The SAP v. Diageo decision – a realistic approach to indirect access?

by Dentons
Contact

Dentons

Following the high court decision in the case of SAP UK Limited (SAP) v. Diageo Great Britain Ltd (Diageo), routine software arrangements many organisations have in place could become subject to significant additional costs. This article looks at the practical effect of the decision and analyses whether the outcome is realistic in our interconnected world before going on to explain the key impacts for your organisation and steps you need to take now.

Facts

Diageo implemented the mySAP business suite in 2004 and took licences for use of the mySAP ERP (SAP ERP) and SAP Process Integration (SAP PI), a piece of integrator software. SAP ERP was primarily a resource planning tool relating to operations, finance and HR. The licence permitted only "Named Users" to access and use the software, directly or indirectly. Key terminology including "use", "access", "direct" and "indirect" was not defined in the licence.

Some time after the initial mySAP implementation, in 2012, the SAP PI integrator software was used to integrate with two new software applications, one named Connect and another named Gen2 provided by Salesforce, a third party Software as a Service provider. The Connect software was used by customers of Diageo to place orders based on data which was generated in the mySAP Business Suite. The customers previously called Diageo's sales team to establish stock levels and place orders. The sales team would access SAP ERP to obtain data which they would then pass on to the customer over the phone. The Connect software allowed these customers to cut out the call centre by accessing the data via the Connect app. Gen2 was used by (i) business administrators to generate and maintain data; and (ii) sales reps to visit sites and input data in relation to those sites.

SAP claimed these uses were uses of the SAP software requiring a licence and licence fees were therefore applicable. SAP calculated the amount of these fees to be an additional £55 million on top of the circa £50-60 million Diageo had already paid in licence fees.

Key findings and considerations for future licensing

The case focused closely on the wording of the relevant agreement with SAP in conjunction with the technical interactions Diageo had in place between third party applications and the relevant SAP software. Although likely to have limited legal precedent value since the licence was largely on SAP's standard terms, it may well buoy the confidence of software vendors when claiming additional licence fees. The key points for your organisation are:

  1. Indirect access catches more than you may think:

    The term "access" was not defined in the agreement and was found by the court to have its plain and obvious meaning of "acquiring visibility of, or connection to, the mySAP ERP software". The term "indirect" was also not defined but there was some reliance placed on the following wording in the agreement "e.g. via the Internet or by means of a hand-held or third party device or system". Combining the two, Justice O'Farrell determined that the customers using Connect had indirect access to the SAP ERP as the Connect software transmitted to the SAP ERP at each stage of the customer's order through Connect. The data provided was data generated from SAP ERP though not always in real time.

    The sales reps using Gen2 were also found to have indirect access to the SAP software as they input data which was then batched and sent to SAP ERP for further processing. The fact that the data was therefore not accessed in real time did not make a difference to the judge's finding that this was, nevertheless, access. It is unclear therefore where the boundaries lie. If Diageo were to have simply extracted the relevant data from the SAP ERP and emailed this to sales reps or allowed them to access the extracted database through their website, it seems unlikely that this would have constituted indirect access to the SAP ERP but the practical steps are barely distinguishable from the use which actually occurred.

    It is worth noting that the type of interaction taking place between the SAP software and the Connect and Gen2 software was not technically possible at the time the SAP agreement with Diageo was entered into. It was accepted by the judge that the contract could not have envisaged and even less provided for the type of access required (nor indeed did it as, for example, customers of Diageo using the Connect software did not fall under any Named User category in the SAP agreement).

    Going forward:

    In all new licences you enter into, ensure that the concepts of "use", "access", "direct" and "indirect" are all clearly defined and accurately reflect your intentions in terms of what they cover and what charges apply to such use and access. Clarify the wording of the licence (in particular in relation to the licence grant clause and related definitions) to mitigate against future disputes.

  2. Fixed Named User categories may not dictate all fees:

    Access to SAP ERP was only permitted on a Named User basis. The category of Named User which the user fell into dictated the applicable licence fee for that user. On the wording of the agreement, if the type of Named User did not fall into one of the payment categories set out in the schedule, the agreement provided for the fee to simply be determined in accordance with SAP's price list at the time.

    Going forward:

    In all licences you enter into, ensure that the categories of Named User are exhaustive and, where commercially possible, that any use by third parties through an API does not attract a licence fee (or at the least attracts only a very small licence fee per user or a single fee for all such users). This should help prevent disproportionate fees being imposed at some later date on the basis of price lists you have not had sight of and which bear little resemblance to the licensor's market practice.

  3. Do not assume licensing integrator tools provide a "gatekeeper" licence:

    Diageo paid a licence fee for SAP's integration software, SAP PI. Diageo contended that, since it paid a licence fee for SAP PI, this was a gatekeeper for SAP ERP and therefore no further licence fee should be due from the consumers. Justice O'Farrell found this argument lacking and sided with SAP in requiring Diageo to pay a Named User charge for the underlying SAP application in addition to the SAP PI licence fee.

    Going forward:

    When entering into agreements for integrator applications, explicitly address whether any additional fees are payable for the use of the integrator software or for any access made using it to ensure no future nasty surprises. Do not rely on the fact that you have the integrator software and therefore the owner of that software must know of the use with third party software providers to protect you.

    What will the effect be?

    Is the position upheld by Justice O'Farrell realistic in our interconnected times? With software systems increasingly required to interact with other software systems, is recognising this kind of interaction as indirect access requiring the payment of licence fees really feasible? The sum of money demanded by SAP (some £55 million) for this indirect use was calculated on the basis of the number of customers accessing the system and using a per user unit price. Though Justice O'Farrell did not rule on the sums payable and implied this sum was too large, there remains a risk that companies will be charged very high sums of money for additional licence use for indirect access, particularly if they are major multi-nationals with a large customer/supplier/distributor base.

    The risks involved with such integration could deter companies from investing in money and time-saving uses of software for communicating information. Indeed, the very same customers of Diageo who used the Connect software and were deemed to have indirect access to the SAP ERP requiring payment of a licence fee had, previously to the introduction of this software in 2014, been gaining the same data drawn from the SAP ERP system by calling Diageo. At the end of the phone, a Diageo sales rep would access the SAP ERP data and tell the customer this information. It seems nonsensical that the mode of delivery of the same data should have such a different and costly effect on Diageo.

    Perhaps this case signals that the Named User approach has had its day. The remuneration model does not seem to fit well with the indirect use required by most companies given new technologies.

Steps you should be taking for existing licences

In 2017, the majority of organisations are using cloud-based software providers to give their customers, suppliers, distributors and other third parties access to data. Much of this data is generated using other parties' software, such as Oracle or SAP. Organisations should assess their exposure to any additional licence payments by taking the following steps:

  1. If your organisation is using SAP:
    • undertake a technical audit of the software usage both within your organisation and by your suppliers, customers and outsourced service providers including considering direct and indirect access. Any such analysis should include any automated use as, though the decision focused on use by individuals, this type of use may be next up for review, particularly with the increasing importance of Artificial Intelligence (AI). Maximise the chances of such an audit being legally privileged by involving your legal advisers and by only circulating the material where necessary and to a limited group; and
    • review the applicable licence agreement you have in place to consider if the issues arising in this case are of direct or analogous application. The key issue is whether your organisation has any system in place which allows your customers or suppliers or any other third party to access software you have licences for through other software integrated with your system.
  2. Consider undertaking the steps laid out at point 1 above in relation to all other software your organisation uses on similar licence terms.

 

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Dentons | Attorney Advertising

Written by:

Dentons
Contact
more
less

Dentons on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):
hide

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.

Security

JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.