Year: 2019

SaaS Agreements – Brexit – Need for an EU Representative

A “no deal Brexit” or “Brexit” with a withdrawl agreement is now likely to happen in the next month or so, following the EU granting an extension until the 31st of January 2020 for the UK government to obtain parliament’s approval to the final terms of the withdrawl agreement and the general election in the UK on the 12th of December. SaaS suppliers and SaaS customers need to take steps now to ensure that they comply with the requirement to appoint an EU Representative under the GDPR, where they will no longer have any establishment in the EU, after Brexit.

When must an EU Representative be appointed.

A SaaS supplier or SaaS customer must appoint an EU representative unless:

  • the processing is occasional and does not include, on a large scale, processing of special categories of data or processing of personal data relating to criminal convictions and offences and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or
    a public authority or body: or
  • they are a public authority or body.

The EU representative is appointed by the SaaS supplier or SaaS customer to deal with supervisory authorities and data subjects on all issues related to the processing of personal data, for the purposes of ensuring compliance with the GDPR.

Do you have an EU Establishment

The GDPR does not define establishment.

However, Recital 22 of the GDPR says:

“Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.”

Therefore if a UK SaaS supplier or customer has a subsidiary incorporated in a Member State of the EU, this subsidiary will be fully subject to the GDPR, if it offers goods or services to individuals located in the EU. In this case the UK SaaS supplier or customer would not need to designate an EU representative, as it would have an establishment in the EU.

Where a SaaS supplier or customer does not have a subsidiary established in a Member State of the EU they will need to appoint an EU representative.

Who can be an EU Representative

An individual or a company. The individual or company does not have to work for or in the case of a company be owned by a linked to the SaaS supplier or SaaS customer.

Does the EU Representative have to be located in the EU

The EU representative must reside or be established in a Member State of the EU in which relevant data subjects whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, reside.

Appointing an EU Representative

The appointment must be in writing.

EEA based individuals whose personal data is being processing should be provided with the details of the EU representative.

Details of the EU representative must also be made easily accessible to supervisory authorities.

Other Brexit Considerations

SaaS suppliers and SaaS customers should be aware that following Brexit, the UK version of the GDPR will require a SaaS customer or SaaS supplier located outside of the UK, i.e. in the EU, to appoint a UK representative.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience dealing with SaaS, cloud computing matters and IT law issues. If you require assistance with any SaaS agreements, cloud computing matters or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Data Processor

It is important for a SaaS supplier to understand the legal obligations imposed upon them as a data processor when negotiating a SaaS agreement and a data processing agreement (“DPA“) as the duties of a data processor are not the same as the duties of a data controller. In a SaaS relationship the supplier is always the data processor of the SaaS customer. The SaaS customer is always the data controller of the SaaS supplier.

Who is a Data Processor

Articel 4(8) of the GDPR defines a data processor as:

“a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller”

A data processor acts on behalf of, and only on the instructions of a data controller. Whereas a data controller, determines the purposes and means of the processing of personal data.

Where a SaaS supplier does not have any purpose of its own for processing the personal data and they only act on a SaaS customer’s instructions, they are a data processor – even if the SaaS supplier make some technical decisions about how to process the personal data.

Need for a Data Processing Agreement

Since the GDPR and the UK Data Protection Act 2018 came into force on the 25th of May 2018 the obligations of data processors have become much more onerous. It is now mandatory for the data processor and the data controller to enter into a written agreement – DPA, setting out each party’s obligations. The DPA must include specific minimum terms.

Liability for Personal Data

A SaaS customer will be liable to its clients/end users (whose personal data it is collecting and processing) for any breaches of the GDPR. As the SaaS supplier will be carrying out the processing on behalf of the SaaS customer, the terms of the SaaS agreement and not just the DPA should include adequate clauses to protect the SaaS supplier and the SaaS customer against data protection breaches, bearing in mind the differing responsibilities of the data controller and the data processor.

Subject Access Request

Data subjects (clients of the SaaS customer) have the right to make a subject access request to the data controller.

Information must be provided within strict time limits and at no cost to the data subject. The request is made to the data controller (the SaaS customer) and the SaaS customer is obliged under the GDPR to respond. However, it is often the SaaS supplier who actually needs to provide the information stored on its servers either to the SaaS customer or their clients, on the SaaS customer’s behalf.

General

When considering SaaS customer requests to change clauses relating to liability, indemnities, data and data protection in a DPA or a SaaS agreement it is essential that a SaaS supplier understands the statutory obligations of the data controller and data processor and the implications of changing any terms of the DPA or SaaS agreement.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Personal Data

It is essential for SaaS providers and SaaS customers to understand what consitutes personal data to ensure that they comply with their respective legal obligations when acting as data controllers and/or data processors.

What is Personal Data?

Articles 4(1) of the General Data Protection Regulation (“GDPR“) defines personal data as:

“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

It is important to note that the GDPR only applies to personal data.

Examples of Personal Data

If an individual is directly identifiable from the information, the data is personal data. For example:

  • Name; or
  • Email address.

If, by looking solely at the data you can distinguish an individual from other individuals, that individual will be identified (or identifiable). Remember you don’t have to know someone’s name for them to be directly identifiable, a combination of other identifiers may be sufficient to identify the individual. For example the following identifiers:

  • Location data;
  • Online identifiers – such as an IP address or cookie identifier;
  • Identification data.

Categories of Personal Data

Some personal data is more sensitive in nature. The GDPR refers to this type of personal data as “special categories of personal data”.

Special categories of personal data include personal data about an individual’s:

  • race;
  • ethnic origin;
  • political opinions;
  • religious or philosophical beliefs;
  • trade union membership;
  • genetic data;
  • biometric data (where this is used for identification purposes);
  • health data;
  • sex life; or
  • sexual orientation.

Is Pseudonymised data personal data?

Pseudonymisation is a technique used to change personal data so that it can no longer be attributed to a specific data subject without the use of additional information. Provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person then the data is pseudonymised.

Is anonymous data personal data?

If personal data is truly anonymised i.e. the data cannot be combined with any other data to identify an individual, then the anonymised data is not personal data.

Is information about companies personal data?

Information about companies or public authorities is not personal data as a company or public authority is not a natural person. However, information about individuals acting as sole traders, employees, partners and company directors where they are individually identifiable and the information relates to them as an individual may be personal data.

Is data about a deceased individual personal data?

Information about a deceased person is not personal data.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – GDPR – Personal Data Breaches and How to Avoid them

Recently there have been a number of high profile cases involving the UK’s data protection authority (the “ICO”), imposing very large fines on Marriott and British Airways for serious data breaches. SaaS customers and SaaS suppliers should be reviewing the appropriateness of their technical and organisational measures to avoid the risk of being fined up to 4% of global turnover for serious personal data breaches.

Complaints

According to the ICO’s annual general report 2018 – 2019 published in July 2019, complaints from members of the public to the ICO have doubled in the last 12 months. The largest proportion of complaints relates to subject access requests, but this is followed by data breaches.

What is a Personal Data Breach

The GDPR defines a personal data breach as: “the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”.

Personal data means any information concerning or relating to an identified or identifiable individual. SaaS suppliers and SaaS customers should be aware that a personal data breach can cover a lot more than just ‘losing’ personal data. It also includes any breach of security that leads to accidental or unlawful destruction, alteration or disclosure of personal data. For example, resulting from accidents (such as sending an email to the wrong recipient) as well as deliberate acts (such as phishing).

SasS customers and suppliers should be aware that a personal data breach is a security incident that negatively impacts the confidentiality, integrity, or availability of personal data. Accordingly, all personal data breaches are security incidents, but not all security incidents are necessarily personal data breaches.

Recent Personal Data Breaches

British Airways

On the 8th July 2019, the ICO announced its intention to fine British Airways £183m for personal data breaches relating to user traffic to the British Airways website being diverted to a fraudulent site where customer details could be harvested by attackers. The personal data breach involved around 500,000 customer’s data and included log in, payment card, and travel booking data, as well name and address data.

Marriott

On the 9th July, the ICO announced its intention to fine Marriott International £99m for personal data breaches which began in 2014 and was only discovered in 2018. The personal data breach involved the personal data of around 339 million guest records worldwide (30 million related to EU residents, of which 7 million related to UK residents).

ICO Actions:

One Stop Shop

Under the ‘one stop shop’ provisions of the GDPR, Marriott and British Airways are being investigated by the ICO – who is the lead supervisory authority. The lead supervisory authority investigates the breach on behalf of all data protection supervisory authorities in the EU whose residents have been affected by the breach. Each national data protection supervisory authority in the EU will have the chance to comment on the ICO’s findings.

Fines

In the above 2 cases no fines have yet been imposed by the ICO. The ICO has at this stage, notified both British Airways and Marriott of its intention to fine them. Each company now has an opportunity to make representations to the ICO in relation to the proposed findings and sanctions.

In determining the proposed level of the fine the ICO commented that both companies had co-operated with the ICO investigation and had made improvements to their security arrangements since these events came to light.

The ICO will now need to consider the representations of Marriott and British Airways and the other concerned national EU supervisory authorities before it make a final decision on the level of each fine and any other sanctions.

Preventing a Data Breach

In light of the above, SaaS suppliers and SaaS should ensure that they have in place appropriate technical and organisational measures to keep personal data safe. The measures taken should be appropriate to the risk the processing represents.

The following security measures should always be taken:

  • Having firewalls, anti-virus applications and malware protection to protect hardware, devices and networks in place;
  • Using up to date software and operating systems;
  • Installing patches and updates without delay.

The following internal organisational measures should as a minimum be implemented:

  • Having a security policy;
  • Having a data protection policy;
  • Having a business continuity plan/disaster recovery plan.
  • Training staff on data protection issues;
  • Carrying out regular risk assessments of staff, systems and suppliers.

Summary

Since the GDPR came into force on the 25th of May 2018 the potential fines that the ICO can impose on a SaaS supplier and/or SaaS customer for a personal data breach can be very large, as shown by the recent fines proposed for Barclays and Marriott. Whether you are a SaaS supplier or SaaS customer you should ensure that you are taking appropriate actions to minimise the risks of a personal data breach as this could in the long run have a serious knock on effect on the level of any subsequent fine proposed by the ICO.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Brexit – Preparing for a No Deal Brexit

SaaS Agreements – Brexit – EU data Transfers to the UK after Brexit

SaaS Agreements – Brexit – Amendments to SaaS Terms and Conditions

SaaS Agreements – Data Protection – SaaS, Brexit and the GDPR

SaaS Agreements – GDPR – The General Data Protection Regulation

SaaS Agreements – FAQs – Personal Data

SaaS Agreements – FAQs – Data Processor