On the GC Grapevine - Austria - Edition 1

ALSO IN THIS ISSUE: Dr. Klaus Steinmaurer Vice-President Legal T-Mobile Austria GmbH Jarkko Airamaa Senior Legal Counsel Nokia Austria GmbH

Dr. Georg Kresbach Wolf Theiss

Dr. Axel Anderl, LLM Dorda Brugger Jordis

This Issue’s Grapevine Pick Dr. Armin Toifl - General Counsel - Siemens AG Austria

LETTER FROM THE EDITORS: 3 Introducing the GC Grapevine - Austria

INTERVIEWS: 4 Interview with Dr. Armin Toifl, Head of Legal, Siemens AG Austria 6 Interview with Dr. Klaus Steinmaurer, Vice-President Legal, T-Mobile Austria GmbH 9 Interview with Jarkko Airamaa, Senior Legal Counsel, Nokia Austria GmbH

IMPACTING THE MARKET: 10 Mandatory Data Security Breach Notification 11 Advertorials – Forbidden (Sweet) Fruits

ISSUE 1 VOL 1 DEC 2011

INTRODUCING THE GC GRAPEVINE - AUSTRIA We are all very pleased

to present to you the inaugural Austria Edition of the GC Grapevine, and we are excited for the opportunity to provide such a unique forum for the discussion and debate of the most important and salient legal topics affecting the Austrian marketplace.

Organizing this publication has been a decidedly collaborative effort, and we truly appreciate the overwhelming support and contributions we have received from so many in the Austrian legal community. While the GC Grapevine has been designed primarily with Corporate General Counsel in mind, it is our sincerest hope that our newsletter will also provide an invaluable resource for all Austrian lawyers who possess a keen interest in the myriad legal issues and challenges facing Austrian business today.

The goals of the GC Grapevine are multifold.

Not only do we seek to offer our readers a unique opportunity to gain valuable insight from the brightest legal minds in Austria, but we also hope our newsletter will serve as a catalyst to forge new bonds between legal practitioners working within the Austrian business community as a whole. We are thus deeply committed to presenting only the most relevant and groundbreaking legal issues of the day, and we always welcome ongoing feedback from our readers on how we can improve this publication. Thus, the comments and suggestions we receive from our esteemed readers will be instrumental in helping us to create a highly anticipated and valued newsletter for Austria’s business minded legal practitioners.

We plan to publish the GCG 4 times annually, and we will cover such diverse industry sectors as Energy, Banking & Finance, Corporate M&A and Pharmaceutical. Aside from our exclusive interviews with some of the most notable General Counsel working in Austria, our publication will also include a Private Practice Strip, The Grapevine Pick, (My) Word on the Grapevine and other interesting features, all intended to engage out readers from both private practices as well as the in-house world.

Here is a breakdown of the multiple ways to get involved and be a part of this exciting project: The Private Practice Strip will offer firms the chance to make brief announcements to share recent successes with the GC comunity in Austria.

The Grapevine Pick will offer all our readers the opportunity to recommend who should be interviewed for the next edition. If you would like to learn best practices and market insights from a key expert in the industry, write to us at GCG@hudson.com and recommend the next Grapevine Pick.

(My) Word on the Grapevine will provide for a platform for our readers to make their voices heard directly. Feedback, replies, comments and additional information that our readers wish to share with the rest of the community can be submitted to our editorial team and be published.

Our first edition covers themes uniquely relevant to the Technology, Media and Telecommunications industries, and we are honored by the excellent contributions from a number of the most respected and influential General Counsel and Private Practice lawyers working in the rapidly evolving TMT sector today. The TMT arena has been particularly dynamic and innovative in recent years, and with the excellent interviews and articles found within these pages we are confident your time with us will be well spent.

So, without further delay, we are delighted to present the GC Grapevine, Austria Edition!

Ronald Stevens Principal Consultant - Austria Hudson Legal Imran Khan Operations Manager - Emerging Europe and Latin America Hudson Legal Radu Cotarcea Marketing Manager - Emerging Europe and Latin America Hudson Legal

Page 3

days.

HL: What do you think are the characteristics of a strong GC?

“An in-house lawyer has to follow the dynamics and requirements of the business he or she works in.”

HL: Many PP lawyers tend to think that in-house lawyers drop their pens at 5pm. In reality what is life as a GC like?

AT: The General Counsel should gain the trust and acceptance of the CEO and of the other board members. The GC should not only mitigate the risks of the company/organization, but should also capture opportunities by utilizing the options the law provides, and should further (last but not least!) protect the reputation of the company/ organization to maintain integrity.

Compliance is one of the most dynamic and developing areas a GC has to take care of (in cooperation with a Compliance Dept/Officer where one is available within the organizational structure).

In contrast, PP lawyers constantly suffer workload peaks since they have more than one demanding client, and their weeks can stretch over six or even six-and-a-half

Page 4

GC, in addition to legal aspects, has to be able to understand the business, financials, strategies and basics of the major technologies incorporated in the company’s products and services.

“...my recipe for prioritization is:“Customer first!”.We shouldn’t forget that ultimately it is the customer who pays our salary.”

The formerly widespread understanding of a mere service provider who only responds in complex legal memos when being asked, for quite some time no longer meets the expectations of

DLA Piper advised austriamicrosystems AG on USD 320M (EUR 220M) acquisition of Texas Advanced Optoelectronic Solutions, Inc.

the modern GC. The GC has to be a pro-active legal manager taking care of the company with a legal focus, just like the CFO does with a financial focus.

DLA Piper Weiss-Tessbach advised the HL:The GC position has many facets to it. What aspect do you find most challenging and what is your secret in overcoming it?

AT: One challenge, of course, is time-management. All those organizational and internal requirements take time and energy. When it becomes really hard and you feel yourself becoming overwhelmed by a tsunami of tasks, my recipe for prioritization is: “Customer first!”. We shouldn’t forget that ultimately it is the customer who pays our salary.

“The reward is trust in and respect for my work AT: An in-house lawyer has In order to be accepted as a partner to follow the dynamics and and an advisor to the CEO, the and the work of my team.“ requirements of the business he or she works in. In an international business, this means we have to cope with time zones, bid and project needs, M&A, and other issues which lead to frequent workload peaks. The rare working day that ends at 5pm is something special and causes a bit of holidaylike feeling. The good thing is that working time generally spans Monday through Friday, while weekends are more or less for personal time.

DLA Piper Weiss-Tessbach

HL: What inspires you as a lawyer?

AT: What inspires me is the ability to analyze situations and find answers to those situations on the basis of the law. It is the perfect basis for the lawyer’s contribution to the business. As the General Counsel, I might involve myself in the business’s decisions and be part of it. On the other side of the equation, such involvement triggers co-accountability for joint business decisions and judgments, and I must be willing to bear my share therein. Furthermore, the deep and wide insight into business and legislations in other

Austrian technology company austriamicrosystems AG on the acquisition of Texas Advanced Optoelectronic Solutions, Inc. (“TAOS”), a global leading provider of light-sensor solutions.

This included all aspects of the transaction concerning Austrian law, from the structuring and implementation of the acquisition to the financing of the transaction.

DLA Piper advised Telelink on acquisition of majority stake in Austrian Datentechnik GmbH DLA Piper Weiss-Tessbach advised Netherlands based Telelink Holdings BV, a leading company for system integration in CEE, on the acquisition of 51% of the shares in the Austrian IT service provider Datentechnik GmbH. Datentechnik GmbH was founded 40 years ago and is a leading Austrian system integrator of business solutions in the field of information- and communication technology.

Skadden, Arps, Slate, Meagher & Flom Skadden supporting IPO on the Hong Kong Stock Exchange Skadden is representing the Chinese owner of an Austrian industrial group in the contemplated IPO of its shares on the Main Board of the Hong Kong Stock Exchange. This is the first time that an Austrian owned business is trying the Hong Kong market. (Skadden Vienna and Hong Kong)

The Private Practice Strip

Dr. Armin Toifl - General Counsel - Siemens AG Austria

The Private Practice Strip

Skadden succesfully represents the Slovak Republic in an investment treaty arbitration

so long and well developed as it is e.g. in Austria, Germany or UK. Transitioning from working with Skadden has secured the dismissal of former Soviet Union legal systems a EUR 1 billion claim brought against to European legal systems makes the Slovak Republic by Dutch invesit hard for lawyers to navigate tor HICEE B.V. This is the largest ever through a scarcely predictable dispute brought against the Slovak environment in order to find the Republic. The claim was dismissed in right answers to legal issues. In its entirety as the tribunal accepted just a few years, a large volume of Skadden’s argument, that the Dutchchanges was implemented in those Slovak BIT is not applicable to the countries, changes which Austrian investment by claimant. This success lawyers could take centuries to on behalf of the Slovak Republic digest. continues Skadden’s record of never having lost an investment treaty arbitration. (Vienna and London offices)

countries, the business culture in those countries, and the fight for the benefit of the company (e.g. in negotiations or disputes) all inspire me a lot. The reward is trust in and respect for my work and the work of my team.

“In just a few years, a large volume of changes was implemented in those countries, changes which Austrian lawyers could take centuries to digest.”

HL: Since you are responsible for the CEE region, which market is the most challenging and why?

AT: Apologies in advance for the diplomatic answer: Each CEE country has its particular challenges.

I have great respect for colleagues in my teams in those countries where the legal environment is not

HL: What do you look for when you choose a law firm to work with?

AT: I look for the best-tailored support for the particular case.

This may relate to aspects like specialization, experience in the respective industry, reputation, available capacity, and of course, cost. In most cases, a lack of time does not allow for a case-related “beauty contest.” Therefore, it is important to establish and maintain a panel of law firms for various not too remote cases so that selection can be made quickly.

HL: How did you become involved in the TMT industry?

AT: I have spent almost my entire professional in-house in an industry branch, the majority being in the business of international plant building projects in the Iron & Steel industry and related

M&A and dispute resolutions. It involved the heavy industry and the company was working on large projects all over the globe. Within the last three-and-a-half years at Siemens I have become involved in other industry branches, including TMT. In recent years I have very much appreciated having specialist lawyers on my team with lots of international experience in this very demanding industry branch.

“Rapid technical developments require new risk analysis. Such technical risks have to be understood by the lawyer and reflected in industry-adequate contracts” HL: The TMT industry, as we know, is continually changing.What are the direct implications of this change for a GC? AT: The TMT business is, as you said, characterized by fast developments and for a lawyer this means time pressure in all bidding situations and lots of IP aspects. Furthermore, the knowledge of the lawyer about sales structures, customers, and technologies needs to keep up with that same pace. Rapid technical developments require new risk analysis. Such technical risks have to be understood by the lawyer and reflected in industryadequate contracts (e.g. in respect of liquidated damages).

HL:What are the main trends or “hot-topics” influencing your work at the moment?

AT: As I mentioned earlier, compliance is currently the hottest topic, fascinating and very dynamic. In my view, compliance is only partly a legal job; the other parts are communication, psychology, and internal processes.

In this context, operational knowledge and experience in the most sensitive areas of the organization are also of substantial help.

The other trend in CEE is, as earlier discussed, the fast development of legal systems in certain other countries.

HL: What advice would you give to a lawyer who is considering going in-house?

AT: In-house is a very exiting field for a lawyer. You should be open to and interested in lots of commercial, technical, strategic, tax-related, and organizational areas of the business and, despite potential “seductions,” stay within the boundaries of the law!

A couple of years of practice in law firms and - even better - bar qualification is always welcomed by recruiting companies and is an asset in the CV of an applicant.

At the same time, experience in the same industry/sector is also appreciated.

JOIN THIS GENERAL COUNSEL ONLY GROUP ON LINKEDIN TO RECEIVE THE MOST UP-TO-DATE NEWS RELATED TO THE GCG AND TO CONNECT TO OTHER GENERAL COUNSELS EXITED BY THIS PROJECT. (SEARCH FOR “GCG”) Page 5

Dr. Klaus Steinmaurer - Vice-President Legal - T-Mobile Austria GmbH just like other so called overheads, is also under constant budget pressure. A legal department therefore must be able to calculate the value added of its work for the business otherwise it will be scrutinized. From my point of view this part of the GC`s work is the most challenging but also the most interesting.

“A legal department therefore must be able to calculate the value added of its work for the business otherwise it will be scrutinized.”

HL: The GC position has many facets: the lawyer, the advisor, the manager, the negotiator, the business man and so on…what aspect do you now find the most compelling/challenging and how do you overcome it?

KS: In the past years the GC role has changed. In the 90s, it was more focused on the legal advisory function whereas today, from my point of view, the GC has more and more of a central management position. On the one hand you have to manage a team of qualified lawyers to meet the company’s needs, and on the other hand you have to be able and competent to understand and manage the business as a whole.

The first part demands the ability to find the right people to handle the various specific legal issues of your sector and to keep them motivated to do their best. At the same time, the in-house lawyer,

Page 6

The value added that I mentioned depends on the ideas about the business you have and on the creativity as a lawyer to design the legal basis for new business opportunities. Therefore you have to be aware of what is going on and have a strategic view of your business, especially in fast developing sectors such as TMT, a highly regulated and very competitive industry.

To be able to meet these targets you must know your company’s business and the people involved very well. It is necessary to know the technical side of the business as well as the tools of the financial markets to be able to know how to act and/or react. On top of that, you must also have the ability to market your work as an inhouse counsel internally but also externally.

HL: Would you describe for our readers the top 5 characteristics every General Counsel should have?

KS: A General Counsel must fulfill the following: 1) He/She should have a general, hands-on understanding of the business he/she is working in and

not just an academic one. That does not mean the academic skills should not be used, but it is crucial to translate the legal solutions he/ she develops in the language of those he/she is working with.

2) He/She must be a manager who is able to see customer needs.

Internal clients must be treated as customers and the GC must also manage his people to act in this way.

3) He/She must be a risk manager, being able to weight business opportunities against legal risks and then define the best solution from the company’s business point of view.

4) He/She must develop strategic thinking and structured communication.

5) He/She must be open minded and always curious to learn more and also be able to motivate the team to work in the same way.This includes being open to changes and managing changes.

“In most of the cases I am involved even before the board is asked.“ HL: There is a growing trend for GCs to be more and more involved in the Board’s decision making process. Is this the case with T-Mobile?

KS: Yes that is the case. Since so many parts of our business are affected by various regulations, as a GC, I became more and more an integral part of the decision making process. In most of the

cases I am involved even before the board is asked.

At the same time, because of my long experience in the market and my relationship to all of the main stakeholders I am able to support the board in many situations. One issue that lead to my involvement with the board expanding was my role as the Compliance Officer and the Data Protection Officer which became more and more important over the time as regulations became more complex and I am happy to see that over the past two years we (my team and I) got the opportunity to build up a well structured and effective compliance management system.

HL: As a GC you must receive countless proposals from law firms. What are the main selling points for you and, in contrast, what do you not like to see in such proposals?

KS: You are right. But for a decision on who to choose there is a simple rule: Avoid those who want to convince you that they are able to do everything and have experts in every sector. Look at the references and challenge them in the first case. At the end you have a stable external team for all the upcoming cases you will need an external law firm. When you have such an established team monitor it and refresh the one or the other from time to time.

HL: We know you have been with T-Mobile almost from its beginning. How did you become involved in the TMT sector?

KS: My involvement in this sector is a funny story. In 1995 I worked in the construction industry and I had the great luck to learn all the things I mentioned above from a very great and motivating (female) GC who is till today one of my favorite role models. Towards the end of 1995 my company went into insolvency so I started to think about a new job. One Sunday evening I saw a discussion in the TV and heard the business philosophies of the first MD of TMA. I thought this guy has good ideas and so I wrote a letter where I asked if they need a lawyer for the new company - you should know that in 1996 T-Mobile was the first private mobile operator in Austria - and I got the job as an in house lawyer beginning of April 1996. In June I was asked to take the position of General Counsel, a role that I hold to this day.

It must sound boring but was not! When I started I had no idea about the industry but the favorable situation was that there were only a few officials working for the former monopoly or in the ministry who had legal know how and as everything was changing at the time with the market liberalization I had the opportunity to get involved in designing the legal framework for our industry. I was also lucky to have worked for a construction company before because the most important issue for a new expanding mobile telecommunication company in Austria was the building of infrastructure in the whole country. Having a deep understanding of the differences in the local building laws became an important asset for me and my company.

“...networks such as the internet have become the nerves of our daily life and of global business, and as such they are very vulnerable.”

HL: When you talk about the TMT sector as an industry, what really gets your blood flowing? What has kept you in this industry for so many years?

The telecommunication industry stands in a very close relationship with the developments in global economy. In the past years it has been both a driver and a major beneficiary of economic growth. Various international studies reckon that telecoms have expanded at twice the rate of the underlying industries. And it is the ongoing competition in the market which will drive this business further on, although the competition itself will change from the pure infrastructure competition model to a more services-driven competition while existing network capacities will be consolidated.

There are and will be innumerable other innovations which rely on telecommunication services and infrastructure like e-business, e-banking, e-health, e-learning, smart grids and smart metering and so on. But when thinking about all these business opportunities as a lawyer, you also have to think about the risks resulting from this development. Network integrity, data security and privacy are the easy questions that need legal answers. As pointed out before, networks such as the internet have

become the nerves of our daily life and of global business, and as such they are very vulnerable.

This demands critical and creative thinking, as well as constant work to find strategic and legal solutions to secure this system for the future and to make it fit against external attacks. Technological and legal solutions have to go hand in hand.

Aside from that, the progression of the telecom industry from a natural monopoly to a competitively structured industry has been accompanied by intense government scrutiny in the form of regulation. While regulation at the beginning was simply a tool to protect and encourage new players facing the established market power of the former incumbents, it has now changed to a new kind of regulation, one which focuses on price, consumer protection, and data privacy. This shift in focus is one which seems logical if you take these factors into concern. The increasing regulation in favor of the end customer while revenues are shrinking is a challenge that needs to be faced.

Aspects like quickly developing technologies with a high grade of innovation are changing the way that network operators compete.

Instead of competing with only each other, they have now shifted to a new service oriented competition system with big players like Apple and Google.The risk of global development and the challenge of regulation resulting from these developments keep my blood flowing, and they are the reason I stayed in the industry for so long. It was, is, and will always be challenging and interesting for

a business lawyer like me.

“Therefore, it is vital that in-house lawyers have a good understanding of their own company’s business (local as well as international), the technology they use, and the market they service.

That is the USP you have to sell as an in-house lawyer ...”

HL: The TMT sector as we well know is fast paced, ever changing with new innovation reaching us every day. Having said that, how does a GC stay up to date on legal implications that affect his daily work and where does he turn for guidance if needed?

KS: To stay up to date on the daily information flood and the ongoing developments at the EU level is a real challenge. It is of enormous importance to be able to divide important information from the unimportant. To manage this you need a structured approach and a personal information network, one with a close relationship to the business (to know the customer/client needs), to advisors (who give you a defined aggregate information overview), and to the university (to check academic background). All of this information must be compiled into a target-oriented approach, and the target must be output oriented. Therefore, it is vital that in-house lawyers have a good understanding of their own company’s business (local as well

Page 7

as international), the technology they use, and the market they service. That is the USP you have to sell as an in-house lawyer, and the one which gives you the opportunity to influence business decisions. Today, GCs demand that you have a clear plan outlining what needs to be done. Managers do not only ask for legal opportunities, but rather for simple solutions to complex questions. You have to explain the legal point of view, and also give a clear idea of how to handle the proposed solution, including the possible risks involved and an assessment of the outcome. Based on these factors, you have to state what you need to do and think about these actions. To fulfill this demand, you need a structured and up-to-date information base.

Information management is crucial. Information management also means having the necessary information available when it is needed in the most efficient way.

A good understanding of how to use relevant IT tools is a must for being successful as a GC.

auction will indicate if and how the industry will be able to manage future demands and investments, particularly under difficult circumstances because of highly competitive market conditions. To meet your company’s objectives as a GC involved in the company’s strategy, you must also be able to foster relationships with relevant stakeholders and try to explain your view. In short, that means in our industry, where law, regulation and legislation are interlinked, public affairs management is an integral part of a GC`s job.

“From a competition point of view, network sharing seems to be the best solution because it keeps a variety of operators offering different services to the customer while still supporting investment needs.”.

HL: What do you see as the biggest regulatory challenge in Austria for your industry?

HL: The Austrian telecommunications industry is very competitive marked by very low prices. With more and more technologies developing, there is an obvious pressure to make more investments. What are, in your view, the regulatory solutions to alleviating this discrepancy? Would network sharing be a good option?

KS: The upcoming consolidation of the market is one of the biggest challenges for regulation and for the market itself. Additionally, the planned spectrum auction for 2012 is one of the most important issues for our future. It will impact industry development for the next twenty years. The outcome of the

KS: Consolidation is a necessity in overheated markets like the Austrian TC market, but there are two options for consolidation.

One is network sharing, and the other is a merger. From a competition point of view, network sharing seems to be the best solution because it keeps

“...the planned spectrum auction for 2012 is one of the most important issues for our future“

Page 8

a variety of operators offering different services to the customer while still supporting investment needs. This is especially evident in rural regions where it is not interesting for one operator to stand alone to further invest in, for example, new broadband technologies. Together, it might also make sense from a business point of view.

A merger at least means less competition for the customer and therefore fewer offers. Those controlling regulation should think about this and give clear guidance.

On the other hand, a merger demands for more continuous regulation which is good for the regulatory authority because it secures its legitimacy. I can understand this from a subjective point of view, but the question is if such a development is in line with the vision of liberalization prominent in the nineties, when the clear goal was to establish sector specific regulations as an interim solution until the market had solved its existing problems.

HL: Having undergone a merger in the past yourself, what are the main hurdles that a GC has to overcome in such a situation?

KS: In a situation like this, the whole range of skills and management capacities of a GC are demanded. You must be able to give strategic input, analyze the outcome of the merger, manage the risks involved, and be the leading project manager. Being the leading project manager means you must be able to compile all information needed, define the situation, and motivate all people involved in

your organization to contribute to a favorable outcome.

You also have to be diplomatic in order to convince the relevant authorities to heed your advice.

In this type of market situation, there isn’t much difference in the GC’s work; either you are part of the merger, or you are the outstanding competitor who wants to secure the interests of his own company.

HL: What is your favorite technology item: laptop? net book? tablet? Smartphone?

Why? KS: As I have already mentioned, information technology is a crucial part of my job. Since I am involved in many parts of the business, I am constantly moving, but I still need to be accessible. My iPad and my iPhone are the most important tools I use because with those two, I have my office with me no matter where I am. This mobility also gives me the opportunity to combine the demands of my job with my family life, an obligation which far exceeds the 40-hour work week, as I am sure you can imagine.

Jarkko Airamaa - Senior Legal Counsel - Nokia Austria GmbH school. Even though I chose to study law, my working career has always been linked very closely to business, and solid business understanding is very important in my line of work.

HL: What do you think are the characteristics of a good TMT lawyer?

“Since the beginning of my professional career, I have wanted to be as close to business as possible, so an in-house role was a natural fit for me.”

HL: Why did you choose to become an in-house TMT lawyer?

XX: Since the beginning of my professional career, I have wanted to be as close to business as possible, so an in-house role was a natural fit for me. When I got the chance to work for Nokia, there was no doubt that this was what I wanted to do. I like the fast pace of the industry and the fact that, as a company, we need to innovate and reinvent all the time. It sometimes feels like driving a sports car, and who wouldn’t like that?

HL: Is this the career path you had envisioned for yourself at an early age, or did you have aspirations in other areas of business?

XX: I have always been interested in law and business, so I think my biggest decision was whether to go to law school or to business

XX: As I said, business understanding is of the utmost importance, and that naturally applies to all business lawyers. In TMT, I find it extremely interesting that the industry is constantly changing and evolving very fast, which means that it is important for lawyers to learn new things all the time and for them to be able to accept uncertainty.

The mobile industry has changed a lot in the past couple of years, and as a legal team we need to change as well in order to be able to face the new challenges that these changes bring. Nokia Legal & IP is constantly looking into improving how we work in order to be able to better support the business.

HL: Since the telecom industry is a heavily regulated industry, what are the major challenges you have faced and how have you learned to overcome them in Austria?

XX: My role is very focused on supporting our sales organization, so the tele-com’s regulations do not play a bigger role compared to other issues. The region that I am responsible for also consists of 15 countries, so I also have

places other than Austria to worry about.

HL: How do you feel that web-centricity and HTML5 will affect the mobile telecom industry, and what legal implications do you foresee?

XX: As I said, the industry is always evolving and we are working in an area that is in constant change. Nokia is at the forefront of bringing in new offerings for consumers. For lawyers, this fast pace can mean that we sometimes need to work in an area that, from a legal point of view, is not yet regulated and is a bit unknown. I think that this just makes the job even more interesting.

“In my opinion, the first step is to understand what consumers want from mobile banking.”

HL: In your opinion, how does the future of mobile banking look in Europe?

XX: In my opinion, the first step is to understand what consumers want from mobile banking. For example, enabling people to easily transfer money amongst each other clearly resonates with European consumers, but the experience needs to be made easy. For example, people do not know their friends’ bank account details, but they do know their mobile numbers. Today, Nokia is working with banks in India and is operating payment services which enable people to transfer money based on just a phone number;

making the experience simple, easy and all-pervasive. There is no reason why a similar approach would not also work in Europe, but it needs willingness on the part of companies in the ecosystem, such as banks and other financial institutions, for it to work.

HL: Naturally, when handling sensitive information such as banking details, security is always one of the main concerns. However the past has proven that a 100% secure system is close to impossible to set up. What steps would you take as a GC to limit the company’s liability in case of security breaches?

XX: I guess the recent cases that have also caught media attention have shown that this indeed is an ever growing risk. In my view, the important factors for lowering the liability are: first, to have proper processes in place if such a risk materializes, and second, to have the correct means to quickly evaluate the situation and make fast decisions to remedy it. An organization would need to have a ready-made plan for such a case.

HL: How do you communicate effectively with nonlegal colleagues?

XX: I don’t think I have ever really had difficulties communicating with my non-legal colleagues. I think most people in Nokia really value the work we do, and they appreciate what we have to say, which makes communication with them easier.

Page 9

HL: What would you recommend that PP lawyers avoid when making a proposal?

XX: I think the first thing to do is to know the client’s business and how they work. This way, the

PP lawyer can avoid delivering something that the client has not asked for. It is very easy to give advice that is too general for the client’s needs, though I must say that law firms are getting better at this all the time.

HL: As you are originally from Finland, how did you find the adjustment to living in Austria?

XX: It has been quite easy. Vienna is a beautiful city and most things seem to function in a similar

manner to Finland. Sometimes I find it hard to understand the local dialect, but I am improving all the time. All in all, I have really enjoyed my time in Vienna.

Mandatory Data Security Breach Notification

by Dr. Georg Kresbach - Partner at Wolf Theiss Attorneys at Law, Head of Praxis Group IP & IT Advanced Persistent Threats, or APTs). Since no organization can claim to be immune against these threats, preparedness for how to react to security breaches is a must.

Under Austrian law, there are three distinct legal sources for an obligation to notify data security breaches: Due to the rise of new and more advanced cyber security threats, breaches of the security of personal data are becoming more and more common. Traditionally, companies suffering such a breach might not have disclosed any information about the breach for fear of liability or damages to their reputation. However, following an international trend, Austrian law increasingly requires that data security breaches be notified to the individuals concerned.

Today’s cyber security threat landscape isn’t characterized anymore by lone teenagers but rather by groups of sophisticated hacker-activists, criminal organizations, and large corporations or nation states conducting corporate espionage (commonly referred to as

Page 10

The first one is § 24(2a) of the Data Protection Act which went into effect on January 1, 2010.

It requires, under a penalty of EUR 10,000, that data subjects be informed immediately if a company learns that personal data has been “systematically and seriously misused.” Neither the statute itself nor its legislative history provides any guidelines for what is to be considered “systematic” and “serious.” This necessitates a case-by-case determination based on the specific facts of the security breach. However, this notification obligation only exists if the data subjects “may suffer damages.” Thus, Data Protection Act § 24(2a) effectively requires a risk assessment that also takes the specific nature of the compromised data into account.

The second legal source is the new

§ 95a of the Telecommunications Act which was adopted in November 2011 to transpose the recently amended Article 4 of the ePrivacy Directive (2002/58/ EC). It requires providers of publicly available electronic communications services (e.g.

Internet access providers and telecom operators) to immediately inform the Austrian Data Protection Commission of any accidental or unlawful breaches of security affecting personal data. While the Data Protection Commission has to be notified irrespective of whether the data was encrypted, the individuals concerned only have to be notified if the breach will “adversely affect their personal data or privacy.”

Violations of Telecommunications Act § 95a are punishable by a fine of up to EUR 37,000.

The third legal source is contract law: Under the general principles of Austrian contract law, there is an implied contractual duty to protect the other contracting party from harm. Thus, where the notification of a security breach would allow the other party to take reactive measures to mitigate the risk created by the security breach, there is a contractual obligation to perform

such a notification. For example, if passwords are compromised, there is a serious risk that the same passwords will also allow the hackers to gain access to other systems, thereby causing further damages. To protect from these damages, a company would be under the obligation to notify its customers that their passwords have been compromised.

This plurality of obligations to perform data security breach notifications creates a significant amount of legal uncertainty.

However, corporations should recognize this as an opportunity and address the issue of breach notification before a breach occurs.

By determining in advance which obligations apply to the corporation and how these obligations can be fulfilled in practice, the corporation will be much more effective and, ultimately, more successful in any crisis communication efforts in the aftermath of a security breach.

Furthermore, corporations should take the opportunity to more clearly specify and, to some extent, limit their implied contractual notification obligations.

Advertorials – Forbidden (Sweet) Fruits

by Dr. Axel Anderl, LLM - Head of the IT/IP Department of Dorda Brugger Jordis and Mag Ines Sieder, LLM - Senior Associate IT/IP Department is, however, contrary to existing regulations and aim of legislator, to draw a clear line between advertisements and articles to enhance credibility of the specific media and the editorial part.

Legal framework

In the internet and multimedia age, medial publicity is key for companies and institutions. A good PR and public appearance helps to sell images and products alike. This is true for the private sector as well as political parties and government representatives who are concerned when it comes to media appearance and possible influence on public opinion and future voters. The revenues generated for advertisements are a main source of income of website operators, TV and broadcasting companies and publishing houses.

It is thus quite natural that entities aim at maximizing the impact on their media coverage and media companies focus on generating money with advertising practices.

As the content of paid advertising purports less reliability to the public, companies aim at being referred to positively in “normal” editorial articles as part of an “all-in” package including serious payments for advertisement in same publication or in another media of same publisher. Hence, there is a strong tendency to cross the line between paid and editorial parts of publications.This

The Austrian legal system provides for various regulations on strict separation of advertising and editorial content. Such provisions run like a common thread through diverse laws starting from Section 26 Media Act for any kind of media to Section 6 E-Commerce Act for online providers. Besides, Section 13 Para 3 Broadcasting Act, Section 38 Private TV Act or Section 19 Para 3 Private Broadcasting Act include an obligation to identification or delimitation of disguised advertising, respectively. In particular, infringements trigger administrative fines.

Further, the Austrian Supreme Court also derived a general duty to clearly identify advertisements from an unfair competition perspective. If an advertisement is not identifiable or explicitly marked, the addressed public is misled regarding the kind and the reliability of the content.

Thus, competitors may proceed against such practice based on the Unfair Competition Act. Further, most recently also the black list of per se unfair practices based on Directive 2005/29/ EC explicitly interdicts unclearly separated advertisements (see Section 11 of the annex to the Unfair Competition Act): If paid

articles are not explicitly marked, an infringement of the Unfair Competition Act is given per se. Further requirements such as essentiality and perceptibility are dispensable. The long history of regulations and its repeated incorporation into Austrian law, however, already gives an idea about the poor acceptance of said provisions and principle in practice.

Separation duty The Media Act covers both print and online media as well as other kinds of audiovisual media.

Editorial articles for the purpose of sales promotion are contrary to such separation duty if the company paid for such article and the latter does not explicitly refer to this fact unless the public itself is in a position to realize the advertisement without any further need of explanation.

The qualification of “paid content” might be triggered by any kind of consideration. Therefore, any promotional dedication of goods, e.g. provision of a car to the editorial staff by a car producer in the course of a sport event in exchange for a positive report on such car and its usage during the event is cov-ered. Further, the report for the purpose of sales promotion is to be interpreted to a wide extent: Not only positive articles on a certain product, but also such on the company itself, its services in general or key employees are critical as they may be apt to promote sales as well.

Delicate state of evidence In practice it is quite difficult for a third party to prove whether an article has been paid for or not: A positive article itself does not necessarily require that a consideration has been given in return. It might also be the case that the specific editor made positive experiences he intends to share as he might also have published negative comments on same company on a different occasion in the past. The specific trigger for an article – payment or provision of a consideration – is not always clearly visible for plaintiff, who would have to provide respective evidence.

Consequences Not only are the principal (advertising company) of the disguised advertisement responsible under Austrian law, but also the media owner (e.g. website operator or newspaper publisher) if an infringement of the separation duty can be proven. A competitor may claim for omission, also enforceable by injunction.

THE NEXT ISSUE WILL FOCUS ON ENERGY. WE WELCOME OUR READERS TO SEND US FEEDBACK AND SUGGESTIONS TO: GCG@HUDSON.COM

Page 11

We would like to thank those who contributed to this newsletter • Dr. Armin Toifl • Dr. Klaus Steinmaurer • Jarkko Airamaa • Dr. Georg Kresbach • Dr. Axel Anderl, LLM • Mag. Ines Sieder, LLM If you would like to receive a hard copy of this publication please write to us at GCG@hudson.com with “subscribe” in the subject line or follow us on Linkedin (Search for GCG) The editors: Ronald Stevens Principal Consultant - Austria Hudson Legal m: +36 20 530 3066 @: ronald.stevens@hudson.com Imran Khan Operations Manager - Emergin Europe and Latin America Hudson Legal m: +36 20 262 5699 @: imran.khan@hudson.com Radu Cotarcea Marketing Manager - Emerging Europe and Latin America Hudson Legal m: +36 20 969 6410 @: radu.cotarcea@hudson.com http://cee.hudson.com/