Category: Data Protection

SaaS Agreements – Data Protection – Anonymising Data

Many SaaS suppliers use personal data, collected on behalf of SaaS customers, in an anonymised form for their own purposes, for example for benchmarking. The UK Information Commissioner’s Office (ICO) Anonymisation Code and more recently the Article 29 Working Party’s Opinion on Anonymisation provide guidance on how to check that personal data is actually anonymous.

If you are a SaaS supplier using anonymised personal data you should comply with the recommendations in these two guides, to ensure that you are properly anonymising data, otherwise you could be found to be using personal data in breach of the Data Protection Act (DPA).

Personal Data

Any SaaS supplier processing personal data must comply with the Data Protection Act 1998 (DPA). The DPA regulates the disclosure and use of personal data.

Personal data is defined in the DPA as data which relates to a living individual who can be identified from those data. Accordingly, information or a combination of information, that does not relate to and identify a living individual, is not personal data.

Information which is not personal data i.e. anonymised data can be disclosed and used more freely with fewer legal restrictions as the DPA does not apply to it. However, SaaS suppliers should ensure that any personal data they have anonymised and they intend to use, is truly anonymous.

Anonymisation Methods

Most data is anonymised using:

  • randomisation techniques, which alter the veracity of the data in order to remove the strong link between the data and the individual. If the data is sufficiently uncertain then it can no longer be referred to a specific individual; or
  • generalisation techniques, which consist of generalising/diluting the attributes of individuals by modifying the respective scale or order of magnitude (i.e. a region rather than a city, a month rather than a week).

Such methods use the following tools to make data anonymous:

  • noise addition;
  • permutation;
  • differential privacy;
  • aggregation/k-anonymity; and
  • l-diversity/t-closeness.

Risk Assessment

In order to ensure that data is properly anonymised, SaaS Supplier’s should carry out regular risk assessment audits. SaaS suppliers should test their anonymisation and randomisation techniques against the following risks to the re-identification of anonymised data:

  • singling out – is it still possible to isolate some or all records which identify an individual in the data set;
  • linkability – is it still possible to link at least two records concerning the same individual or a group of individuals;
  • inference – can information be inferred concerning an individual from the values of a set of other attributes.

Audits should also assess new risks to re-identification, as over time due to technological developments anonymised data could become re-identifiable in the future.

Pseudonymised Data and Anonymised Data

SaaS suppliers should note that the Article 29 Working Group does not accept that pseudonymised data is equivalent to anonymised data. The reason for this is that pseudonymisation allows:

  • an individual to be singled out; and
  • the individual to be linkable across different data sets.

Summary

Where any uncertainty exists about whether or not re-identification can occur, SaaS suppliers should obtain prior consent from individuals to the use of their anonymised data or they run the risk of breaching the DPA.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Which law applies?

UK SaaS suppliers who provide cloud computing services to SaaS customers located outside of the UK are increasingly being required to comply not just with UK data protection law, but also the data protection laws of the countries in which the SaaS customer and its clients are based. This increasingly creates problems for SaaS suppliers, as data protection laws generally assume that data is stored/processed in one place. However when operating in the cloud data is often moved between jurisdictions and it may be unclear exactly where data is being stored or processed and who is storing and processing it.

Two recent cases involving Facebook and Google show the extent of this developing problem.

Facebook

In February 2014, Facebook, a US owned company, with its European headquarters in Ireland, was ordered to comply with German data protection law. A German court ruled that Facebook must comply with German data protection law before sending emails to German individuals i.e. by obtaining consent even though the processing of the German personal data was carried out by the Irish company.

The German court took the view that Irish data protection law did not apply, as although Facebook had its European headquarters in Ireland, a EU country, the US parent company Google Inc. controlled the processing and was the data controller. Even though the US parent company was located outside of the EU, as it was using ‘equipment’ situated in a EU country to process the personal data i.e. setting cookies on the devices of German users, the national data protection laws of Germany applied.

Google

The European Court of Justice (ECJ) ruled in May 2014 that Google Spain, a Spanish subsidiary of the US parent company Google Inc, must comply with Spanish data protection law when processing Spanish user data, as the Spanish entity was “established” in the EU. Google had argued that because the processing of Spanish user’s personal data was carried out by the US parent company, EU data protection law did not apply.

The ECJ disagreed, arguing that Google Inc had set up a subsidiary in Spain which directed its activities towards Spanish citizens and therefore Spanish data protection law applied, even though Google Inc. was located in the USA.

EU Data Protection Directive

Both of the above cases are based upon the application of EU data protection law (Directive 95/46/EC), to companies who:

  • process personal data;
  • are a data controller; and
  • have an establishment, or use equipment in, a member state of the European Union.

Where a SaaS customer fulfils the above criteria, it will be subject to EU data protection law (and effectively the locally applicable national data protection law of the country in which the user whose personal data is being processed is based).

Summary

SaaS suppliers should be aware that the application of different national data protection laws in the cloud is primarily the problem of a SaaS customer – who is the data controller. However this becomes an issue for the SaaS supplier where the SaaS customer attempts to pass on its cross border data protection obligations to the SaaS supplier within the terms of the SaaS agreement.

Such obligations are usually disguised in the terms of the SaaS agreement by reference to the SaaS supplier complying with „all applicable laws“ or more specifically to the specific data protection laws of named countries. Such terms should not be agreed to, unless the SaaS supplier is:

  • aware of the obligations and penalties imposed by such data protection laws; and
  • sure of its ability to comply with such obligations.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – BYOD

Employees are increasingly using their privately owned devices (i.e. Ipads, tablets, mobile phones and laptops) for business purposes and may be accessing SaaS customer data using them. SaaS suppliers who allow staff to use such “bring your own devices” (BYOD) for work purposes should be aware of their duties to protect any SaaS customer personal data being accessed by staff using such BYODs.

ICO Guidelines

In March 2013 the Information Commissioner’s Office (ICO) published guidelines providing advice on how to protect personal data that is accessed using a BYOD. The Commissioner underlined the fact that SaaS suppliers are obliged to look after personal data for which they are responsible  under the Data Protection Act 1998 (Act) regardless of ownership of the device used to carry out the processing.

In order to protect SaaS customer data and to comply with their duties under the Act, SaaS suppliers who permit staff to access data on a BYOD should:

  • ensure that the BYOD is password-protected;
  • ensure that data is encrypted when it is transferred;
  • ensure that data is encrypted when it is stored; and
  • consider having a BYOD policy for staff.

BYOD Policy

SaaS suppliers should either prohibit BYOD and the ability to access SaaS customer data for work purposes on such devices entirely or they should permit access within the scope of a BYOD policy.

A BYOD policy should contain rules on the use of personal devices by staff, setting out:

  • which employees are allowed to use a BYOD, i.e. senior management;
  • what types of devices may be used;
  • which types of data may be accessed via the device;
  • how devices will be protected against loss, theft or hacking i.e. by requiring the use of passwords, pins and/or encryption;
  • how data should be deleted when an employee leaves or disposes of a device;
  • how and when use of the device will be monitored; and
  • sanctions for breach of the BYOD policy.

Ownership and Deletion of Data

A BYOD policy should also state that any work data i.e. contact details or content i.e. business documents will remain the property of the SaaS supplier. Employees should agree to the SaaS supplier being permitted to:

  • delete work data and content from the device; and
  • make copies of work data and content if an employee leaves the company’s employment.

Summary

SaaS customers are more likely to choose SaaS suppliers who demonstrate that they control and monitor the use of SaaS customer data on BYODs. Having a clear BYOD policy in place will often satisfy a SaaS customer’s concerns about the use and storage of personal data in accordance with the SaaS agreement terms.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Update on the EU Draft Data Protection Regulation

SaaS suppliers should be aware of the recent changes made by the EU Parliament to the draft EU Data Protection Regulation (Regulation). If this amended version of the Regulation becomes law next year the obligations of SaaS suppliers who process personal data on behalf of customers will radically change. A summary of the current main proposed provisions is set out below.

Fines

The proposed fine for breaching data protection law will be increased to the higher of:

  • 5% of annual worldwide turnover; or
  • €100 million

Currently the maximum UK fine for a breach of data protection law is £500,000.

Data Protection Officer

A data protection officer must be appointed where:

  • a SaaS supplier processes the personal data of more than 5,000 individuals in any consecutive 12 month period; or
  • special categories of data, location data, data relating to children, or employee data in large scale filing systems is processed.

The data protection officer must be appointed for:

  • a minimum of 2 years; and
  • meet specific minimum requirements set out in the Regulation.

Notification of Data Protection Breaches

SaaS suppliers must notify breaches of data protection law without undue delay.

Data Processor Obligations

The obligations and duties of SaaS suppliers (data processors) have been more specifically defined. For example SaaS suppliers should:

  • only employ staff who have given confidentiality undertakings or commitments;
  • obtain permission from SaaS customers (data controllers) before employing a sub-processor i.e. using a third party hosting centre;
  • ensure that security measures are implemented; and
  • maintain documentation of all processing operations.

Data Transfers – Prism

The transfer of an individual’s personal data to third parties has been restricted in light of recent revelations about the NSA and Prism. No transfer of personal data will be permitted in relation to a third country court decision or administrative authority (i.e. under the Patriot Act or FISA) if this does not comply with a mutual legal assistance treaty or an international agreement.

Additionally, individuals will have the right to know if their personal data has been disclosed to a public authority.

Territorial Scope

The Regulation will apply to companies located outside of the EU whenever they process the personal data of individuals located in the EU. This means that if a UK SaaS supplier uses a data centre located outside of the EU to host EU SaaS customer data the provisions of the new Regulation will apply to both the SaaS provider and the data centre. For example if a SaaS supplier uses Microsoft to host EU customer data both will be directly subject to EU data protection law.

Right to be Forgotten

This has been changed to the right to be erased. This right will not apply to data which cannot be erased due to the type of storage technology used, provided that the technology was installed prior to the Regulation coming into force.

Summary

The above is a summary of the current status of the draft Regulation. The Regulation may be amended before it becomes law in 2014 and SaaS suppliers should continue to monitor the position to ensure they are ready to adapt their existing procedures and compliance regimes to comply with any change in their legal obligations.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To learn more about SaaS and cloud computing join me at the Berlin CloudConf 2013 on 5th of December.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Email Marketing and Consent

As a SaaS supplier you will undoubtedly be sending marketing emails in your own name to existing and potential clients to advertise your own products and services, or possibly as a SaaS service on behalf of a customer. In any event you should be aware that the Information Commissioner’s Office (ICO) has issued new guidance on direct marketing, with regard to complying with the Data Protection Act (DPA) and the Privacy and Electronic Communications Regulations (PECR) both of which apply to sending direct marketing to consumers (BTC).

Consent

SaaS suppliers must obtain “extremely clear and specific” consent from individuals in order to conduct direct marketing via email or through any other form of electronic marketing i.e. text or via the telephone. SaaS suppliers cannot simply rely upon implied consent unless this is adequate.

Implied consent will not be adequate if:

  • it is obtained via acceptance of a privacy policy which is hard to find, difficult to understand, lengthy, or rarely read;
  • it must be given in order to subscribe to a service;
  • it is not freely given;
  • the individual is not specifically informed about what they are consenting to; and
  • it does not involve a positive action indicating agreement.

Specific Consent

A SaaS supplier must obtain specific consent to the type of communication in question.  For example, if an individual has consented to receive marketing texts a SaaS supplier is not permitted to send marketing emails and vice versa. Also, although a general statement of consent to receive marketing might be valid for email marketing, it will not cover telephone calls or texts as additional rules apply to these forms of marketing under the PECR.

Email Marketing Lists

The ICO guidance specifically refers to the issue of obtaining consent in relation to the use of third party email marketing lists. Often marketing lists are sold to a SaaS supplier or a SaaS customer where the seller claims to have obtained relevant consents from individuals. However, such third party consent cannot be relied upon by the SaaS supplier or the SaaS customer – unless the individual intended their consent to be passed on to the SaaS customer or SaaS supplier (whoever is actually doing the marketing).

SaaS suppliers should also be aware that other regulatory bodies have rules that apply to social media and digital advertising that must also be complied with. For example the Advertising Standards Agency (ASA), the Digital Marketing Association (DMA) and the Office of Fair Trading (OFT) have their own rules.

How to Obtain Consent

SaaS suppliers should use opt-in boxes in order to obtain explicit consent to direct marketing from individuals. Clear records should be kept of all consents, showing when and how such consent was obtained. These records can then be used as evidence if a complaint is made.

On-going Marketing

The context in which consent is obtained will determine whether SaaS suppliers can rely on consent to all future direct marketing via electronic messaging. For example, consent for a one-off message, or consent that is clearly only intended to cover a short period of time or a particular context, will not count as on-going consent for all future marketing messages.

Fines for Breach

The ICO can fine SaaS suppliers up to £500,000 for serious breaches of the DPA or PECR i.e. for sending unsolicited marketing emails, texts or live and automated marketing phone calls.

Therefore if you are a SaaS supplier offering SaaS services to consumers or you have a SaaS customer who uses your SaaS services to send marketing emails to consumers, you need to ensure that you follow the ICO guidance on direct marketing.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To learn more about SaaS and cloud computing join me at the Berlin CloudConf 2013 on 5th of December.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Hosting – Encryption of Stored Data

Under the Data Protection Act (DPA), SaaS customers are required to take “appropriate technical and organisational measures” to prevent the unauthorised or unlawful processing of personal data and accidental loss or destruction of, or damage to, personal data. SaaS providers who process personal data on behalf of SaaS customers are required to include such obligations in their SaaS agreement (or SLA).

Written Obligation

The specific obligations specify that SaaS customers must have a written contract with SaaS providers which states that:

  • the SaaS provider may only process data in accordance with the SaaS customer’s instructions; and
  • the SaaS provider undertakes to comply with the “technical and organisational measures” requirements of the DPA.

Encryption Requirement

Last year the Information Commissioner’s Office (ICO) issued some guidance on cloud computing. Amongst other issues, this advised SaaS customers to ensure that personal data in transit is secure and protected from interception by:

  • encrypting data in transit;
  • using encryption that meets recognised industry standards; and
  • obtaining assurances from SaaS providers that data in transit is appropriately secure.

The ICO also advised that data “at rest” i.e. personal data which is stored, should also be encrypted, depending upon the nature of the personal data held i.e. is it sensitive personal data and the type of processing taking place.

SaaS customers were advised to ensure that encryption keys are:

  • kept up to date, in order to maintain the level of protection; and
  • not lost, as this could render the data useless.

Compliance

SaaS customers are increasingly asking SaaS providers to include data encryption obligations in SaaS agreements. Google cloud services now:

  • automatically encrypts all data before it is stored;
  • regularly updates keys;
  • implements access controls; and
  • permits auditing procedures.

In time this could become standard for all SaaS providers. In any event you may want to check with your data centre, where you are outsourcing hosting and storage to check whether they also offer this service, which is provided to Google cloud service customers at no additional cost.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To learn more about SaaS and cloud computing join me at the Berlin CloudConf 2013 on the 5th December.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – IT Security Requirements

In January 2013 Sony was fined 250,000 GBP for failing to take “appropriate technical measures” to protect the security of personal data stored on its PlayStation Network (PSN) in breach of the Data Protection Act (DPA). In light of the lack of guidance currently provided by the Information Commissioner’s Office (ICO) on data protection security SaaS suppliers should be aware that the ICO plans to draw up new guidelines.

Appropriate Technical and Organisational Measures

Under the DPA, SaaS suppliers must take appropriate technical and organisational measures against the unauthorised or unlawful processing of personal data and accidental loss, destruction or damage to personal data. However there is currently no legal definition, or guidance from the ICO, on what are “appropriate” organisational and technical measures.

In the past the ICO has stated that personal data should be encrypted, if loss or theft of the data would cause damage or distress to the individuals concerned. More recently in the case of Sony, the ICO found that Sony’s software was not up to date and that passwords were not secure.

However, in light of the lack of any specific guidance on this matter, the ICO seems to determine fines based on the facts of each individual case.

Factors to Consider

Often the following factors are taken into consideration by the ICO:

  • the financial resources of a SaaS supplier;
  • the number of individuals whose data is affected;
  • the harm actually caused to those individuals;
  • how a SaaS supplier responds to a breach;
  • what technology the SaaS supplier uses; and
  • any mitigating factors, such as voluntarily reporting of a breach.

How to Avoid Fines

Regardless of what any future guidelines might say, SaaS suppliers should already have in place their own technical and organisational measures. Not only to avoid the risk of incurring a substantial ICO fine, but moreover to prevent substantial damage to their reputation and financial losses which could result from the publication of internal security system failures and vulnerabilities following an ICO investigation. Sony gave this as one of the reasons why they dropped their appeal against the ICO fine.

Measures to be Taken

Such technical and organisational measures should include:

  • cryptographic controls to protect passwords;
  • ensuring that sub-contractors provide sufficient technical and organisational guarantees in writing;
  • carrying out regular security risk assessments;
  • auditing the compliance of sub-contractors with their contractual obligations.

Conclusion

The ICO is increasingly taking action against companies and imposing large fines for breaches of the DPA. In August penalty notices were issued against the Bank of Scotland, Aberdeen City Council and Islington Borough Council. Statistics on the type of companies being targeted, the nature of breaches occurring and levels of fine are published quarterly on the ICO website and SaaS suppliers should review these to see if they are operating in a particular “risky” area.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Advantages of Hosting in Switzerland

SaaS suppliers are increasingly using data centres located in Switzerland to host SaaS software and store customer data. In light of recent media revelations about “prism” and the already existing concerns over access to customer data under the Patriot Act and FISA this could be an increasing trend. The advantages of hosting SaaS data in Switzerland are summarised below.

Why Switzerland?

Switzerland is often viewed internationally as representing the following values – stability, neutrality, discretion and trustworthiness based on its banking history. For this reason Swiss law is often accepted by non-European customers in international agreements when there is a disagreement about which law or arbitration rules should apply to the contract.

Confidentiality

Currently many global SaaS suppliers use data centres located in the USA. However, when dealing with European customers, SaaS suppliers often encounter problems with customers raising concerns about the application of:

  • the Patriot Act, a US law which permits US authorities to access EU customer data stored in the USA or EU customer data stored outside of the US where there is a US parent company such as Microsoft; and
  • FISA which allows the US government to access and monitor the personal data of non-US citizens held by US public cloud providers such as Amazon or Google.

An additional benefit of using a Swiss data centre is that generally data stored in Switzerland is not traceable to a named person, but only to a number.

Safe Harbor not Adequate

SaaS customers and data protection authorities, particularly in Germany, are raising concerns about the adequacy of the safe harbor status of US companies. It is often claimed that safe harbour certification is little more than a paper exercise which in practice does not comply with European levels of data protection.

Compliance with EU Data Protection Laws

An added advantage of using Swiss data centres is that Switzerland is accepted by the EU as having equivalent protection to EU data protection laws. Therefore no additional consents are required from SaaS customers to enable data to be stored and processed in Switzerland.

Language

Although English is not one of the official languages of Switzerland, it is widely spoken and is the language of preference for business transactions. In addition French, German and Italian are official languages providing the added bonus of SaaS suppliers being able to request hosting services in any, or all, of the four languages. This makes Switzerland very attractive to global companies who are often wary of hosting outside of their territory due to language barriers.

Summary

Under the provisions of the US Patriot Act and FISA, the personal data of SaaS customers based in the EU must be shared with US law enforcers without the customer being informed, even though this conflicts with EU data protection law.

By using a data centre located in Switzerland a SaaS supplier can process and store customer data in compliance with EU data protection rules, provided that the hosting company located in Switzerland, is not owned by a US parent company.

For the above reasons some well known global companies such as Swift, Yahoo and Hewlett Packard have in recent years relocated their hosting services to Switzerland.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Prism

In light of recent and ongoing “prism” revelations, SaaS suppliers are having to deal with numerous queries about the safety of SaaS customer data. Many customers mistakenly believe that by using a non-US data centre their SaaS customer data is protected against disclosure to the US authorities. Below is a summary of the relevant laws and most common concerns being raised by SaaS customers.

What is Prism?

“Prism” refers to the National Security Agency (NSA) secretly accessing personal data stored on the servers of Microsoft, Apple, Google, Yahoo, Facebook and some other major US public companies.

Prism, FISA and the Patriot Act

Prism is not the only problem. The US government has been secretly accessing SaaS customer data for years under the Foreign Intelligence Security Act (FISA) and the Patriot Act. Prism is just part of the whole range of tools that are being used by the US to access SaaS data of EU citizens.

What is FISA?

FISA allows the US government to access and monitor the personal data of non-US citizens (located outside of the USA) held by US public cloud providers. Public cloud providers such as Amazon and Google must secretly provide all assistance, facilities and information requested by the government if they request access to SaaS customer data. The public entity is not allowed to inform the SaaS supplier that it has disclosed or been asked to disclose personal data, nor that the data is being monitored.

The Patriot Act

The Patriot Act gives US law enforcement authorities the right to access personal data held by SaaS suppliers, regardless of where in the world the data is stored. The Act also gives US law enforcers the right to prevent SaaS suppliers from informing customers that they have handed over personal data. The Act applies not just to SaaS suppliers owned by a US company but also to any SaaS suppliers using the services of a US company i.e. a US data centre.

Safe Harbor

Safe Harbor does not protect SaaS customer data against secret access by the US authorities. Safe harbor, simply means that a US company registered under the “safe harbor” scheme is deemed to have data protection principles in place which are accepted in the EU as being adequate. This simply allows SaaS customer data to be legally transferred outside of the EU i.e. to be processed in a US data centre.

Summary

Many SaaS customers falsely believe that if their SaaS data is stored in a data centre located in the EU it will be protected against disclosure to the US authorities. Under the Patriot Act, FISA (and “prism” where applicable) the personal data of SaaS customers based in the EU must be shared with US law enforcers without the customer being informed, even though this conflicts with the EU Data Protection Directive and the data protection laws of the 28 EU member states.

Local EU data protection authorities and EU member state governments are currently investigating how to resolve this conflict, for example by adding provisions preventing disclosure in the draft proposed EU data protection regulation. While the position remains unresolved, SaaS suppliers should be considering how to minimise the risk this poses to their business model, whilst assuring SaaS customers that their concerns are being addressed.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Data Controller

It is important for a SaaS supplier to understand the legal obligations imposed upon a data controller when negotiating a SaaS agreement and data processing agreement (“DPA“) as the duties of a data controller are not the same as the duties of a data processor. In a SaaS relationship the SaaS customer is always the data controller and the SaaS supplier is always the data processor of the SaaS customer.

Who is a data controller

A data controller is defined in Article 4(7) of the GDPR as follows:

“the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.”

The data controller always decides and controls the purposes for which personal data is to be collected and processed. A data processor acts on behalf of, and only on the instructions of the data controller.

Controller obligations under the GDPR

The GDPR sets out the following 7 data protection principles that a data controller must comply with.

  • Lawfulness, fairness and transparency;
  • Purpose limitation;
  • Data minimisation;
  • Accuracy;
  • Storage limitation;
  • Integrity and confidentiality (security);
  • Accountability.

Need for a Data Processing Agreement

Since the GDPR and the UK Data Protection Act 2018 came into force on the 25th of May 2018 the obligations of data controllers have become more onerous. It is now mandatory for the data processor and the data controller to enter into a written agreement – DPA, setting out each party’s obligations. The DPA must include specific minimum terms.

Liability for Personal Data

A SaaS customer will be liable to its clients/end users (whose personal data it is collecting and processing) for any breaches of the GDPR. As the SaaS supplier will be carrying out the processing on behalf of the SaaS customer, the terms of the SaaS agreement should include adequate clauses to protect the SaaS supplier and the SaaS customer against data protection breaches, bearing in mind the differing responsibilities of the data controller and the data processor.

Registration under the Data Protection Act

The UK Data Protection Act 2018 requires every data controller who is processing personal data to register with the UK Information Commissioners Office (“ICO“), unless an exemption applies. It is not just a SaaS supplier who must register. A SaaS customer must also register where it acts as a data controller, in addition to being a data processor. Failure to register is a criminal offence.

There is an annual fee for registration. Current fees are determined by the ICO and a self assessment tool on the ICO website can be used to help you determine whether or not you are a data controller who needs to pay the fee.

Subject Access Request

Data subjects (clients of the SaaS customer) have the right to make a subject access request to the data controller.

Information must be provided within strict time limits and at no cost to the data subject. The request is made to the data controller (the SaaS customer) and the SaaS customer is obliged under the GDPR to respond. However, it is often the SaaS supplier who actually needs to provide the information stored on its servers either to the SaaS customer or their clients, on the SaaS customer’s behalf.

General

When considering SaaS customer requests to change clauses relating to liability, indemnities, data and data protection in a SaaS agreement or DPA it is essential that a SaaS supplier understands the statutory obligations of the data controller and data processor and the implications of changing any terms of the SaaS agreement or DPA.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: