Source: https://iclg.com/practice-areas/outsourcing-laws-and-regulations/germany
Timestamp: 2019-04-20 08:53:25+00:00

Document:
In Germany, there are no national laws specifically regulating outsourcing transactions; however, the following are two exceptions: (a) if the services to be rendered by the supplier are regulated services, e.g. telecommunication services, banking or insurance services, the supplier is subject to the applicable regulatory law as any other service provider in this field; or (b) if the customer services are in a regulated industry, e.g. a bank or an insurance company, regulatory law (§ 25b German Banking Act; § 32 German Insurance Supervision Act) sets out specific requirements for the outsourcing of services (as supplemented by Section AT 09 of the Minimum Requirements for Risk Management in Banks and Financial Services Providers issued by the German Federal Banking Supervisory Authority as its circular 09/2017 as of 27 October 2017, “MaRisk”). Moreover, the German Federal Banking Supervisory Authority (“BaFin”) specified detailed requirements to a bank’s IT environment which the service provider will have to fulfil, in its circular 10/2017 as of 03 November 2017 “Banking Supervisory Requirements to the Information Technology” of banks and financial institutions (“BAIT”).
Outsourcing transactions in the public sector are subject to public procurement law; moreover, specific confidentiality obligations are required to preserve the official secret.
Outsourcing transactions in industries will be subject to the regulatory requirements as referred to in question 1.1 above.
The outsourcing of telecommunication services means that the supplier will be subject to the regulatory regime as any other telecommunication services provider.
With the exceptions mentioned above, outsourcing transactions are not subject to specific regulatory requirements.
If the services to be outsourced include the collection, processing and use of personal data, both the customer and the supplier are required to abide applicable data protection law.
See the answers to questions 1.1 and 1.2.
Pursuant to Art. 3 para. 1 of the EC Regulation No 593/2008 on the law applicable to contractual obligations (Rome I), parties are free to choose the applicable law and German courts will respect and accept such choice of law. There is no legal requirement that an outsourcing transaction must be governed by local law. In German business practice, outsourcing transactions are generally governed by the local law of the customer.
In first generation outsourcing transactions, parties usually enter into (i) a (master) service agreement governing the ongoing rendering of the contracted services including service levels, governance regime, etc., (ii) an asset transfer agreement, (iii) a HR transfer agreement if the supplier takes over the customer’s employees deployed before the effective date to internally provide the services, and (iv) a migration agreement governing the transition and transformation of services.
In a next generation outsourcing transaction, usually assets and employees are no longer transferred so that parties only enter into a (master) service agreement and (if any) a migration agreement.
If the customer is a public or governmental body or otherwise subject to public procurement law and the expected volume of service fees is above applicable thresholds, it has to apply public procurement law.
If the customer is a private entity, for compliance reasons it will also tender the services and select a supplier based on a provider selection process that includes indicative offers, the negotiations results (at least heads of agreement) and the best and final offer of the suppliers on the short list.
Neither national nor local law imposes any maximum or minimum term for an outsourcing contract. Rather, parties are free to agree on a term which they deem fit and appropriate in the individual case.
Neither national nor local law regulates the length of the notice period that is required to terminate an outsourcing contract.
Pursuant to No. 7 lit. (f) of AT 09 MaRisk, parties to an outsourcing agreement in the banking and financial services industry are required to agree on termination rights and notice periods that are “reasonable”, which means that notice periods for the supplier shall be as long as necessary for the bank both to find a succeeding provider (or re-insource the services) and to ensure an uninterrupted migration.
Both input-based charging methods (a specific fee per server, GB RAM capacity, working place, etc.) and output-based charging methods (how many business transactions are to be supported, how many support calls, etc.) and hybrid-methods in between are used. If the services outsourced are highly standardised services, an output-based charging method is generally used, whereas a tailor-made outsourcing solution usually comes along with an input-based charging metric. Extra services and projects ordered by the customer from time-to-time are usually charged on a time and material basis, whereas requests for standardised services (such as IMACs, i.e. installs, moves, adds and changes to IT infrastructure, e.g. desktops, printers, servers and networks) are charged at standard rates per IMAC within certain thresholds. Although outsourcing shall be a method to make the customer’s business more profitable, profit sharing models are almost never used.
Although being a time-consuming and cost-intensive exercise, customers often insist on benchmarking clauses to ensure that the prices payable are still in line with the market price level. The shorter the term of an outsourcing agreement, however, the more uncommon benchmarking clauses are. If benchmarking clauses are used, the customer is generally entitled to lower market prices if determined by the benchmarking service provider, whereas the supplier is not usually entitled to higher market prices.
Although German law does not mandate a specific form, a transfer or lease of movable assets and licences is a purchase or lease agreement which is usually concluded as a written agreement. In most cases, a transfer of licences, as well as the transfer of maintenance and support agreements for assets transferred, requires the consent of the contractual counter-party (i.e. licensor, maintenance service provider).
The transfer of land requires a notarised purchase and transfer agreement and the registration of the change in ownership in the land register. Before a change in ownership of land is entered into the register, the purchaser has to prove that it has paid the real estate transfer tax.
If maintenance and support agreements remain with the customer, it must be ensured that the supplier is nevertheless authorised vis-à-vis the provider to request for support services or initiate tickets on the support hotline.
If the customer draws up its balance sheet pursuant to the IFRS principles, it may happen that although the supplier holds title in specific assets, those assets cannot be balanced for the customer; these consequences must of course be clarified before the asset transfer transaction, it is a post-completion matter to ensure a correct balancing of the assets is transferred and used for the provision of the outsourced services.
For a transfer of movable assets and licences, no registration is required under German law. Only the transfer of land must be registered with the land registry.
Pursuant to § 613a German Civil Code, if a business or part of a business passes to another owner by legal transaction (“Transfer of Undertaking”), the acquirer succeeds to the rights and duties under the employment relationships existing at the time of transfer.
The term “Transfer of Undertaking” is interpreted in constantly changing national and European case law. The key issue is whether an undertaking (i.e. the transferred business) continues as a going concern retaining its identity. A transfer of assets on its own will not qualify as a transfer of undertaking. Rather, the same or similar activities must be carried out by the supplier after the closing of the transaction as in the business run by the transferor before the transaction. No transfer of undertaking takes place, though, if only the function (and nothing else) is continued by the supplier.
When assessing a given case, the following factors must be taken into consideration: branch of industry; type of the given business; transfer of its tangible and/or intangible assets; and whether the majority of employees are to be taken over. Depending on the branch of industry (manufacturing or service sector), the said factors are weighed differently. Therefore, in the case of the service sector, a hardware transfer is less relevant than in manufacturing businesses; here, the staff and the customer base are of much greater importance.
During the provider selection phase, due to data protection restrictions, the customer is not allowed to provide bidders with personal data relating to identified employees. Rather, only statistical employee data can be provided, e.g. the number of employees affected, their remuneration scheme, applicable pension schemes, applicable collective labour and/or bargaining agreements, any other benefits, employees’ qualifications and experiences, their current jobs, etc. That is, any information the potential supplier may need to reasonably estimate the costs that it will incur due to the succeeding of the undertaking should be provided. As soon as the supplier has been finally selected, individualised personal data may be provided.
Pursuant to § 613a para. 4 German Civil Code, the dismissal of an employee by the previous employer or by the succeeding supplier due to the transfer of undertaking is null and void. The right to terminate the employment relationship for other reasons, however, remains unaffected.
Pursuant to § 613a para. 1 second to fourth sentence German Civil Code, if these rights and duties are governed by the legal provisions of a collective labour agreement or by a bargaining agreement, they become part of the employment relationship between the acquiring supplier and the employee and may not be changed to the disadvantage of the employee before the end of one year after the date of transfer. Prior to the expiry of the one-year period, the rights and duties may be changed if the collective labour agreement or the bargaining agreement no longer applies or, where it is not the case that both parties are bound by a collective labour agreement in the scope of applicability of another collective labour agreement, the application of that collective labour agreement is agreed between the succeeding supplier and the employee. This does not apply if the rights and duties with the succeeding supplier are governed by the legal provisions of another collective labour agreement or by another bargaining agreement. Anyhow, the harmonisation of employment terms of a transferring employee will regularly be treated as a dismissal with the option of altered conditions of employment, so that the supplier will have to comply with the protective rules against dismissal as for any other dismissal.
If the transfer of undertaking regime (§ 613a German Civil Code) applies, the supplier succeeding to the outsourced business also succeeds to the rights and duties under any pension arrangement. Depending on what kind of pension scheme existed for the customer, parties will have to make arrangements to ensure that the supplier is in a position to completely fulfil the employer’s obligations under such pension schemes. This may mean that, e.g., funds accrued to finance pension schemes for the employees transferred have to be calculated by an actuary service provider and transferred to the supplier.
An offshore outsourcing transaction will most likely mean that the legal concept of transfer of undertaking will not apply so that the specific job protection under § 613a para. 4 German Civil Code (cf. question 7.4 above) will neither apply. The customer, however, will have to obey the general job protection rules under the German Employment Protection Act, so that the customer will have to assess on a case-by-case basis whether a dismissal is possible or whether he should make arrangements as to how to otherwise deploy these employees or how to incentivise their phasing out.
The outsourcing solution agreed will have to be analysed and it will be decided whether personal data will be processed and used by the supplier at all; and if so, whether the supplier’s role is that of a data processor commissioned by the customer or whether the supplier qualifies as the controller. Depending on the supplier’s role and from which location it will provide its services, contractually either a data processing agreement pursuant to Art. 28 para. 3 GDPR or a specific agreement reflecting data subjects’ specific interests in the transfer of personal data by the controller to the service provider is to be set up which may support the weighing of interests pursuant to Art. 6 para. 1 lit. (f) GDPR in legitimising the transfer of personal data to the service provider. Alternatively, if the supplier is located outside the EU/EEA, corresponding agreements on the basis of the applicable EU model clauses or business codes of conduct approved by the competent supervisory authority or the Board (Art. 40 et seq. GDPR) should be set up, and should be combined with additional arrangements covering the data subjects’ reasonable interests. In any event, parties should agree on the technical and organisational measures to be taken by the supplier to protect personal data form unauthorised access and to ensure their integrity and availability. In this context, data security-related clauses are to be agreed.
If the customer is in a regulated industry, e.g. a bank or an insurance company, regulatory law will require specific data security-related obligations of the supplier. If the outsourcing customer operates critical infrastructures (organisational and physical structures and facilities of such vital importance to the society and economy that their failure or degradation would result in sustained supply shortages, significant disruption of public safety and security, or other dramatic consequences), e.g. utility services pursuant to Art. 2 and 3 of the German Regulation on Critical Infrastructures (“KritisVO”) or specific banking and financial services as defined in Art. 7 of the KritisVO, it will be subject to the German IT Security Act (“ITSA”); if the outsourcing transaction is relevant for the customer’s obligations under the ITSA, parties will have to contractually ensure that the customer is able to fulfil its obligations under the ITSA. Since 6 July 2016, the Network and Information Security (“NIS”) Directive 2016/1148 has been in effect and has been transformed by the German legislator into national law with the German Act to transfer the NIS Directive to Ensure a High Degree of Network and Information Security (“NIS Transferring Act”) of 29 June 2017 by which additional rights and obligations were granted to and/or imposed on the German federal Information Security Agency. Parties to an outsourcing transaction in Germany should diligently peruse the NIS Transferring Act to identify whether and, to what extent, the NIS Transferring Act has any impact on the intended transaction.
Whilst an outsourcing transaction by an acquisition of shares in a group-internal service provider by a supplier happens very rarely, the customer typically sells and the supplier acquires the assets of the outsourced business. The supplier is then in a position to linearly depreciate the assets acquired for their remaining lifecycle. The sale and transfer of the outsourced business usually is a VATable transaction with a VAT rate of 19%. If, however, the outsourced business is the complete or the material part of the business (e.g. if the business is carved out from a group-internal service supplier), the sale and transfer of the outsourced business may be free of VAT. As the supplier is usually entitled to deduction of input tax, the VAT-burden is of temporary relevance for the supplier’s liquidity only.
In next-generation outsourcing transactions, significant VAT-related issues can arise if assets located in a foreign country are sold to the succeeding supplier.
The purchase price will usually be based on the book value of the assets transferred which may cause problems if the market value is already beyond the book value due to the fast progress of technology which reduces the market value of assets faster than the linear depreciation.
The same issues arise upon termination and re-transfer of the outsourced business either to the customer or to a succeeding supplier.
VAT leakage may arise if the supplier uses subcontractors in other countries where the service fees invoiced to the supplier as the main contractor are VATable whereas the main contractor itself is not entitled to the deduction of input tax.
Also, if the customer itself is not entitled to the deduction of input tax (e.g. in German banks or insurance companies), the supplier is obliged to invoice VAT in addition to the net service fees agreed in which the VAT amounts payable to the supplier mean additional costs.
If the supplier is located outside Germany, under §§ 49, 50 German Income Tax Act, specific categories of income are taxable at source meaning that the customer will be obliged to pay the income tax although owed by the foreign supplier. This tax burden may have a significant influence on the customer’s business case.
If the parties agree on an e-invoicing process, German tax authorities accept electronic invoices as long as the customer ensures they originated from the supplier, their integrity and their readability. Therefore, the customer will have to set up internal processes to control and monitor that electronic invoices received are collected and archived in a non-editable electronic format and are controlled in the same manner as paper-based invoices. Document retention requirements apply to invoices received from the supplier regardless of whether they were issued electronically or are paper-based.
Parties are often not aware that the definition of effectively enforceable service levels requires detailed rules in the contract. In the contract, the required quality level of a service is to be defined, as well as to which service exactly the defined service level shall apply, and which cooperation services the customer has to provide. Measuring methods, measuring points, measuring metrics, as well as typical exceptional situations which shall leave the service level unaffected (such as planned outages for maintenance reasons, etc.), are also to be defined.
Often parties agree on “penalties” without knowing the legal background. “Penalties”, within the meaning of §§ 340, 341 German Civil Code, mean an obligation to pay an agreed amount of money in the case of non- or mal-performance without the customer being required to establish the damages incurred. If, however, the customer is able to establish damages exceeding the penalty amount, they will also be entitled to such exceeding damages (within the framework of the general limitation of liability). If parties, however, mean liquidated damages when speaking of “penalties”, in the event of the supplier’s non- or mal-performance, the customer will only be entitled to the payment agreed but not to any exceeding damages.
Parties are often reluctant to establish a system of service credits which increase the more and/or the longer the supplier failed to fulfil the agreed service level. An extreme failure to meet the agreed service level may be a “good reason” which entitles the customer to terminate the outsourcing agreement for cause.
As an outsourcing transaction is a long-term contractual arrangement, pro-active remedies may help the parties to become aware of critical situations to be resolved before legal remedies may apply. Such pro-active remedies may be detailed monitoring and reporting processes with regular review meetings, root-cause analyses of service level failure, monitoring of remedy processes, internal escalations, etc.
Typical warranties and/or indemnities can include service level agreements, a warranty for defective deliverables, a warranty for poor performance in services rendered (making up leeway, if possible; otherwise damage claims), a warranty that services rendered and deliverables provided are free of third party intellectual property rights with corresponding indemnifications, compliance of services rendered with applicable law and regulatory requirements, and warranties regarding claims raised by employees transferred.
each in a minimum amount per occurrence and per year.
Usually, parties agree on a fixed term during which no ordinary termination is possible.
To allow the customer more flexibility, parties can agree on the right of the customer to terminate the agreement in whole or in part for convenience which, however, is linked to the terminating customer’s obligation to pay a residual compensation (the amount of which depends on the duration of the remaining term of the terminated agreement).
By agreeing on a fixed term, parties implicitly agree on the exclusion of ordinary termination rights during the term. Parties are free even to exclude ordinary termination rights, but for a maximum of 20 years without any ordinary termination rights. Each party’s right to terminate the agreement for cause must always remain unaffected since this termination right is mandatory under German law (§ 314 German Civil Code).
Intellectual property rights of each party are protected to the extent that is provided for by statutory law. If and to the extent that the supplier needs the right to use intellectual property rights of the customer, a non-exclusive, a non-transferrable, non-sub-licensable right to use the subject of such intellectual property rights for the term of the outsourcing agreement and for the purposes of fulfilling its contractual obligations only is granted to the supplier. To this extent the customer will have to indemnify and hold the supplier harmless from any third party infringement claims.
If, and to the extent that, the supplier provides any development or other services under which new intellectual property rights arise, parties will have to agree which party shall become either the owner of such intellectual property rights or – to the extent an assignment of the intellectual property right itself should not be possible under applicable law – become the holder of exclusive (perpetual or for the term of the outsourcing agreement) licence rights. If software or other copyrightable pieces of work are developed, parties will have to agree on whether the other party is entitled to change, modify or amend the software and to the extent that it should also be made available to the source code of the respective software.
Know-how, trade secrets and other business critical confidential information is protected under §§ 17, 18 German Unfair Competition Act against unauthorised use or disclosure to a third party. The German legislator will have to transfer the EU directive on the protection of undisclosed know-how and business information against unlawful acquisition, use and disclosure as adopted by the EU council on 27 May 2016 by May 2018. On 17 April 2018, the German Ministry of Justice released a bill proposal regarding the transposition of the directive (EU) 2016/943 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure. Germany will therefore not meet the deadline as set out in the Directive (May 2018) for completing the transposition of the Directive into national law. Pursuant to the bill proposal, the proposed new German Act shall replace the actual legal provisions under §§ 17 and 18 German Unfair Competition Act, so that additional statutory law protecting know-how, trade secrets and business critical confidential information can be expected.
If parties agreed in the outsourcing agreement that any licence is granted to the supplier for the term of the outsourcing agreement only, it expires upon termination of the outsourcing agreement, and there are no implied rights for the supplier to continue to use licensed IP rights post-termination.
There is no statutory law in Germany under which the customer is entitled to gain access to the supplier’s know-how post-termination. Rather, within the exit management-related clauses of an outsourcing agreement, parties usually agree on a restriction that the customer may make use of the supplier’s know-how post-termination for migration-purposes only. Suppliers are usually not ready to disclose their general know-how to any succeeding supplier beyond any customer-specific know-how and information.
Under German law, a party’s liability for wilful intent, for guarantees (regardless of any default) granted and the supplier’s liability under the Product Liability Act can neither be excluded nor limited.
If the outsourcing agreement is a standard agreement, i.e. was pre-formulated for more than two contracts and is not individually negotiated thereafter between the parties, it will qualify as general terms and conditions, even if used in a B2B context. This means that the liability of the party who uses such pre-formulated standard agreements for gross negligence and for ordinary negligence in the performance of material contractual obligations can neither be excluded nor limited beyond the level of typical and foreseeable damages. Moreover, in such standard agreements a party’s liability for personal injury and death can neither be excluded, nor limited. Outsourcing agreements, however, are usually individually negotiated agreements so that specific restrictions for standard agreements will not apply.
If the outsourcing agreement does not qualify as a standard agreement (as defined in question 15.1 above), parties are free to agree a financial cap on liability for ordinary (slight) and even gross negligence. Only limitations of liability for wilful intent, under the German Product Liability Act and for guarantees (liability without default) will be null and void.
As outsourcing transactions usually are highly complex transactions which require a specific industry-related know-how, litigation before ordinary courts is not always the method of choice. Rather, parties agree on alternative dispute resolution such as arbitration, mediation or reconciliation. If the parties agree on arbitration, they may agree on arbitration proceedings before the ICC or under the rules of the German Institution for Arbitration (Deutsche Institution für Schiedsgerichtswesen e.V.).
Under § 242 German Civil Code, a general obligation to perform according to the requirements of good faith is set forth, taking customary practice into consideration. Broad and long-term case law derives the specific legal consequences from this overriding requirement. In many outsourcing agreements, parties, nevertheless, agree on the requirement of “partnerial behaviour” with which they also mean that they should act in good faith, fairly and in consideration of the other party’s reasonable interests. In view of the requirement under § 242 German Civil Code, a “partnerial behaviour” clause is more of a moral appeal than an enforceable contractual obligation.

References: § 32
 Art. 3
 § 613
 § 613
 § 613
 § 613
 Art. 28
 Art. 6
 Art. 2
 Art. 7
 § 242
 § 242