Category: GDPR

FAQs – Sub-Processor Lists – Transfer Mechanisms

SaaS suppliers and SaaS customers can only lawfully transfer personal data to sub-processors located outside of the UK, Switzerland or the EEA, (make a restricted transfer) if a recognised transfer mechanism is in place to protect the personal data being transferred.

Transfer Mechanisms

Currently the only transfer mechanisms are:

  • Adequacy, (EU Adequacy Decisions including the DPF);
  • EU Standard Contractual Clauses, (EU SCCs);
  • UK Standard Contractual Clauses, (UK SCCs);
  • Binding Corporate Rules, (BCRs)

If none of the above transfer mechanisms are used, no restricted transfer of personal data can be lawfully made.

Adequacy

The European Commission has currently awarded Adequacy Decisions to the following countries:

Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland , the United Kingdom under the GDPR and the LED, the United States (commercial organisations participating in the EU-US Data Privacy Framework)  and Uruguay .

A full list can be found on the European Commission website – Adequacy Decisions.

Data Privacy Framework (DPF)

The DPF is an opt-in certification scheme that can be used with sub-processors located in the USA to enable restricted transfers of personal data to be lawfully made to the USA. The DPF has been in force since the 10th of July 2024 and US entities can apply to be certified on the DPF website. Once a US organisation has been certified and is publicly placed on the DPF List they can receive EU personal data relying upon the DPF.

EU + UK SCCs

EU standard contractual clauses are a set out of standard clauses that have been approved by the EU Commission as providing adequate protection, when used to transfer EU personal data from the EU to a third country located outside of the EEA. Up until June 2021 there were two sets of standard contractual clauses that could be used for transfers of personal data between data controllers, and one set for transfers between a data controller and a data processor, (old EU SCCs). There were no clauses for transfers between data processors.

In June 2021 the EU Commission replaced the old EU SCCs with one new set of standard contractual clauses, (new EU SCCs) to cover 4 different types of data transfers in one document in 4 different modules:

  • Module 1: covers transfers from a data controller (SaaS supplier) to a data controller outside of the EEA (third party);
  • Module 2: covers transfers from a data controller (SaaS customer) to a data processor outside of the EEA (SaaS supplier);
  • Module 3: covers transfers from a data processor (SaaS supplier) to a data processor outside of the EEA (sub-processor); and
  • Module 4: covers transfers from a data processor (SaaS supplier) to a data controller (third party) outside of the EEA.

Is important to be aware that when EU SCCs are relied upon as a data transfer mechanism a data transfer assessment must also be carried out.

Binding Corporate Rules (BCRs)

BCRs only cover international transfers of personal data between companies within the same group.

Sub-Processor Lists

SaaS suppliers must list all sub-processors to whom they transfer personal data, in a sub-processer list. The sub-processor list usually forms part of the SaaS supplier’s data processing agreement, (“DPA”) which is often published on the SaaS supplier’s website or SaaS platform. The transfer mechanism used by each sub-processor must be identified in the sub-processor list.

A SaaS supplier’s current list of sub-processors must correctly identify the actual transfer mechanism relied upon by each sub-processor. Please note that:

  • since the introduction of the DPF, many US sub-processors no longer user SCCs as their transfer mechanism; and
  •  where a sub-processor list was created before March 2024, the “old” EU and UK SCCs must be replaced with the “new” EU and UK SCCs.

SaaS suppliers should also be aware that where any sub-processor uses SCCs as a transfer mechanism, SaaS suppliers must ensure that the data transfer assessment carried out for each such sub-processor is updated at least annually.

Actions to be taken now

Where SaaS suppliers make any restricted transfers of personal data to sub-processors, or to their group companies, affiliates, customers or suppliers, they may need to update their legal documentation to reflect the above current transfer mechanisms.

For example:

Where a restricted transfer of personal data is made by the SaaS supplier to a member of a group company or an affiliate located in the USA the SaaS supplier will need to:

  • apply for the US entity to be certified under the DPF;
  • amend the group company or affiliate’s privacy policy to include the mandatory information required under the DPF rules;
  • amend any inter-company data processing agreements to reflect the new transfer mechanism.

Where a transfer of personal data is made to a customer, supplier or sub-processor located in the USA the SaaS supplier will need to:

  • amend its sub-processor list;
  • amend its data processing agreement;
  • amend its data transfer assessments;

to reflect the changes in the transfer mechanisms relied upon.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – Restricted Transfers

SaaS suppliers and SaaS customers currently have to comply with complicated rules and include onerous obligations in their SaaS agreements, data processing agreements and data privacy practices to lawfully make restricted transfers of personal data when providing SaaS services. Before making any restricted transfers of personal data, SaaS suppliers must ensure that the specific safeguards required under the UK GDPR and the EU GDPR are in place.

What is a Restricted Transfer

When a SaaS supplier sends or transmits personal data to an entity located in a country outside of the EEA which is not deemed “adequate” by the European Commission, this a restricted transfer.

Examples of restricted transfers that SaaS suppliers usually make are:

  • Hosting of SaaS customer personal data, for example in data centres operated by entities established outside of the EEA, for example: AWS, Microsoft;
  • Using technology services of suppliers located outside of the EEA, for example: Cloudflare, Google;
  • Using sub-processors located outside of the EEA to provide services to SaaS customers, for example: Zendesk, Sendgrid, Zoom;
  • Transferring or sharing access to personal data with group companies located outside of the EEA.

What is a Transfer Mechanism

SaaS suppliers and SaaS customers are required by European data protection authorities and the GDPR to use a recognised transfer mechanism in order to make their restricted transfers of personal data lawful.

In the past the following transfer mechanisms were recognized as providing “adequacy”:

  • Safe Harbor – covered transfers of personal data to US companies signed up to the scheme until the mechanism was declared invalid in the Schrems I decision of the European Court of Justice in 2015;
  • EU – US Privacy Shield – replaced Safe Harbor and covered transfers of personal data to US companies signed up to the scheme until the mechanism was declared invalid in the Schrems II decision of the European Court of Justice in 2020.

Following the Schrems II decision, the only transfer mechanisms now recognised by the EU as being “adequate” are:

Additional Requirements

Following the Schrems II decision:

When using EU SCCs (or BCRs) as a transfer mechanism, EU SaaS suppliers and SaaS customers must also:

When using UK SCCs (or BCRs) as a transfer mechanism, UK SaaS suppliers and SaaS customers must also:

  • Implement supplemental safeguards when making restricted transfers; and
  • Carry out data transfer assessments, (DTAs).

Also: note that in the UK there are 2 different types of UK SCCs that can be used:

Google and Meta Decisions

However, in spite of compliance with the above obligations, Google has been declared by various EU data protection authorities, and more recently Meta, to be in breach of the GDPR for making unlawful restricted transfers of EU personal data. Meta has been fined €1.2bn (£1bn) and ordered to suspend all restricted transfers to the USA.

Meta is currently appealing this decision, and the fine awarded, and is continuing to make restricted transfers of personal data to the USA as the suspension only comes into effect in October 2023, by which time the new EU-US Data Privacy Framework (DPF) should have been granted “adequacy” by the European Commission, making the continued transfers to the USA lawful.

EU-US Data Privacy Framework – DPF

The DPF is the replacement transfer mechanism for the invalidated EU-US Privacy Shield to enable EU personal data to be transferred to the USA. The European Commission has indicated its intention to grant the DPF “adequacy” but like its predecessors, the DPF will probably be challenged by Mr Schrems and could again be declared invalid by the European Court of Justice at some point in the future.

Important note: The DPF can only be used by US businesses regulated by the Federal Trade Commission or the US Department of Transportation. Such businesses would need to self-certify compliance with the DPF.

UK – US Data Bridge

As the UK is no longer part of the EU following Brexit, it needs to agree its own transfer mechanism with the USA – that is also acceptable to the EU. The UK is referring to this new transfer mechanism as the UK-US Data Bridge and it appears to be an extension to the DPF specifically for the UK.

Summary

SaaS suppliers and SaaS customers need to closely watch developments over the coming months on the progress of these new proposed data transfer mechanisms in the US, EU and the UK.

However, even if the new transfer mechanisms are granted “adequacy” by the EU, they will only apply to transfers of personal data to the USA. SaaS suppliers and SaaS customers will still need to :

  • Have in place supplemental measures; and
  • Document data transfer impact assessments, (DTIAs) for any restricted transfers of personal data that rely upon SCCs that they make to other countries outside of the EEA, for example: Australia, Singapore etc.

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com

www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – Does your DPA and Sub-Processor List need updating?

Meta were fined 1.2 billion Euros for breaches of EU data protection law and for transferring personal data of EU users to the US despite, using standard contractual clauses, (SCCs), having in place supplemental measures and carrying out data transfer impact assessments, (DTIAs). Google has also been pursued in various EU member states for similar breaches.

In light of these decisions, SaaS suppliers should review their own data protection practices and documentation to ensure that they are up to date and comply with the current rules.

Use of the correct SCCs

New EU SCCs

Since the 27th of December 2022 the new EU SCCs must be used for all transfers of EU personal data to a third country. Any SaaS agreements that still include the old EU SCCs must be updated to include the new EU SCCs.

New UK SCCs

All SaaS agreements concluded on or before the 21st of September 2022 must use the new UK SCCs.

SaaS suppliers and SaaS customers can only continue to use the old EU SCCs in existing SaaS agreements until the 21st of March 2024 provided that the processing operations that are the subject matter of the agreement remain unchanged.

Supplemental Measures

In addition to using the correct, and up to date SCCs, SaaS suppliers must carry out due diligence on any sub-processors they plan to use to process personal data, where the sub-processors rely upon SCCs to transfer personal data outside of the EEA. Details of the supplemental measures used must be included in the sub-processor list.

The only supplemental measures that are compliant with the European Data Protection Board, (EDPB) guidelines are:

  • Encryption of data at rest and in transit; and
  • Storage of encryption keys within the EEA.

Data Impact Transfer Assessments

Following the Schrems II decision, the court made clear that SaaS suppliers and SaaS customers must carry out and document data transfer impact assessments when using SCCs as a transfer mechanism for restricted transfers.

SaaS suppliers should check their Article 30 GDPR data mapping document to identify which sub-processors rely upon SCCs, then they must;

  • Carry out a Schrems II data transfer impact assessment, for each transfer from the EU;
  • Carry out an ICO data transfer assessment for each transfer from the UK, (DTA) using the ICO tool or using an EU DTIA.

Summary

When reviewing compliance with the above rules SaaS suppliers and SaaS customers should not just check their SaaS agreements with customers. They will also need to review existing group data transfer agreements and existing agreements and DPAs with all third parties, i.e. suppliers, resellers, partners and sub-contractors.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements: EU-US Adequacy Decision – Update

Following the Schrems II judgment, the EU-US Privacy Shield was declared invalid, meaning that SaaS suppliers and SaaS customers have to use standard contractual clauses (SCS) or BCRs when making transfers of EEA (or UK) personal data to the USA. In addition, SaaS customers and SaaS suppliers are required to carry out a data transfer impact assessment (DTIA) prior to transferring any personal data from the EEA or UK to a “third country” i.e. the USA.

New US Adequacy Decision

In December 2022, the European Commission published its draft adequacy decision for the new EU-US Data Privacy Framework (DPF). If the European Data Protection Board (EDPB), the EU Member States and the European Parliament approve the DPF, the USA will be granted adequacy by the EU Commission and SCCs and BCRs will no longer be required for transfers of EEA personal data to the USA.

The final adequacy decision of the EU Commission is expected to be made by July 2023.

Similar to the EU-US Privacy Shield, companies in the USA can choose to join the DPF and must commit to certain privacy obligations.

Unlike the EU-US Privacy Shield, the DPF now:

  • limits access to EEA personal data by US intelligence agencies to what is necessary and proportionate; and
  • provides an independent and impartial complaints mechanism and a Data Protection Review Court.

UK Adequacy Decision

The UK government intends to grant its own adequacy decision for the USA. However, it is likely that the content of a UK adequacy decision may differ from the EU’s adequacy decision.

Schrems Challenge

In light of recent comments made by Max Schrems on the DPF, it is very likely that Mr Schrems will challenge the validity of the DPF in the European Court of Justice on the basis that:

  • the US Data Protection Review Court does not adequately protect data subject’s rights; and
  • the scope of permitted surveillance by US authorities under the DPF is too wide.

If the DPF is challenged, any UK – US adequacy decision would probably also be challenged.

Advantages of using the DPF

If the DPF is granted “adequacy” by the European Commission, SaaS suppliers and SaaS customers can use the DPF instead of relying upon SCCs or BCRs. Furthermore, as the DPF will be recognised in the EU as a lawfully valid transfer mechanism for transfers of personal data to the USA (until declared otherwise by the ECJ). This means that there will be no need for SaaS suppliers and SaaS customers to carry out any data transfer impact assessments (DTIA) in addition.

A legal challenge to any EU-US adequacy decision would probably take a couple of years to be resolved, meaning once in place, the DPF can be used as a valid transfer mechanism for transfers to the USA in the near future, provided that an adequacy decision is issued by the EU Commission.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Retention and Deletion

GDPR Obligations

In compliance with their respective obligations under the GDPR, SaaS suppliers and SaaS customers must only keep personal data for as long as necessary and as specified to data subjects. SaaS suppliers should include their obligations in relation to retention and deletion of personal data when acting as a data processor in their SaaS agreement and when acting as a data controller in their privacy policy.

Data Retention Policy

In order to determine how long personal data should be kept, SaaS suppliers should create a data retention policy that identifies:

  • the types of personal data it processes; and
  • the purposes for which personal data are processed.

Once this information is collected, a SaaS supplier can then decide how long each type of personal data will be kept. The factors considered in determining retention periods should be recorded in the data retention policy. Exceptions should also be recorded, for example where any personal data may need to be held longer to comply with particular laws that apply to the SaaS supplier.

Personal data must then be deleted in accordance with the data retention policy.

When to Delete

Before a SaaS supplier deletes any personal data, they should:

  • identify the relevant personal data to be deleted;
  • consider whether any personal data needs to be kept for longer; and
  • decide whether the personal data should be permanently deleted or anonymised.

The date of deletion or anonymisation of the personal data should be recorded by the SaaS supplier so that evidence of the deletion can be produced, if required in a later dispute or if a disclosure request is made.

How to Delete

Any personal data must be securely deleted by the SaaS supplier. This includes backup copies of the personal data being deleted.

If any personal data needs to be retained for longer, such data should be anonymised where possible. SaaS suppliers must ensure that any personal data they use to create aggregated statistics or historical analysis is anonymised. Anonymisation means that all personal identifiers are removed from the data, so that is it truly anonymised i.e. it cannot identify an individual even if linked with other information. If truly anonymised, the GDPR does not apply to the date – as anonymised data is no longer personal data.

Remember: Pseudonymised data is still personal data – as individuals can be re-identified from this. The GDPR applies to pseudonymised data.

What to Delete

SaaS suppliers should physically destroy all physical records i.e. shredding or burning. A third party can be used for the destruction process, provided there is a data processing agreement in place between the SaaS supplier and the third party – as the third party will be the SaaS supplier’s processor.

Electronic records such as emails, text messages and recordings will also need to be destroyed.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – EU Standard Contractual Clauses

SaaS Agreements – GDPR – Data Processing Agreement

SaaS Agreements – New UK SCCs – IDTA and UK Addendum

Background

Since the EU-US Privacy Shield was declared invalid in 2020 by the European Court of Justice in the Schrems II decision, SaaS suppliers and SaaS customers have had to use EU standard contractual clauses, (“EU SCCs”) or binding corporate rules (“BCRs”) as the transfer mechanism when transferring personal data from the EEA, UK or Switzerland to a third country. A third country is a country which the EU has determined does not have laws that protect personal data to the same standard as the EU and is therefore not deemed “adequate” by the European Commission, for example, the USA.

The EU SCCs were drafted more than 10 years ago and were not really suitable for the actual types of data transfers that SaaS customers and SaaS suppliers make today under complex cloud computing models. Accordingly the EU created a new version of the EU SCCs.

New EU SCCs

On the 27th of June 2021, the European Commission replaced the existing EU SCCs with new EU SCCs. The new EU SCCs cover four different transfer scenarios in one document:

  • Controller to controller – module 1
  • Controller to processor – module 2
  • Processor to controller – module 3
  • Processor to processor – module 4

However, the new EU SCCs only apply to international transfers of personal data from the EEA (not the UK) to third countries. The UK continued to use the “old” EU SCCs for international transfers of personal data from the UK to third countries. The UK has now created new UK SCCs.

New UK SCCs

The Information Commissioner’s Office (“ICO”) on the 21st of March 2022 and has advised that the new UK SCCs must be used instead of the “old” EU SCCs for transfers of personal data from the UK to third countries.

The new UK SCCs consist of two separate documents:

SaaS suppliers and SaaS customers can choose whether to use the IDTA or the UK Addendum.

IDTA

The IDTA is designed to enable SaaS suppliers and SaaS customers to transfer personal data from the UK to a third country, i.e. the USA.

UK Addendum

The UK Addendum is an addendum to the EU SCCs. It is designed to enable SaaS suppliers and SaaS customers to transfer data from the EU and the UK using the new EU SCCs, by incorporating the UK Addendum into the new EU SCCs. The UK Addendum allows SaaS suppliers and SaaS customers to use the new EU SCCs to cover both transfers, avoiding the need to use both the EU SCCs and the IDTA.

When must the new UK SCCs be used

SaaS suppliers and SaaS customers can continue to use the old EU SCCs until the 21st of March 2024 for all agreements concluded on or before the 21st of September 2022, provided that the processing operations that are the subject matter of the agreement remain unchanged.

All agreements concluded after the 21st of September 2022, must either use: (i) the IDTA; or (ii) the UK Addendum together with the new EU SCCs.

IDTA or the UK Addendum?

The choice will largely depend upon the locations of the SaaS supplier, SaaS customer, their group companies and the countries to which each transfers personal data.

Where a SaaS supplier transfers personal data from both the EU and the UK, it makes sense to use the UK Addendum, as:

  • The EU SCCs can be used for transfers from the EU and from the UK (with a UK Addendum added for the UK transfers);
  • This makes the drafting of the SCCs much simpler;
  • This should reduce discussions between SaaS customers and sub-processors;
  • This will make the contractual provisions for all personal data transfers more consistent.

Where a SaaS supplier only transfers personal data from the UK to third countries, or most transfers are from the UK, use of the IDTA makes sense, as:

  • The SaaS agreement is incorporated into the IDTA;
  • The structure is simpler to follow and does not include the complicated modular approach of the new EU SCCs;
  • More flexible commercial provisions can be added to the IDTA.

Where a US SaaS supplier transfers personal data from both the EU and the UK, the UK Addendum should be used.

Actions to take now

SaaS suppliers and SaaS customers will need to take the following steps to implement changes to their existing data processing agreements to add the UK Addendum or IDTA, as appropriate, in line with the above time lines. They will need to:

  • Carry out a data mapping to identify international data transfers from the EU and UK;
  • Identify the data transfer mechanism relied upon for each transfer to a third country;
  • Carry out a Schrems II data transfer assessment, (“DTA”) based on the guidance from the EDPB for transfers relying upon SCCs or BCRs;
  • Carry out an ICO data transfer assessment for each transfer from the UK, (“DTA”) in due course using the template and tool being created by the ICO, see: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/;
  • Decide whether to use the UK Addendum or the IDTA for personal data transfers from the UK;
  • Review existing group data transfer agreements;
  • Review existing DPAs with all third parties i.e. customers, suppliers and sub-contractors;
  • Use the UK Addendum or IDTA for all new agreements from the 21st of September 2022;
  • Ensure the UK Addendum or IDTA is added to all existing agreements before the 21st of March 2024

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Cookies – Are your Cookie Banners Compliant

SaaS suppliers and SaaS customers should take note of three recent data protection fines issued against Facebook and Google by the French Data Protection Authority (“CNIL“) for non-compliant cookie banners on their websites.

The fines were issued pursuant to breaches of French Data Protection Law and the GDPR and highlight common non-compliant cookie banner practices that many websites use.

Fines imposed

Google were fined €150 million and Facebook €60 million.

In assessing the amount of the fines, CNIL took into account:

  • The number of users;
  • The revenue the companies raised from advertising indirectly generated by the data collected from the cookies; and
  • The fact that CNIL had repeatedly warned Google and Facebook that they were in breach.

Google

In January 2022 Google LLC and Google Ireland Limited were fined €90 million and €60 million respectively for failing to make it as easy to reject the use of cookies in their cookie banners as it was to accept the use of cookies on google.fr and youtube.com.

Consent Method

The cookie banner displayed on both websites contained a button allowing immediate acceptance of cookies, but no similar means were offered to enable a user to as easily refuse the use of cookies, as:

  • To refuse cookies, users had to perform at least five actions
    clicking on the ‘customise’ button, then clicking on each of the three buttons to select ‘disabled’ – each button corresponding to ‘personalization of the search’, ‘YouTube history’, and ‘ad personalisation’, and finally clicking on ‘confirm’;
  • To accept cookies users simply needed to click once on ‘I accept’

Breaches

The mechanism for refusing cookies was more complex than the mechanism for accepting cookies. Under French data protection law this amounted to discouraging users from refusing cookies and encouraging them to favour the “I accept” button.

In addition to fining Google, CNIL:

  • Ordered Google to make their website compliant within three months; and
  • Provided for additional fines of €100,000 per day to be imposed for non-compliance following the end of the 3 month period.

Facebook

In January 2022 Facebook Ireland Limited (now Meta Platforms Ireland Limited) was fined €60 million for failing to make it as easy to reject consent to the use of cookies as it was to accept cookies on facebook.com.

Consent Method

When a user accessed facebook.com, a pop-up window “Accept cookies from Facebook in this browser” appeared. Two buttons “Manage data parameters” and “Accept all” appeared at the bottom of the window. In order to continue browsing, the user was obliged to click on one of the two buttons.

  • If the user clicked the “Accept all” button they could continue browsing;
  • If the user clicked the “Manage data settings” button, a new pop-up window appeared, displaying 2 consent slider buttons relating to personalised ads. The two sliders were disabled. However the user had to click on the “Accept cookies” button at the bottom of this window, to continue browsing without any advertising cookies being set.

Breaches

The General Data Protection Regulation, (“GDPR”) states that consent:

  • Must be a freely given, specific, informed and unambiguous indication of the data subject’s wishes by a statement or by a clear affirmative action – Article 4(11);
  • Should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment – Recital 42.

Facebook’s cookie banner did not allow users to refuse cookies with the same degree of simplicity as required to accept them, in breach of the above rules on obtaining consent freely.

In addition to fining Facebook, CNIL:

  • Ordered Facebook to modify its methods for collecting consent to the use of cookies by offering users a means of refusing cookies as simple as the mechanism provided for acceptance of cookies; and
  • Provided for additional fines of €100,000 per day to be imposed for non-compliance following the end of the 3 month period.

CNIL also decided to publish this decision despite Facebook requesting that it did not do so. CNIL justified publication on the grounds of the seriousness of the infringement in question, the scope of the processing, and the number of people concerned.

Summary

In light of the above, SaaS suppliers and SaaS customers should ensure that their cookie banners are not adopting such practices. Many EU member state data protection authorities are now pro-actively checking cookie banners and are imposing larges fines and enforcing compliance for breaches.

Many national data protection authorities have published their own detailed cookie guidelines and these guidelines should be followed in the applicable jurisdiction.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – FAQs – Cookies

What is a Cookie?

Cookies are small text files placed on a user’s hardware device, such as a computer, tablet or mobile phone which record online activity. The majority of websites use cookies to measure visits and the use of websites (analytics cookies). Cookies are often also used to save user names, passwords and user preferences to make repeated use of a website more comfortable for the user. However, increasingly cookies are being used to collect information about users for the purposes of targeted marketing, tracking and other non essential purposes.

Opt In Consent Required

It is unlawful to use cookies to collect user data without first obtaining consent. There is an exception when a cookie is strictly necessary for a service which a user has requested i.e. where a user places an item in an online shopping basket and there is the need to ensure that payment is for the goods actually purchased.

Compliance and Fines

The UK Information Commissioners Office (ICO) investigates and prosecutes companies for breaches of the Privacy and Electronic Communications (Amendment) Regulations and the GDPR. These two laws set out the obligations of website operators to provide users with information about cookies and any other similar techonlogy that track use of a website and the need to obtain obtain a user’s consent to the use of cookies. Failure to comply with the rules can result in GDPR fines.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – Schrems II: Data Transfer Assessments

SaaS suppliers are now required to map all personal data that they process and carry out a data transfer assessment (DTA) prior to making any international transfers of personal data to a “third country”. A third country is a country outside of the EEA, that does not have an “adequacy” decision from the EU. i.e. the USA. This is due to the Schrems II judgement and the final European Data Protection Board (EDPB) Schrems II guidance on international data transfers.

Map all Data Transfers

Before a SaaS supplier or SaaS customer can transfer any personal data to a country outside the EEA they must identify and map all personal data used in their business. This includes mapping all controller to controller transfers, controller to processor transfers, processor to processor transfers and processor to controller transfers.

  • A controller to controller transfer takes place when a SaaS supplier makes lead referrals to a company, or shares personal data with another SaaS supplier.
  • A controller to processor transfer takes place when a SaaS customer transfers personal data to a SaaS supplier when using their cloud services.
  • A processor to processor transfer takes place when a SaaS supplier transfers personal data to its sub-contractors, for example to a data centre, email services or backup provider.

Verify the Transfer Mechanism

Once personal data has been mapped SaaS suppliers and SaaS customers must identify whether any transfers of data are made to outside of the EEA. Where such international transfers are made the transfer tool relied upon must be identified. The possible transfer tools are:

  • the transfer is made to a country with an adequacy decision from the EU Commission i.e. a transfer of personal data is made from the EU to the UK; or
  • the transfer is made using SCCs;
  • the transfer is made pursuant to Binding Corporate Rules (BCRs); or
  • the transfer is based on an Article 49 derogation, such as consent.

Assess the Effectiveness of the Transfer Mechanism

Where the transfer mechanism used is SCCs, the SaaS supplier and SaaS customer must assess whether the transfer tool provides a level of protection in the third country “essentially equivalent” to the EEA protections. They must assess whether there is anything in the law and/or practice in force in the third country that impinges on the effectiveness of the SCCs. For example: requests made to a US company under Section 702 of the U.S. Foreign Intelligence Surveillance Act (FISA) by US intelligence agencies to access data without a data subject’s consent or knowledge.

The level of protection should be assessed not just when the data is imported into the third country, but also when in transit (i.e. during the process of data being transferred). In other words, where public authorities in a third country, can access data with or without the data importer’s knowledge, through the importer or through any telecommunications providers.

The assessment should include:

  • consideration of any legislation and practices relevant to the specific data transferred; and
  • the documented practical experience of the data importer with respect to relevant prior access requests made by public authorities in the third country.

Where the data importer or data exporter is subject to “problematic legislation”, transfers are still permitted where:

  • the data exporter has no reason to believe such legislation will be applied in practice to the data exporter or data importer; or
  • supplementary measures can be implemented.

The data importer must provide the data exporter with relevant sources and information on local laws and data practices. All sources must be relevant, objective, reliable, verifiable and publicly available or otherwise accessible and clearly documented. Annex 3 of the SCCs includes a non-exhaustive list of such sources.

Identify and Implement Supplementary Protection Measures

Supplementary protection measures must be adopted if the data transferred is not afforded a level of protection “essentially equivalent” to the EEA level of protection.

The EDPB guidance provides a non-exhaustive list of examples of technical, organizational and contractual supplementary measures and case studies with examples of technical measures that would or would not be effective. SaaS suppliers and SaaS customers should be aware that transfers of unencrypted data to cloud services or other processors when providing SaaS services are not protected or equivalent, if there is any “problematic legislation” in the third country “in practice”.

Actions to Take

SaaS suppliers and SaaS customers now need to:

  • carry out a data mapping exercise to identify all data transfers;
  • identify and assess the transfer mechanisms used to transfer data to third countries;
  • review and amend technical and organisational measures and implement supplementary protection measures where necessary;
  • use new SCCs in all new contracts entered into from 27th of September 2021;
  • replace the current SCCs with the new SCCs in all existing contracts by the 27th of December 2022.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – New EU Standard Contractual Clauses

The new EU Standard Contractual Clauses (new SCCs) must now be used by all SaaS suppliers and SaaS customers who transfer personal data from the EU to countries outside the EU/EEA (third countries) as the old SCCs (old SCCs) were repealed on the 27th of September 2021. Below is a summary of the changes and measures that SaaS suppliers and SaaS customers need to take to adapt and implement the new SCCs.

What are EU Standard Contractual Clauses

EU standard contractual clauses are standard data processing agreements that have been approved by the EU Commission as providing adequate protection for the transfer of personal data from the EEA to a third country – known as a restricted transfer. Until the 27th of September 2021 there were two sets of standard contractual clauses: (i) for transfers of personal data between data controllers; and (ii) for transfers between a data controller and a data processor.

New SCCs must be used where EU personal data is transferred from:

  • A data controller (SaaS customer) to a data processor (SaaS supplier) located outside of the EEA; or
  • A SaaS supplier (data processor) transfes EU personal data to a sub-processor located outside of the EEA;

The SaaS supplier will need to enter into the new SCCs with the SaaS customer or SaaS sub-processor, as applicable.

When must the new SCCs be used?

From the 27th of September 2021 all new data processing agreements with customers and suppliers (including inter-company agreements) must use the new SCCs. SaaS suppliers and SaaS customers can continue using the old SCCs for existing agreements until the 27th of December 2022. On or before the 27th of December 2022 all old SCCs must be replaced with the new SCCs.

How are the new SCCs different?

The new SCCs cover 4 different types of transfers:

  • controller to controller;
  • controller to processor;
  • processor to processor;
  • processor to controller.

SaaS suppliers and SaaS customers must adapt and customise the 4 modules as required for each customer, supplier or inter-company data transfer, as applicable.

No separate DPA required

The new SCCs include all of the provisions that must be included in a written data processing agreement under Article 28 of the GDPR. This means that the new SCCs can be used without the need for any additional DPA. However, SaaS suppliers and SaaS customers should still have an overarching data transfer agreement that the new SCCs form a part of, in appropriate cases, as the new SCCs have very onerous provisions that should only apply to transfers of EU personal data.

Obligations of the Parties

Each of the 4 modules sets out the different data protection obligations of the parties which will need to be customised for each applicable module, or deleted if a module does not apply.

Security Measures

Specific technical and organisational measures (TOMs) must be described in Annex II of the new SCCS, clearly indicating which specific measures apply to each transfer.

Competent Supervisory Authority

The data importer agrees to accept the authority of the competent data protection authority named in Annex I of the new SCCs, respond to its enquiries, comply with the measures adopted by the data protection authority and submit to audits by the data protection authority.

The data protection authority of the data exporter, not the data importer will be the competent supervisory authority.

Where the data exporter is not located in the EU, but is subject to the GDPR the supervisory authority will be that of:

  •  the country in which the data exporter’s EU representative is established; or
  • the EU country in which the data subjects whose personal data is transferred are located, where no EU representative is required under the GDPR.

Local Law Assessment and Documentation – Schrems II

The data exporter and data importer must warrant that they have completed a data transfer assessment (DTA) of the local laws in the third country to which EU personal data will be transferred, where SCCs (of BCRs) are relied upon as the lawful basis for the transfer. They must also warrant that they have no reason to believe that such laws would prevent the importer from complying with their obligations under the new SCCs.

The parties must document this DTA (known as a “Schrems II assessment”) and make the DTA available on request, to a data protection supervisory authority.

Access by Public Authorities

Data importers must comply with the contractual obligations set out in the new SCCs if they receive a binding request from a public authority for disclosure of personal data. This includes notifying the data exporter, documenting responses and requests, providing periodic reporting to the data exporter, and challenging requests, if the data importer determines that any access request is unlawful.

Third Party Beneficiaries

Data subjects can make direct claims and complaints against the data importer for breaches of the new SCCs.

Liability

The data exporter and data importer are jointly and severally liable for breaches of the new SCCs. Each party is also liable to the other and data subjects for breaches of the new SCCs.

Onward Transfers

These are only permitted where the third party receiving the personal data signs the new SCCs or is established in a country that is “adequate”, such as the UK.

What about the UK

The new SCCs cannot be used for UK personal data. The old SCCs adapted by the UK Data Commissioner(ICO) must be used in relation to all UK personal data.

Implementing the New SCCs

In order to implement the new SCCs SaaS suppliers and SaaS customers need to:

  • carry out a data mapping exercise to identify all personal data transfers;
  • carry out and document a Schrems II data transfer assessment for each transfer using SCCs or BCRs;
  • review and amend their technical and organisational measures used for protecting personal data transferred to third countries;
  • identify and review all existing contracts and template agreements that involve the transfer of EU personal data to a third country;
  • amend all exisitng DPAs to incoporate the new SCCs;
  • adapt and customise the new SCCs and their Annexes for transfers to and from customers, suppliers and inter-group companies;
  • use the new SCCs for all new contracts entered in from 27th of September 2021;
  • replace the old SCCS with the new SCCS in all existing contracts by the 27th of December 2022.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: