Year: 2013

SaaS Agreements – FAQs – Prism

In light of recent and ongoing “prism” revelations, SaaS suppliers are having to deal with numerous queries about the safety of SaaS customer data. Many customers mistakenly believe that by using a non-US data centre their SaaS customer data is protected against disclosure to the US authorities. Below is a summary of the relevant laws and most common concerns being raised by SaaS customers.

What is Prism?

“Prism” refers to the National Security Agency (NSA) secretly accessing personal data stored on the servers of Microsoft, Apple, Google, Yahoo, Facebook and some other major US public companies.

Prism, FISA and the Patriot Act

Prism is not the only problem. The US government has been secretly accessing SaaS customer data for years under the Foreign Intelligence Security Act (FISA) and the Patriot Act. Prism is just part of the whole range of tools that are being used by the US to access SaaS data of EU citizens.

What is FISA?

FISA allows the US government to access and monitor the personal data of non-US citizens (located outside of the USA) held by US public cloud providers. Public cloud providers such as Amazon and Google must secretly provide all assistance, facilities and information requested by the government if they request access to SaaS customer data. The public entity is not allowed to inform the SaaS supplier that it has disclosed or been asked to disclose personal data, nor that the data is being monitored.

The Patriot Act

The Patriot Act gives US law enforcement authorities the right to access personal data held by SaaS suppliers, regardless of where in the world the data is stored. The Act also gives US law enforcers the right to prevent SaaS suppliers from informing customers that they have handed over personal data. The Act applies not just to SaaS suppliers owned by a US company but also to any SaaS suppliers using the services of a US company i.e. a US data centre.

Safe Harbor

Safe Harbor does not protect SaaS customer data against secret access by the US authorities. Safe harbor, simply means that a US company registered under the “safe harbor” scheme is deemed to have data protection principles in place which are accepted in the EU as being adequate. This simply allows SaaS customer data to be legally transferred outside of the EU i.e. to be processed in a US data centre.

Summary

Many SaaS customers falsely believe that if their SaaS data is stored in a data centre located in the EU it will be protected against disclosure to the US authorities. Under the Patriot Act, FISA (and “prism” where applicable) the personal data of SaaS customers based in the EU must be shared with US law enforcers without the customer being informed, even though this conflicts with the EU Data Protection Directive and the data protection laws of the 28 EU member states.

Local EU data protection authorities and EU member state governments are currently investigating how to resolve this conflict, for example by adding provisions preventing disclosure in the draft proposed EU data protection regulation. While the position remains unresolved, SaaS suppliers should be considering how to minimise the risk this poses to their business model, whilst assuring SaaS customers that their concerns are being addressed.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Data Controller

It is important for a SaaS supplier to understand the legal obligations imposed upon a data controller when negotiating a SaaS agreement and data processing agreement (“DPA“) as the duties of a data controller are not the same as the duties of a data processor. In a SaaS relationship the SaaS customer is always the data controller and the SaaS supplier is always the data processor of the SaaS customer.

Who is a data controller

A data controller is defined in Article 4(7) of the GDPR as follows:

“the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.”

The data controller always decides and controls the purposes for which personal data is to be collected and processed. A data processor acts on behalf of, and only on the instructions of the data controller.

Controller obligations under the GDPR

The GDPR sets out the following 7 data protection principles that a data controller must comply with.

  • Lawfulness, fairness and transparency;
  • Purpose limitation;
  • Data minimisation;
  • Accuracy;
  • Storage limitation;
  • Integrity and confidentiality (security);
  • Accountability.

Need for a Data Processing Agreement

Since the GDPR and the UK Data Protection Act 2018 came into force on the 25th of May 2018 the obligations of data controllers have become more onerous. It is now mandatory for the data processor and the data controller to enter into a written agreement – DPA, setting out each party’s obligations. The DPA must include specific minimum terms.

Liability for Personal Data

A SaaS customer will be liable to its clients/end users (whose personal data it is collecting and processing) for any breaches of the GDPR. As the SaaS supplier will be carrying out the processing on behalf of the SaaS customer, the terms of the SaaS agreement should include adequate clauses to protect the SaaS supplier and the SaaS customer against data protection breaches, bearing in mind the differing responsibilities of the data controller and the data processor.

Registration under the Data Protection Act

The UK Data Protection Act 2018 requires every data controller who is processing personal data to register with the UK Information Commissioners Office (“ICO“), unless an exemption applies. It is not just a SaaS supplier who must register. A SaaS customer must also register where it acts as a data controller, in addition to being a data processor. Failure to register is a criminal offence.

There is an annual fee for registration. Current fees are determined by the ICO and a self assessment tool on the ICO website can be used to help you determine whether or not you are a data controller who needs to pay the fee.

Subject Access Request

Data subjects (clients of the SaaS customer) have the right to make a subject access request to the data controller.

Information must be provided within strict time limits and at no cost to the data subject. The request is made to the data controller (the SaaS customer) and the SaaS customer is obliged under the GDPR to respond. However, it is often the SaaS supplier who actually needs to provide the information stored on its servers either to the SaaS customer or their clients, on the SaaS customer’s behalf.

General

When considering SaaS customer requests to change clauses relating to liability, indemnities, data and data protection in a SaaS agreement or DPA it is essential that a SaaS supplier understands the statutory obligations of the data controller and data processor and the implications of changing any terms of the SaaS agreement or DPA.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – IPR – Software Patents

The issue of software patents has recently been highlighted by a proposal to change German patent and copyright law. The proposal recommends preventing computer software being registered as a patent, arguing that computer software should only be protected using copyright law, as this is sufficient to protect a software developer’s rights. In light of the current German proposal, below is a brief summary of patent and copyright law in relation to SaaS software in the UK, Germany and non-EU countries.

Patents

A patent protects a new invention and covers how things work, what they do, how they do it, what they are made of and how they are made. It gives the owner the right to prevent others from making, using, importing or selling the invention without permission. Generally SaaS software cannot be patented in the UK but there are limited exceptions which are set out below in more detail.

Software Patents in the UK

Despite the general presumption that SaaS software cannot be patented in the UK, it is possible to patent some computer software inventions in the UK. This is because software uses technology (computers) but often for non-technical purposes. Whether a computer software invention is patentable depends on the contribution the invention makes. For example, if computer software provided improved control of a car braking system, it would be likely to be patentable in the UK, but if it merely provided an improved accounting system, it would probably not be patentable in the UK.

Patents outside the UK

The law on what is patentable within the EU is generally the same as in the UK, as national patent laws are derived from the European Patent Convention (EPC). However, individual EU countries may interpret the terms of the EPC differently resulting in different rules actually applying in each EU country. For example, in Germany only software that substitutes a mechanical or electro-magnetic component is patentable. Outside of the EU in the US and Japan software patents can be registered with very few restrictions.

Copyright v Patent Law

Copyright alone does not adequately protect computer software as it does not protect the functionality of software. This is because copyright only protects the expression of ideas in the software NOT the ideas themselves. For example, if a third party substantially modified your SaaS software to create its own software that performed exactly the same function it would not breach your copyright as there is no ‘copying’ of your SaaS software.

The main objection to the use of patents to protect SaaS software, particularly in the open source software community and companies which use and contribute to open source, is that patents impede and/or prohibit the distribution of free software, as licence fees become payable for use of the patents. This results in technological progress being hindered and allows monopolies and powerful companies to exclude others from developing computer software e.g. Amazon “one-click” which is patented in the US but not in the EU.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Prism and US Laws

SaaS suppliers should be aware of relevant US laws when outsourcing SaaS services (data storage and hosting) to US companies or companies located in the USA. SaaS customers are becoming increasingly concerned about outsourcing in the USA following media reports about “Prism”. Namely, that the National Security Agency (NSA) accesses personal data stored on the servers of Microsoft, Apple, Google, Yahoo, Facebook and a few other major US public companies. Below is a summary of the most relevant US laws that SaaS suppliers should be aware of.

FISA

If you outsource any SaaS services to a US public company the US government can access SaaS customer data pursuant to the Foreign Intelligence Security Act (FISA).

FISA allows the US government to access and monitor the personal data of non-US citizens (located outside of the USA) held by US public cloud providers (i.e. Amazon or Google). Public cloud providers must secretly provide all assistance, facilities and information requested by the government if they request access to SaaS customer data. The public entity is not permitted to inform the SaaS supplier that it has disclosed or been asked to disclose personal data, nor that the data is being monitored.

The Patriot Act

If you are a SaaS supplier owned by a US parent company or you outsource any SaaS services to a US located data centre or a US based company, US law enforcers can access SaaS customer data pursuant to the Patriot Act.

The Patriot Act gives US law enforcement authorities the right to access personal data held by SaaS suppliers, regardless of where in the world the data is stored. The Act also gives US law enforcers the right to prevent SaaS suppliers from informing their customers that they have handed over personal data. The Act applies not just to SaaS suppliers owned by a US company but also to any SaaS suppliers using the services of a US subsidiary for data processing i.e. a US data centre.

HIPAA

If you are a SaaS supplier providing SaaS services to a US customer who is a health care provider you, and your sub-contractors, must comply with the security and privacy obligations of the Health Insurance Portability and Accountability Act 1996 (“HIPAA”).

HIPAA applies to any SaaS supplier who creates, receives, maintains, or transmits protected health information (“PHI”), regardless of whether or not the SaaS supplier actually views the data. HIPAA applies even if the SaaS supplier is not located in the USA. Any subcontractors a SaaS supplier uses i.e. a data centre will also need to comply with HIPAA.

SaaS Suppliers must include the privacy and security obligations set out in HIPAA in their SaaS agreements with US health care provider customers. SaaS suppliers are directly liable for breaches of the HIPAA security and privacy rules, which includes failing to cooperate with DHHS investigations of HIPAA breaches. Liability is strict i.e. a SaaS supplier will be liable regardless of intent. The penalties for breach are severe and a SaaS supplier can be fined up to 1.5 million US dollars for all breaches in any calendar year.

Summary

Under the provisions of the US Patriot Act and FISA the personal data of SaaS customers based in the EU must be shared with US law enforcers without the customer being informed, even though this conflicts with English and EU data protection law. Under HIPAA SaaS suppliers must comply with detailed privacy and security provisions of a US law applicable to the health care industry or face severe fines.

It is therefore important that SaaS suppliers ensure they are aware of the extent of any US laws they will be subject to when:

  • contracting with US SaaS customers; or
  • outsourcing SaaS services to companies linked to or based in the USA; or
  • if they have a parent company based in the USA.

SaaS suppliers should have procedures and measures in place to deal with any applicable US laws. These procedures need to be set out clearly in the terms of the SaaS agreement with the Customer, bearing in mind mandatory obligations to comply with US laws.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

Other related articles:

SaaS Agreements – Data Protection – HIPAA

On January 25th 2013, the US Department of Health and Human Services modified the rules of the Health Insurance Portability and Accountability Act 1996 (“HIPAA”). HIPAA applies to any SaaS suppliers who process protected health information (“PHI”) on behalf of customers to whom the Act applies, regardless of whether or not the SaaS supplier is located in the USA.

HIPAA

HIPAA is a US law that places security and privacy obligations on “covered entities” in the health care field e.g. SaaS customers who are health care providers. If you are a SaaS supplier who processes PHI on behalf of a covered entity you will also be subject to the provisions of HIPAA, if you are a “business associate”.

A SaaS supplier is a “business associate” under HIPAA if it “creates, receives, maintains, or transmits” PHI even if it does not view the PHI or only does so on a random or infrequent basis. Also, any subcontractor i.e. the data centre of the SaaS supplier will be a business associate for the same reason.

Business Associates

The importance of being a business associate is that it is now mandatory for SaaS Suppliers, who are business associates to include terms covering their privacy and security obligations under HIPAA in their SaaS agreements with customers. Also, SaaS suppliers are now directly liable for breaches of HIPAA’s security and privacy rules, which includes failing to cooperate with DHHS investigations of HIPAA breaches.

Liability is strict i.e. a SaaS supplier will be liable regardless of its intent. The penalties for breach are severe and can be up to 1.5 million dollars for all breaches in any calendar year.

How to Comply with HIPAA

SaaS suppliers cannot ensure that their SaaS customers comply with HIPAA as they have no control or sometimes do not even know what data users are uploading and what particular regulatory requirements apply to users and their data, especially where users are located outside of the UK or are subject to industry specific regulations.

Therefore if you are a SaaS supplier offering SaaS services to the US health care and insurance sector and your customers are subject to HIPAA you should:

  • Consider amending the design of your SaaS software to make it more appropriate for dealing with PHI and to support compliance with HIPAA obligations;
  • Try to physically prohibit PHI from being uploaded into and stored on your SaaS system;
  • Include clauses in your SaaS agreement which prohibit SaaS customers from uploading PHI;
  • Include a SaaS customer indemnity in your SaaS agreement to protect you against any claims for breaches of HIPAA;

By drafting standard business associate clauses for inclusion in your SaaS agreement with customers and your agreements with relevant subcontractors you may be able to limit your liability for breaches of HIPAA and avoid your customers trying to impose their own more onerous clauses upon you.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

 

SaaS Agreements – FAQs – Applicable Law and Jurisdiction

It is important to understand the difference between applicable law and jurisdiction when negotiating a SaaS agreement. Applicable law specifies which country’s laws will apply to your SaaS agreement. Jurisdiction specifies which courts will have authority to deal with a dispute. Usually a UK SaaS agreement will specify the laws of England and Wales as the applicable law and the courts of England will have jurisdiction.

English or Scottish Law

Many SaaS suppliers are not aware that two legal systems exist in the UK. English law and Scottish law and each has its own courts. English law and Scottish are not the same and it is important to specify which law applies and which courts should have jurisdiction as there is no such thing as “UK law” or “UK courts”.

Other Laws

If you are a SaaS supplier used to dealing with customers located outside of the UK, you will be familiar with SaaS customers insisting on their local law applying to your SaaS agreement. Many SaaS suppliers agree to this by simply removing “English law” from the SaaS agreement and replacing it with, for example, “laws of Delaware” unaware of the consequences this will have upon their SaaS terms and conditions.

Consequences of Changing the Applicable Law

By changing the law applicable to your SaaS agreement you may automatically invalidate many of the limitations on liability contained in your SaaS agreement. You may also become liable for types of damages that you thought were excluded in your SaaS agreement, i.e. direct damages, indirect damages, typically foreseeable damages, or punitive damages, as in some countries liability cannot be limited for these types of damages, or the local understanding of what types of losses fall within these areas may differ from English law.

This could also result in you becoming subject to local laws applicable to consumer contracts, even though you are contracting with a business. For example, in France if you enter into a SaaS agreement with a business not operating in your business sector, your SaaS customer will be a consumer and will be protected by local consumer protection laws. i.e. with rights to refunds.

By agreeing to a change of law in your SaaS agreement you may also unknowingly grant customers new rights that do not exist under English law. For example, if you agree to a change to German law under mandatory German law a customer can lower the price it pays for the SaaS services if the service is defective.

Jurisdiction

If you agree to change the applicable law when negotiating your SaaS agreement you should also consider changing the country in which the courts are located that will deal with any disputes i.e. French law and the courts of Paris.

Language

You should also specify in the SaaS agreement in which language disputes should be dealt with. If you do not speak or understand the local language of your customer you should state that all disputes must be dealt with in English. This is particularly important if the SaaS agreement has been translated into your customer’s local language. In this case you should state that the English version of the SaaS agreement will prevail if there is a discrepancy between the two versions.

Legal Costs

Also do not forget that the local rules on the amount of costs that a court can order the losing party to pay the winning party can vary substantially. In some jurisdictions and in some areas of law, no costs are recoverable at all by a winning party.

General

For the above reasons when considering SaaS customer requests to change the applicable law or jurisdiction in your SaaS agreement it is essential that you understand the difference between applicable law and jurisdiction and the implications of changing these.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Dealing with Late Payment or Non-payment of Invoices

In the current economic climate, SaaS customers often delay payment of invoices. In order to protect your SaaS business and improve your cash flow, you should consider including the following in the terms of your SaaS agreement.

Right to Claim Interest

There is no requirement to have an interest clause in your SaaS agreement, as you have a statutory right to claim interest on late payments from a business customer (BTB) under the Late Payment of Commercial Debts (Interest) Act 1998 (“Act”). The statutory interest rate to be applied is the applicable Bank of England Base Rate + 8%.

Alternatively you can specify a specific interest rate in your SaaS agreement. This can be a number i.e. 7%, or a reference to an index i.e. the European Central Bank base rate, or a combination of both i.e. the Bank of England base rate + 2%. The interest rate specified can be higher or lower than the statutory rate. Note that if you specify an interest rate in your SaaS agreement, the  statutory rate will not apply, even if the interest rate you specify is lower than the statutory rate.

SaaS suppliers should therefore consider the following when deciding whether or not to include an interest clause and specific interest rate in the terms of their SaaS agreement.

  • By specifying an interest rate in your SaaS agreement you are inviting a business customer to negotiate a lower rate. If you have a weaker bargaining position, you may have to agree to a rate much lower than 8.5%;
  • Time and money could be wasted on protracted negotiations on which index to use and the % rate applicable;
  • Many SaaS customers are not aware that you have a mandatory right to claim interest on late payment and that the statutory rate will apply.

Right to Claim Compensation

In addition to claiming statutory interest from a SaaS customer, under the Act you are also entitled to a fixed amount of compensation. The amount is based upon the amount of the outstanding invoice:

  • £40 – for debts less than £1,000;
  • £70 – for debts between £1,000 to £9,999; and
  • £100 – for debts over £10,000.

Recovery of Costs

Since the 16th of March 2013 SaaS suppliers have the additional right to claim the difference between the  fixed compensation amount and their reasonable costs in recovering the debt e.g. appointing a debt recovery company or lawyer. However this right only applies to debts accrued after the 16th of March 2013.

Right to Terminate or Suspend SaaS Services

If a SaaS customer fails to pay you on time this will be in breach of contract – but not a fundamental breach (which permits you to terminate the SaaS agreement and claim damages). SaaS supplier’s should therefore state in their SaaS terms and conditions that “time is of the essence” for all payments. If the SaaS customer then fails to pay  on time you can terminate the SaaS agreement immediately without notice and claim compensation. However many SaaS customers will not agree to time being of essence.

Alternatively you could include the following specific rights in the SaaS agreement to achieve the same  result:

  • the right of the SaaS supplier to terminate the SaaS agreement for late or non-payment; and/or
  • the right of the SaaS supplier to suspend delivery of the SaaS Services until payment is received.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Source Code

When negotiating a SaaS agreement you will come across the terms source code, object code and open source. What is the difference if any between source code, object code and open source?

Source Code

Source code is the version of a computer programme (SaaS software) that exists prior to the software being ready to compile and run on a computer. The source code consists of a number of statements created in a text form by a programmer. These statements are saved in a named file and are called the source code.

The source code is human-readable but cannot be executed directly by a computer. The source code needs to be translated so that a computer can interpret it. This is done by compiling the source code into a format that a computer can interpret – the object code.

Do note there are some exceptions to the above. For example, modern source code can often be the same as the object code where no compilation is required. An example of such code is HTML, which is used to build most websites.

Object Code

Object code is the version of a computer programme that is created when the source code has been translated and compiled by a special programme. The object code file contains a sequence of instructions that can be executed directly by a computer. The object code is difficult for a human to read or modify.

Open Source Code

Open source code (OSS) refers to the version of a computer programme (SaaS software) in which the source code is made available and licenced to the general public. The open source licence gives users the right to study, modify and distribute the source code free of charge. Open source code is often created as a collaborative effort in which programmers improve the source code and share changes within a community.

Importance of Source Code

When source code is translated into object code, a lot of information is lost. As a result of this it is not possible to fully reconstruct the original SaaS software source code from the object code. Accordingly, it is sometimes advisable to have the source code held by a third party in escrow to ensure that you have access to the SaaS source code in the event of the insolvency of, or access and maintenance issues with your SaaS supplier. If you do not have access to the source code you will be unable to continue to use the SaaS software.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Website Legal Requirements – for SaaS Suppliers

Below, I have set out the main legal requirements (including some optional recommendations) that you should comply with when operating your website in the UK. Even if you do not sell SaaS products or services online via your website, you will still need to comply with the following English laws when operating a website in the UK.

Mandatory Requirements

About Us/Contact Information

You must provide the following information in an easily accessible position on your website:

  • your legal name i.e. XYZ Ltd
  • your geographical address
  • contact details i.e. telephone number, fax number and email address
  • which country your business is registered in and the registration number
  • details of any supervisory body which regulates your business i.e. the FSA. For regulated bodies more detailed information is required.
  • where you are registered for VAT and your VAT number
  • clear details of prices and whether or not delivery and/or tax is included

Registration under the Data Protection Act

If you collect any personal data on your website – i.e. email address, name or address of a living individual, you will be processing personal data and must register as a data controller under the Data Protection Act (DPA). As a SaaS supplier the DPA will apply as soon as you require users to register in order to access your SaaS website or receive a newsletter or marketing information from you.

Privacy Policy

If you are collecting personal data it is a criminal offence not to register as a data controller under the Data Protection Act (DPA).

If you are collecting, storing or processing personal data you need to inform SaaS customers or website users how, what and why you are using their personal data in order to comply with the DPA. Even if you do not collect personal data on your website as a SaaS supplier you will be collecting and processing personal data on behalf of your SaaS customers.

Also, if you are sending marketing emails to potential SaaS customers you need to ensure that you have obtained specific consent, BEFORE such emails are sent. Consent should be covered in your privacy policy and the registration process on your website.

Cookie Policy

Cookies are small text files placed on a user’s computer which record online activity. Virtually all websites use cookies. Most use analytics cookies to measure visits and use of websites. Performance and functionality cookies are used to make repeated use of a website more comfortable for the user and advertising cookies are increasingly used to collect information about users for targeted marketing purposes.

You must provide users with clear and comprehensive information about the type of cookies being used on your website and the purposes for which the information is collected (subject to some exceptions). Users must give consent to the use of cookies. Consent can be obtained, by specifically making users aware of their acceptance of the terms of your cookie policy (or the relevant section of your privacy policy) by virtue of continuing to use your website.

Disabled Access to your Web Site

If you offer SaaS goods or services on your website you need to make your website accessible to disabled users. Level 1 compliance with the WC3 standard will usually suffice.

Trademarks and Logos

Do not use other people’s trademarks or logos without their consent on your website or you could be liable to pay damages for trademark infringements.

Copyright

Do not use other people’s content without their consent on your website, or you could be liable to pay damages for copyright infringements. If you have links to other people’s content, make sure that this is permitted in their terms of use and ensure that the information opens in a new frame.

Online Payment

If you accept online payment for your SaaS goods or services you must provide SaaS customers with specific information about their right to cancel, VAT and prices, refunds and defective goods PRIOR to the sale being concluded.

Recommended Requirements

In addition to the above mandatory rules it is advisable to include the following information on your website.

Terms of Use/Disclaimer

You should set out the rules applicable to visitors using and accessing SaaS goods and services on your website. For example, state who may access the website i.e. consumers, businesses, over 18s. You should also aim to limit your liability for information on your website. For example, state which law applies and your limits on liability. However, please note that you cannot exclude or limit certain liabilities in particular circumstances  – particularly in relation to consumers, injuries caused by goods and services, or defects in your goods and SaaS services.

Copyright Notice

Protect the information on your SaaS website by inserting a copyright notice “© company name 2013.  All rights reserved.” Without this notice, it may be difficult in some countries to take legal action against any copyright infringement.

Summary

The above are examples of the main legal requirements for UK websites. This is a very complicated area of law and the specific rules that apply to you will depend on what goods and SaaS services you are offering, whether you are acting BTB (business to business) or BTC (business to customer), where you are based, where your customers are located and many other factors.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Safe Harbor Still Adequate

Recently, the Department of Commerce’s International Trade Administration (ITA) – a US government body – published a document confirming that any SaaS suppliers based in the US (and/or SaaS suppliers using a data centre located in the US) who are “safe harbor” registered must be recognised as having an “adequate” level of data protection. The ITA rejected the view that EU data protection authorities can unilaterally refuse to recognise safe harbor certification as a valid means of demonstrating that a SaaS supplier based in the US (and/or SaaS suppliers using a data centre located in the US) has an adequate level of data protection.

Background

Under current EU data protection laws, SaaS suppliers cannot send personal data outside of the EEA (the 28 EU member states plus Norway, Iceland and Liechtenstein) unless adequate protections have been put in place or where the destination country is pre-approved as having adequate data protection. Only the following countries are pre-approved and recognised as having adequate protection: Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and Japan.

EU Position

Last year the Article 29 Working Party, a EU privacy body, claimed that SaaS customers based in the EU needed to see actual evidence that US SaaS suppliers (and/or SaaS suppliers using data centres in the US) complied with safe harbor standards. They claimed it was not enough for SaaS customers to simply rely on the fact that a SaaS supplier was registered under the safe harbor scheme.

ITA Position

The ITA disagrees with the above position. The ITA points out that the same rules apply to all SaaS suppliers under EU data protection laws regardless of whether or not they are located within the EEA, an ‘adequate’ country or are safe harbor registered. As the safe harbor framework is binding on all countries within the EEA additional requirements cannot be imposed exclusively on US SaaS suppliers (and/or SaaS supplier using data centres in the US).

Additionally, safe harbor SaaS suppliers (and/or SaaS suppliers using data centres in the US) are not obliged to use the EU model clauses in order to be recognised as adequate, as these are simply for use as an alternative approach to safe harbor. Moreover, they were specifically designed to address the adequacy requirement where safe harbor is not an option.

Additional Requirements

The ITA accepted that US SaaS suppliers (and/or SaaS suppliers using data centres in the US) must enter into a basic processing agreement with SaaS customers (which could form part of the SaaS agreement) but only to ensure that the SaaS supplier has sufficient instructions regarding use of the personal data. This requirement applies to all SaaS suppliers.

Additional requirements could only be imposed if these were required under other applicable laws. For example, under the Markets in Financial Instruments Directive (MiFID) if a US SaaS supplier (and/or SaaS supplier using data centres in the US) enters into a SaaS agreement with a SaaS customer who is providing financial services the terms of the SaaS agreement must guarantee the SaaS customer physical access to the US premises at which data is being processed.

Summary

SaaS suppliers who have SaaS customers querying their “adequacy” and compliance with EU data protection laws can use the ITA document to confirm that safe harbor registration does provide “adequate” protection. Along with the terms of the SaaS agreement, which will include specific data processing obligations, SaaS customers should be satisfied that processing in the US under safe harbor is adequate.

In addition, the European Commission has indicated that safe harbor will continue to be deemed “adequate” in the final version of the new proposed EU Data Protection Regulation.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: