Jeroen van Helden

Outsourcing is still hot. A recent study shows that the Dutch IT outsourcing market will continue to grow. Nearly half of the respondents indicate that they will outsource at a higher pace in the next two years. This is currently the highest level in Europe. Plans to insource have halved, from 16% to 8%. The financial services sector predicts the most outsourcing growth: 64% of organizations plan to outsource more. The main reasons for outsourcing are: focusing on core activities, reducing IT costs, and improving IT support. By outsourcing, you can focus on what you are strong at and transfer supporting tasks, such as IT, to parties that are strong in those areas and have scale. Due to that scale, these parties can deliver more quality at lower costs. However, there are also companies that hesitate or want to slow down. This hesitation is understandable. IT outsourcing remains complex, also from a legal perspective.

The roots of modern privacy law lie in the 1970s when it became clear how easily computer systems could store and process large amounts of data. The General Data Protection Regulation (GDPR) is intentionally technology-neutral. New technologies should, in principle, be able to fit within these existing legal frameworks. However, blockchain presents us with challenges. On the one hand, it offers a new and interesting data processing model where individuals have more control over their personal data. On the other hand, some of its unique characteristics seem difficult to reconcile with the core principles of privacy law. My colleague Jeroen van Helden wrote an interesting chapter about this in the KNVI bundle "Multidisciplinary Aspects of Blockchain".

There is hardly any IT project imaginable where personal data is not processed. When personal data is processed, both the controller and the processor are required under Article 28 of the GDPR to draw up a data processing agreement. Compliance with this legal obligation is important, if only because the mere fact that no data processing agreement has been concluded can lead to a fine from the Data Protection Authority. When are you a 'controller' or 'processor' and what requirements are imposed on a data processing agreement?