or a competent court.
Confidentiality Provisions In Business Level

In business level, the provisions that refer to confidentiality are (or should be) normally contained:
- in the employment contracts, in the service agreements, in work contracts etc. of the company
- in the company’s Work Rules (where applicable)
- in the Code of Ethics (or Code of Conduct) of the company
- in the NDA’s of the company and its customers- clients τόσο της επιχείρησης όσο και των πελατών της (to the extent that the latter apply to the company and, in addition, to its employees)
Confidentiality Provisions Contained Into Legislation – Generally

In cases where (contrary to what is agreed or what the law requires) the person who breaches the confidentiality obligation causes damage, the person responsible is obliged to restore it in its entirety (losses and damages – article 914 of the Civil Code, moral damage – article 932 of the Civil Code)

However, irrespective of the civil claims maintained by the injured person against the person responsible, there are a number of criminal provisions relating to the criminal offense of the offender [indicatively: article 370 of the Penal Code (violation of letters privacy), article 370A of the Penal Code (violation of the telephone conversation and oral conversation privacy) , article 370C of the Penal Code (illegal access to an information system) and the related provisions of articles 370B, 370D, 370E of the Penal Code]

There are, of course, also provisions referring to specific issues arising from the breach of confidentiality, as (indicatively):

There are, of course, also provisions referring to specific issues arising from the breach of confidentiality, as (indicatively):

More Specific Provisions

(a) With regard to personal data breach

Whenever the confidentiality obligation breach is related to personal data breach, there are administrative, criminal and civil penalties directly or indirectly imposed (also) on the offender.

On the basis of the existing institutional framework (Law 2472/1997) which is in force until 25.5.2018 – when Regulation 2016/679 – http://koumentakislaw.gr/en/blog/articles/personal-data-protection-and-companies/ enters into force, there are provided specific administrative penalties (Article 21), criminal sanctions (Article 22) and also civil liability of the offender (Article 23).

Regulation 2016/679, of course, provides for very serious administrative sanctions (Article 83) and for civil liability for those who violate personal data (Article 82). It is expected that the law currently being drafted will further specify said sanctions or even impose additional (e.g. criminal) for the offenders (Article 84).

(b) With regard to unfair competition

Where through confidentiality breach there is also violation of the provisions of unfair competition (Law 146/1914), both criminal penalties (Article 16 & 17) and civil sanctions (Article 18) are provided for.

(c) With regard to Codes Of Ethics

It is not unusual for the operation of certain business sectors to be governed by Codes of Ethics. In these Codes, we often encounter a number of provisions regarding the obligation to ensure confidential data as well as sanctions in case of breach. (Indicatively: Code of Greek Pharmaceutical Conduct – provisions of articles 26-chapter A and 4 of chapter C)

Penalties on Breach of Confidentiality: Legal, Business And Not Only …

In general, in view of the above, one could say that the obligation to preserve confidentiality directly or indirectly is supported in almost the whole range of law (e.g. civil, criminal, administrative). More specific provisions of the existing institutional framework and of the contractual relationships that have arisen in the course of the negotiations, specify both this obligation and the many consequences of its breach.

The penalties provided envisaged relate to offenders-natural persons and, sometimes, the directly or indirectly involved companies: those who did not do the appropriate to protect those affected as well as those who urged the offenders into their unlawful actions.

Thus, the sanctions are not only legal:

The persons who violate this obligation they also suffer the corresponding personal and professional demerit.

However, in the case of companies where the offenders were employed, the consequences are sometimes unbearable: For how long can a company operate when data, personal data (or even worse sensitive personal data) of its customers are loaded into the Internet? For how long can a company operate when its critical business secrets (whether it’s recipes or clientele, or production or marketing methods or whatever) are diffused to its competitors?

Necessity Of Compliance And Consequences Of Non-Application Of Confidentiality – The Role Of The Legal Advisor

Storing and disseminating information (also at business level) is an element of everyday life-one that does not seem to be differentiated from vital, human, functions..

Safeguarding the integrity and confidentiality of information, notwithstanding the avoidance of the aforementioned sanctions, ensures the existence of high professional standards (in particular) for the companies concerned. This fact, inevitably, is reflected in its existence and development, in its relations with its customers and suppliers. It is reflected into the shareholders, the employees, the associates and their families.

There is no doubt that securing confidentiality is an obligation of all those who are directly or indirectly involved in operating a company. However, the responsibility of the legal advisor is a little more special as he/she has the burden of: (a) informing the parties involved; (b) creating a coherent grid of contractual and other regulations, dissuasive to be breached; and (c) managing the critical situation created in the case of violation of any kind of confidential information.

It is also not of a minor importance that your Legal Advisor’s involvement in Cyber Risk issues is already covered by Directive 2016/1148 on Measures for a High Level of Network and Information Security for Networks across the Union ( Network and Information Security Directive 2016/1148 – also known as NIS) – but for this issue, there shall be a specialized screening and filing on the same site.

The Challenge (By Way Of Conclusion)

In any case, it is more than obvious that securing confidentiality is one of the challenges of today’s business. It is up to us, the directly and indirectly involved (us Legal Advisors in particular), to assist and respond positively to this challenge by providing our own small contribution to what everybody desires, that is to secure and develop healthy entrepreneurship.

Stavros Koumentakis
Senior Partner
[/vc_column_text][/vc_column][/vc_row]
December 17, 2017

This site is registered on wpml.org as a development site. Switch to a production site key to remove this banner.