REMOTE MONITORING AND DATA SECURITY
Many software vendors and equipment support providers require remote access to their software and supported equipment to monitor performance, identify (and possibly diagnose and remedy) troubles, and spot breaches of software licenses. Software vendors may also reserve the right to remotely disable software or equipment features for a variety of reasons, including the customer’s breach of an applicable license or failure to renew a maintenance agreement.
Enterprise customers cannot usually avoid giving vendors remote access, but they may be able to negotiate away the vendors’ right to interfere with their use of the software or equipment, at least for long enough to allow the customer to cure an alleged breach or non-payment.
Giving a third party access to equipment through which a customer transmits confidential and proprietary data raises numerous confidentiality, privacy, and data security issues. A customer who is negotiating an agreement through which a third party will gain access to company data should involve the company’s security or privacy group, as well as the legal department, early in the process.
Taking steps to protect the security of the company’s (and its employees’ and customers’) confidential information is important to all enterprises, but particularly to government agencies; financial institutions subject to the Gramm-Leach-Bliley Act; health care institutions, insurers, and providers subject to the Health Insurance Portability and Accountability Act; and merchants who accept credit or debit cards and are subject to the Payment Card Industry Data Security Standard. These issues are among the most challenging to negotiate and are often among the last to be resolved.
ACCEPTANCE TESTING
Vendors will want to limit the types of equipment that will be subject to acceptance testing, as testing imposes additional obligations on them and delays the due date for final payment. The customer’s IT staff does not have time to test every item of new equipment upon installation, but wants some role in selecting the equipment that the vendor must test after installation and before the equipment is deemed accepted by the customer.
One approach is to agree on a purchase price threshold above which equipment is subject to acceptance testing, and below which the equipment will not be subject to testing unless the customer specifically requests otherwise. SLAs and warranties should be required, of course, but they cannot offset the disruption that may occur if important equipment does not perform as promised.
THIRD-PARTY PRODUCTS
OEMs are eager to sell third-party products to be used in conjunction with their own lines of equipment, but they resist taking responsibility for those products. For example, they may not agree to provide interface specifications for such equipment or may charge the customer for such specifications, even though the customer needs them to combine third-party equipment with the manufacturer’s own products.
OEMs may also disclaim any responsibility for the performance or non-performance of combinations of their equipment with products manufactured by others, even if they sell those third-party products. In addition, such combinations frequently void any indemnification by an OEM for intellectual property infringement claims arising from such combinations -- again, even where the OEM sold the products that the customer combined, leading to the infringement claim.
UNIQUE ISSUES IN RESELLER AGREEMENTS
In addition to creating complications with respect to pricing and discounts, interposing a middleman between the customer and the OEM can lead to operational hurdles for the customer. For example, a customer’s right to cancel or modify orders or to return products will likely be subject to the policies and charges imposed by the OEMs, not the reseller. The agreement between the customer and the reseller seldom articulates those policies and fees, which creates uncertainty. Moreover, the OEM may change its policies and fees without notice to the customer.
Sophisticated large customers may be able to negotiate these matters directly with the manufacturer--in our experience the manufacturers prefer to exclude the reseller from those side discussions or agreements.
Kevin DiLallo is a partner with the Washington-based law firm of Levine, Blaszak, Block & Boothby, LLP (LB3), which specializes in the representation of enterprise users in connection with their procurement of network-related services; before the FCC and other telecom regulatory bodies; and in disputes with service providers. LB3 and its consulting affiliate, TechCaliber, represent scores of large users, including about half the Fortune 100.
