Outsourcing 2019 Guide

1. OUTSOURCING MARKET

   1.1 IT Outsourcing

   The IT outsourcing market in Luxembourg is assessed to be around EUR448 million, which represents 30% of the total ICT services in Luxembourg (worth EUR1.5 billion) and appears to be one of the most common types of outsourcing activities and continues to increase every year.

   Key market developments in IT outsourcing relate to the increasing use of cloud computing infrastructures. The Luxembourg regulatory authority in the financial sector, the CSSF ("Commission de Surveillance du Secteur Financier") released in 2017 a specific Cloud Circular, Circular 17/654, regarding IT outsourcing relying on a cloud computing infrastructure. In light of the release of the revised Guidelines on outsourcing arrangements by the European Banking Authority ("EBA") in February 2019, the Cloud Circular was updated by the CSSF in March 2019 with the release of Circular 19/714. The Guidelines on outsourcing arrangements from the EBA will certainly trigger a change in the CSSF regulations on (non-cloud based) outsourcing.

   Furthermore, a recent survey on IT outsourcing in Luxembourg has shown that not only do IT contracts tend to be implemented for a shorter period of time, usually for a maximum of three years whereas the standard length for these contracts used to be five or seven years, but also that the average contract value of IT outsourcing agreements is decreasing and customers tend to replace single-sourcing contracts with multi-sourcing engagements.

   It should be pointed out that cybersecurity and data protection are major concerns in the context of IT outsourcing. The Luxembourg government issued a National Cybersecurity Strategy in 2012 of which the latest version has been published for the 2018-2020 period.

   1.2 BP Outsourcing

   In connection to the recent increase in outsourcing options permitted in the financial sector, we note that there is an increasing belief in and use of BP outsourcing in this sector. The BP outsourcing is mostly targeted at back-office operations, such as IT.

   1.3 New Technology

   The Luxembourg government launched, in 2014, the Digital Lëtzebuerg programme, aiming to establish Luxembourg as a "smart nation" ready to deal with a digital society. In April 2015, the World Economic Forum awarded Luxembourg the ninth overall ranking in the Global Information Technology Report. In this context, Luxembourg established inter alia a strategic vision for artificial intelligence (AI). It acknowledges the speed at which AI technologies deliver new services and it has been based on Luxembourg's ambitions to become a digital front-runner. AI is considered to be the facilitator between data and society's most valuable products and services. However, especially if AI services rely on personal data, data privacy and cybersecurity are of critical importance and ever increasingly need to be taken into account in the context of outsourcing activities.

   Furthermore, AI could facilitate internal business processes, for example in companies or hospitals. The increasing use of AI by companies can lead to the insourcing of technologies; currently the same services are outsourced. It is part of the Luxembourg's strategic vision to take efforts to connect with relevant AI solutions and to insource technology and service providers from abroad, which already occurs in the context of financial services. In this respect, the CSSF released a white paper at the end of 2018 setting forth the trends of AI in the financial sector and highlighting detected points of attention from a (financial) regulatory perspective.

   In the field of blockchain and smart contracts, especially in the financial and fund sectors, are engaged in proof of concepts, some of them within the relevant professional associations. On a more general note, the Luxembourg State is also actively looking into the matter and examining which use cases can run on blockchain technology. The State has been a driver for the Infrachain project, a State sponsored non-profit organisation including service, consultancy and law firms as well as potential blockchain service clients and which builds a trustworthy infrastructure layer for blockchain applications.

2. REGULATORY AND LEGAL ENVIRONMENT

   2.1 Legal and Regulatory Restrictions on Outsourcing

   There are no rules that specifically relate to outsourcing in a general manner, ie, that apply to any type of outsourcing, irrespective of the sector. That being said, for any type of outsourcing, it is strongly recommended to verify whether:

   outsourcing is likely to lead to a transfer of undertakings pursuant to Article L. 127-1 et seq. of the Luxembourg Labour Code, based on the EU Directive 2001/23/EC of 12 March 2001, and, if so, to contractually allocate the consequences thereof (refer to 5.1 Rules Governing Employee Transfers); outsourcing could constitute illegal lending of workers which is prohibited pursuant to Article L. 133 of the Luxembourg Labour Code (refer to 5.1 Rules Governing Employee Transfers); and/or outsourcing will...