The legal issues with external innovation: intellectual property, data privacy and cybersecurity

Interview with Filip Van Elsen (Partner at Allen & Overy) and Peter Van Dyck (Senior associate at Allen & Overy)
Statements reported by Marion Dupire, Vlerick Centre for Financial Services

From you point of view how do you see that ‘external innovation’ phenomenon happening in the financial sector?

Peter Van Dyck: “As technology lawyers, we are increasingly advising clients on new digital trends. Banking and insurance are heavily impacted. We see similar trends in other sectors such as healthcare in particular, and we observe a number of legal regulatory opportunities that are similar across different sectors.

Collaboration between FinTech firms and large financial institutions is a topic that raises both legal and non-legal issues. On the legal side, big banks and small players come from very different backgrounds, have completely different risk profiles and give different levels of attention to compliance. Big banks often have an important legal department and are well aware of regulatory evolutions while smaller players are much less risk averse and less aware of legal restrictions. That creates difficulties to find a collaboration agreement where the compliance effort should be equally split between the two parties.

On the non-legal part, one important issue is the cultural clash. Banks are often highly hierarchical and this is very relevant for financial institutions given the importance of compliance. Small players have quicker processes, they do not always understand why things take so long with financial players. Therefore we often see a cultural clash between the financial institutions that are very compliance-driven on the one hand and on the other hand FinTech companies who are happy to take risk and move very quickly.”

Filip Van Elsen: “I see two other important challenges also at play. Banks are indeed extremely complicated and often stuck with heavy legacy systems. First many banks did not invest in building new IT systems in the right time, and after the financial crisis there were no money left to invest in new systems. Secondly banks have grown aggressively through acquisitions and IT systems are often not integrated.

On the marketplace companies like Google, Alibaba, Apple and others do not have legacy problems, are more flexible and less regulated. These players enter the area of mobile payments for instance. It is not clear whether banks will adapt to the same way of working, or start acquiring technology companies.

In this context a phenomenon that emerges is open innovation. Banks like Barclays or ING are opening their offices to start-up companies to let them develop new financial technologies. The idea is to openly share ideas hoping that new technologies will be developed. That raises a lot of Intellectual Property (IP) issues, especially with respect to who will own the newly generated data as well as the new technology itself.”

With respect to the question of who will own the data, what is the current situation and how do you see it evolving in the future?

Filip Van Elsen: “It is a complicated debate because there are different types of IP rights. For a bank entering into a collaboration agreement with a software company, it is crucial to clearly define the ownership rights and the license rights of each party. Secondly, in order to be able to allocate IP rights, the contribution of each party must be very clear: what is the financial institution bringing to the table? Is it technology? Is it people? Is it access to customers? And what is the contribution of the technology company? It is very important in such a collaboration project to clearly define the contribution of each party and then allocate the IP rights. A license generally works well because it does not require to transfer ownership, the bank works with a license and the technology firm continues to improve and develop its own technologies.”

Peter Van Dyck: “Where it gets tricky is when it is difficult to differentiate the contribution of each party. And it is often the case in the context of open innovation where they develop something together without a clear distinction of who did what. Parties often simply state that the developed technology will be owned jointly. It sounds very nice on paper but in practice that means that each party can veto anything that the other party is doing with the newly developed technology. It is therefore extremely important to state what the collaboration precisely means and what each party can do without the approval of the other party.”

Are there issues of customer privacy in this kind of collaborations?

Peter Van Dyck: “Absolutely. Data protection is another point on top of the IP issues. A lot of these collaborations are very data-driven. With these technologies customer data is key and can come from a variety of sources: from the bank itself, from social media… It is a key consideration to make sure that data protection law is being complied with. There are a couple of ways to actually insure that it is the case. One is to look very clearly at the relevant data restrictions when you design your technology. Very often by designing your technology in a certain way, you can insure that it is compliant. Then in the collaboration agreement, it is extremely important to be clear on who has what role. Data protection law is a restrictive type of law and it is crucial to delineate each party’s responsibility. One party will be qualified as the data controller which means that it will be responsible for complying with most legal obligations, the other party will be qualified as the data processor and has less legal obligations.

Another important legal issue is data security. In the press we saw some banks being attacked by cyber hackers. A certain level of security has to be established while developing new financial technologies, like mobile payments for instance. If you transfer data, you need to make sure that you are doing it in a careful way and that you are protected against hacking. Security is therefore also a very important regulatory issue.”

Do you share the view that FinTech firms have an advantage over big institutions because they less regulated?

Filip Van Elsen: “At the moment, companies like Google are indeed less regulated than traditional banks. Banks are also subject to substantial capital requirements. But this is probably just a temporary situation and we may expect that technology companies offering mobile payment systems will be subject to regulation in the future. Today it is fair to state that technology start-up have a competitive advantage over banks. But -A- they will be subject to regulation as well and –B- I do not think that banks will disappear at the benefit of firms like Google or Alibaba. I think in the future we will see a model where traditional banks will work very closely together with companies like Apple or Google and will be subject to the same set of regulation. The two models will converge in the next couple of years. It is actually happening already, BNP Paribas Fortis entered into a number of strategic partnerships with Google, and I think we will see more of those examples in the near future.”

Peter Van Dyck: “FinTech players are indeed subject to less regulatory requirements because they offer one thing while banks offer a full range of solutions, leading to more legislation. And when small FinTech players extend their offering they become subject to more regulatory requirements. Therefore when FinTech start-ups are growing they start discussing with larger financial players to jointly ensure legal compliance.”

From the side of FinTech companies, what are the benefits to team up with a bigger financial institution?

Filip Van Elsen: “It also brings market access, banks have branches in multiple cities and FinTech companies typically lack the same level of market penetration. The bank therefore can bring proximity to the customer.”

Peter Van Dyck: “Another key point is the access to data. A lot of technology players are very data-driven. Banks have huge amounts of data that tech companies might be interested to work with.”

From your experience what are the keys for such collaborations to be successful? What are the biggest challenges/difficulties?

Filip Van Elsen: “The biggest challenge is the one of culture. The world of banks is totally different from the world of technology companies. One illustration is the divergence of negotiation processes, large companies typically perform a due diligence with a comprehensive check-list on the small company. For the smaller company it takes several days if not weeks to complete the due diligence check-list. The same issue arises with governance for example, the bank will typically pay a lot of importance to governance, setting steering committees, boards… etc. But the people working at tech companies work on designing products rather than sitting in governance boards. Navigating between these cultural differences is extremely important.

And the big challenge for the bank is often that they are not familiar with the way in which a technology company works. Large institutions are familiar with working with heavy back-office functions but that is a completely different world than developing technological systems.”

Peter Van Dyck: “A bank and a small technology player also often have very different risk appetites. Small FinTech players are happy to take risks while bigger banks are more risk averse. This can lead to misunderstandings between both parties because of processes and timing constraints are different. The length of decision-making processes at banks is for example sometimes interpreted as a lack of interest while it is often only a matter of checking all legal risks. As advisers we are acting on both sides and one of our roles is to avoid this kind of cultural clash.”

Would you recommend that banks should change their culture?

Peter Van Dyck: “I do not think that banks should change dramatically their culture. It is important for a financial institution to be open to the implementation of new technologies, but most financial institutions are actually doing it already, they are very much aware that the new technologies will dramatically alter the way in which financial services are being offered. Banks need to become more technology-oriented. I think they are aware of the evolutions but they are not certain of how to handle them simply because they are not technology firms yet. That is an expertise on which they need to build up but I am not sure they need to change their culture.”

Filip Van Elsen: “I also think it is more a matter of adapting. They need to work with new types of partners. The technology companies will also need to adapt to highly regulated financial institutions. They will also adapt to become more process-minded, understand that they need to meet certain requirements in order to successfully collaborate with financial institutions. Therefore I think it is an adapting process on both sides.”

What type of collaboration would you recommend: with another industry? Small innovating start-ups? Digital platform?

Filip Van Elsen: “There are probably different models, it could be acquisition, it could be creating a fund that invests in digital start-ups. Each financial institution needs to figure out which path is the most suitable. It may not be just one or the other, financial institutions often opt for a combination of two models: invite technology companies in an incubator on one side and collaborate with a leading company like Google on the other side.”

Peter Van Dyck: “Indeed collaboration is not always a bank with a small FinTech player, it could also be banks collaborating together to develop something. One example is the technology behind Bitcoin called Blockchain where we see a lot of investment banks collaborating together. The collaboration can also be between different banks.”

Do you believe that technology innovation can also emerge from inside a large financial institution?

Peter Van Dyck: “It can certainly come from within the organization, that is another model. Recently banks have been active in developing mobile payment technologies. In some cases the bank did it together with a partner, in other cases the bank developed it internally. We also see some banks developing their own crowdfunding platforms. So it is totally possible to develop these things internally. Banks should keep in mind all different models and assess which one is more appropriate given the objective they target.”

& Rankings

Equis Association of MBAs AACSB Financial Times