Category: Data Protection

SaaS Agreements – Data Protection – Prism and US Laws

SaaS suppliers should be aware of relevant US laws when outsourcing SaaS services (data storage and hosting) to US companies or companies located in the USA. SaaS customers are becoming increasingly concerned about outsourcing in the USA following media reports about “Prism”. Namely, that the National Security Agency (NSA) accesses personal data stored on the servers of Microsoft, Apple, Google, Yahoo, Facebook and a few other major US public companies. Below is a summary of the most relevant US laws that SaaS suppliers should be aware of.

FISA

If you outsource any SaaS services to a US public company the US government can access SaaS customer data pursuant to the Foreign Intelligence Security Act (FISA).

FISA allows the US government to access and monitor the personal data of non-US citizens (located outside of the USA) held by US public cloud providers (i.e. Amazon or Google). Public cloud providers must secretly provide all assistance, facilities and information requested by the government if they request access to SaaS customer data. The public entity is not permitted to inform the SaaS supplier that it has disclosed or been asked to disclose personal data, nor that the data is being monitored.

The Patriot Act

If you are a SaaS supplier owned by a US parent company or you outsource any SaaS services to a US located data centre or a US based company, US law enforcers can access SaaS customer data pursuant to the Patriot Act.

The Patriot Act gives US law enforcement authorities the right to access personal data held by SaaS suppliers, regardless of where in the world the data is stored. The Act also gives US law enforcers the right to prevent SaaS suppliers from informing their customers that they have handed over personal data. The Act applies not just to SaaS suppliers owned by a US company but also to any SaaS suppliers using the services of a US subsidiary for data processing i.e. a US data centre.

HIPAA

If you are a SaaS supplier providing SaaS services to a US customer who is a health care provider you, and your sub-contractors, must comply with the security and privacy obligations of the Health Insurance Portability and Accountability Act 1996 (“HIPAA”).

HIPAA applies to any SaaS supplier who creates, receives, maintains, or transmits protected health information (“PHI”), regardless of whether or not the SaaS supplier actually views the data. HIPAA applies even if the SaaS supplier is not located in the USA. Any subcontractors a SaaS supplier uses i.e. a data centre will also need to comply with HIPAA.

SaaS Suppliers must include the privacy and security obligations set out in HIPAA in their SaaS agreements with US health care provider customers. SaaS suppliers are directly liable for breaches of the HIPAA security and privacy rules, which includes failing to cooperate with DHHS investigations of HIPAA breaches. Liability is strict i.e. a SaaS supplier will be liable regardless of intent. The penalties for breach are severe and a SaaS supplier can be fined up to 1.5 million US dollars for all breaches in any calendar year.

Summary

Under the provisions of the US Patriot Act and FISA the personal data of SaaS customers based in the EU must be shared with US law enforcers without the customer being informed, even though this conflicts with English and EU data protection law. Under HIPAA SaaS suppliers must comply with detailed privacy and security provisions of a US law applicable to the health care industry or face severe fines.

It is therefore important that SaaS suppliers ensure they are aware of the extent of any US laws they will be subject to when:

  • contracting with US SaaS customers; or
  • outsourcing SaaS services to companies linked to or based in the USA; or
  • if they have a parent company based in the USA.

SaaS suppliers should have procedures and measures in place to deal with any applicable US laws. These procedures need to be set out clearly in the terms of the SaaS agreement with the Customer, bearing in mind mandatory obligations to comply with US laws.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

Other related articles:

SaaS Agreements – Data Protection – HIPAA

On January 25th 2013, the US Department of Health and Human Services modified the rules of the Health Insurance Portability and Accountability Act 1996 (“HIPAA”). HIPAA applies to any SaaS suppliers who process protected health information (“PHI”) on behalf of customers to whom the Act applies, regardless of whether or not the SaaS supplier is located in the USA.

HIPAA

HIPAA is a US law that places security and privacy obligations on “covered entities” in the health care field e.g. SaaS customers who are health care providers. If you are a SaaS supplier who processes PHI on behalf of a covered entity you will also be subject to the provisions of HIPAA, if you are a “business associate”.

A SaaS supplier is a “business associate” under HIPAA if it “creates, receives, maintains, or transmits” PHI even if it does not view the PHI or only does so on a random or infrequent basis. Also, any subcontractor i.e. the data centre of the SaaS supplier will be a business associate for the same reason.

Business Associates

The importance of being a business associate is that it is now mandatory for SaaS Suppliers, who are business associates to include terms covering their privacy and security obligations under HIPAA in their SaaS agreements with customers. Also, SaaS suppliers are now directly liable for breaches of HIPAA’s security and privacy rules, which includes failing to cooperate with DHHS investigations of HIPAA breaches.

Liability is strict i.e. a SaaS supplier will be liable regardless of its intent. The penalties for breach are severe and can be up to 1.5 million dollars for all breaches in any calendar year.

How to Comply with HIPAA

SaaS suppliers cannot ensure that their SaaS customers comply with HIPAA as they have no control or sometimes do not even know what data users are uploading and what particular regulatory requirements apply to users and their data, especially where users are located outside of the UK or are subject to industry specific regulations.

Therefore if you are a SaaS supplier offering SaaS services to the US health care and insurance sector and your customers are subject to HIPAA you should:

  • Consider amending the design of your SaaS software to make it more appropriate for dealing with PHI and to support compliance with HIPAA obligations;
  • Try to physically prohibit PHI from being uploaded into and stored on your SaaS system;
  • Include clauses in your SaaS agreement which prohibit SaaS customers from uploading PHI;
  • Include a SaaS customer indemnity in your SaaS agreement to protect you against any claims for breaches of HIPAA;

By drafting standard business associate clauses for inclusion in your SaaS agreement with customers and your agreements with relevant subcontractors you may be able to limit your liability for breaches of HIPAA and avoid your customers trying to impose their own more onerous clauses upon you.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

 

SaaS Agreements – Data Protection – Safe Harbor Still Adequate

Recently, the Department of Commerce’s International Trade Administration (ITA) – a US government body – published a document confirming that any SaaS suppliers based in the US (and/or SaaS suppliers using a data centre located in the US) who are “safe harbor” registered must be recognised as having an “adequate” level of data protection. The ITA rejected the view that EU data protection authorities can unilaterally refuse to recognise safe harbor certification as a valid means of demonstrating that a SaaS supplier based in the US (and/or SaaS suppliers using a data centre located in the US) has an adequate level of data protection.

Background

Under current EU data protection laws, SaaS suppliers cannot send personal data outside of the EEA (the 28 EU member states plus Norway, Iceland and Liechtenstein) unless adequate protections have been put in place or where the destination country is pre-approved as having adequate data protection. Only the following countries are pre-approved and recognised as having adequate protection: Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and Japan.

EU Position

Last year the Article 29 Working Party, a EU privacy body, claimed that SaaS customers based in the EU needed to see actual evidence that US SaaS suppliers (and/or SaaS suppliers using data centres in the US) complied with safe harbor standards. They claimed it was not enough for SaaS customers to simply rely on the fact that a SaaS supplier was registered under the safe harbor scheme.

ITA Position

The ITA disagrees with the above position. The ITA points out that the same rules apply to all SaaS suppliers under EU data protection laws regardless of whether or not they are located within the EEA, an ‘adequate’ country or are safe harbor registered. As the safe harbor framework is binding on all countries within the EEA additional requirements cannot be imposed exclusively on US SaaS suppliers (and/or SaaS supplier using data centres in the US).

Additionally, safe harbor SaaS suppliers (and/or SaaS suppliers using data centres in the US) are not obliged to use the EU model clauses in order to be recognised as adequate, as these are simply for use as an alternative approach to safe harbor. Moreover, they were specifically designed to address the adequacy requirement where safe harbor is not an option.

Additional Requirements

The ITA accepted that US SaaS suppliers (and/or SaaS suppliers using data centres in the US) must enter into a basic processing agreement with SaaS customers (which could form part of the SaaS agreement) but only to ensure that the SaaS supplier has sufficient instructions regarding use of the personal data. This requirement applies to all SaaS suppliers.

Additional requirements could only be imposed if these were required under other applicable laws. For example, under the Markets in Financial Instruments Directive (MiFID) if a US SaaS supplier (and/or SaaS supplier using data centres in the US) enters into a SaaS agreement with a SaaS customer who is providing financial services the terms of the SaaS agreement must guarantee the SaaS customer physical access to the US premises at which data is being processed.

Summary

SaaS suppliers who have SaaS customers querying their “adequacy” and compliance with EU data protection laws can use the ITA document to confirm that safe harbor registration does provide “adequate” protection. Along with the terms of the SaaS agreement, which will include specific data processing obligations, SaaS customers should be satisfied that processing in the US under safe harbor is adequate.

In addition, the European Commission has indicated that safe harbor will continue to be deemed “adequate” in the final version of the new proposed EU Data Protection Regulation.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – FISA Customer Concerns

SaaS suppliers who use US public cloud providers to store, process or host their SaaS customer’s data as part of their SaaS services may now experience customers raising concerns about the risk of disclosure to, and monitoring of, their data by the US government under the Foreign Intelligence Security Act (FISA).

FISA

FISA (a US law) gives the US government the right to access and monitor the personal data of non-US citizens (who are located outside of the USA) held by US public cloud providers (i.e. Amazon or Google), without a warrant for a period of up to one year, for the purposes of acquiring foreign intelligence information. Public cloud providers must secretly provide all assistance, facilities and information requested by the government. They are not permitted to inform SaaS suppliers that they have disclosed or been asked to disclose personal data or that it is being monitored.

Breach of European Data Protection Laws

Data protection laws in the 27 countries of the EU all prohibit the disclosure of personal data without a data subject’s consent or knowledge. The provisions of the FISA conflict directly with English and EU data protection laws.

The recent amendment to this US law adds to the concerns raised by the Article 29 Working Party last year in their opinion on cloud computing and data protection. In this opinion, which amongst other things the working party said that EU businesses using cloud services i.e. SaaS customers must ensure that non-EU providers i.e. SaaS suppliers comply with EU data protection laws and that simply relying on a US company’s safe harbor registration was not enough.

FISI is not the only Problem

SaaS customers often falsely believe that their data is “unsafe” due to the fact that SaaS supplier’s use third party data centres to store and process their data. However the risks of personal data being disclosed apply regardless of whether or not data is stored or processed in a SaaS model. Most countries including the UK, France, Spain and Belgium have data disclosure laws that all, not just SaaS suppliers, must comply with. For example in the UK the Regulation of Investigatory Powers Act 2000 (RIPA) requires companies to disclose the content of communications to police forces.

Also data stored or processed anywhere outside of the EEA, in a country which does not have equivalent protection, will be subject to all local disclosure laws i.e. in China and India, and such local laws may be much wider than FISA.

In addition, in the USA notwithstanding FISA, the US authorities can access customer data when it is hosted outside of the USA and there is no company presence in the USA under Mutual Assistance Legal Treaties (MLAT).

Assessing the Actual Risks

SaaS customer concerns about FISA are valid but these must be considered in light of:

  • The type of data SaaS customer’s are providing;
  • The likelihood of the customer data ever being monitored or requested; and
  • The fact that customer data is already subject to similar disclosure obligations to the UK government and foreign governments under other existing laws.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

 

SaaS Agreements – FAQs – Transferring Data Outside the EEA

When negotiating a SaaS agreement with SaaS customers you will often need to transfer customer data outside of the EEA (European Economic Area). This could be at the request of your SaaS customer or more usually because you have a sub-contractor such as a data centre located outside of the EEA. SaaS suppliers should be aware of the following in order to comply with their duties under the UK Data Protection Act 2018 (DPA) and the GDPR.

The GDPR and the Data Protection Act

The GDPR and the UK Data Protection Act 2018 applies to the processing of personal data, i.e. names, email addresses, dates of birth or national insurance numbers of any living individual. The GDPR and the DPA set out different duties for data controllers and data processors. In a SaaS agreement, the customer is always the data controller and the SaaS supplier is their data processor.

Transfer outside of the EEA

The European Economic Area is the 28 EU member states plus Norway, Iceland and Liechtenstein. If data is transferred to any country outside the EEA the specific consent of each data subject whose data is being transferred must be obtained before the transfer takes place, unless the data is transferred to a country recognised by the EU as having adequate data protection laws.

Countries with Adequate Protection

Currently Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and Japan are recognised by the EU data protection authorities as countries with adequate protection. In addition companies registered under the EU-US Privacy Shield regime in the USA are also recognised.

Other ways of Obtaining Consent

Consent can be obtained from data subjects by the SaaS customer including relevant information in its privacy policy and ensuring that its clients actively consent to transfers of their data outside of the EEA when they enter into a contract to use the SaaS customer’s products or services.

Summary

Any transfer of SaaS customer data to any country not set out above will be illegal, unless specific consent has been obtained prior to the data transfer taking place.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Changes to BCRs

The Article 29 Working Party, which represents the European data protection authorities (DPAs), recently announced that data processors (i.e. SaaS suppliers) can now use binding corporate rules (BCRs) to transfer personal data outside the European Economic Area (EEA). Previously the use of BCRs was limited to data controllers (i.e. SaaS customers).

What are BCRs?

BCRs are a set of rules adopted within a particular company or corporate group that set out legally binding obligations in relation to data processing within a company or group which cover global data transfers of personal data. BCRs include amongst other matters, details of:

  • data protection policies;
  • commitments to data protection training;
  • data protection audits.

BCRs must be approved by a lead national data protection authority (DPA), typically determined by the location of the European headquarters of a SaaS supplier. Once the lead national DPA approves the BCRs they are then responsible for coordinating approval of the BCRs with all other DPAs across Europe.

Current Use of BCRs

Around 30 organisations currently have BCRs in place (e.g. eBay, BP and American Express).  By extending the use of BCRs to data processors SaaS suppliers may wish to review the possibility of using BCRs particularly in light of the proposed new Data Protection Directive.

Advantages for SaaS Suppliers

Under the Data Protection Act personal data cannot be transferred to countries outside of the EEA, unless the receiving country has adequate protection. To date only Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and Japan have been deemed “adequate”. Individual companies located in the USA are also accepted as having equivalent protections if they are registered under the Safe Harbor regime. This means that a transfer of data to any other country is not permitted, unless data subjects have given their consent.

The main advantage to SaaS suppliers of using BCRs is that they create a framework under which personal data can be transferred outside of the EEA without the need to negotiate the terms relating to data processing for each SaaS agreement with customers.

If a SaaS supplier has BCRs in place SaaS customers (data controllers) will be able to rely on these BCRs to show that they comply with their duties as a data controller under the Data Protection Act.

Disadvantages for SaaS Suppliers

The major obstacle to the use of BCRs is the time it takes to negotiate and agree their form with the DPAs. Some DPAs still require a permit to be issued before they will allow the transfer of data from that member state. There is also a considerable cost involved in obtaining the approval of the BCRs, as the whole procedure can last a number of years.

Alternatives to BCRs

For the reasons set out above most businesses do not currently use BCRs and choose one of the following options to overcome the obstacles to transferring data outside of the EEA:

  • Safe Harbor arrangement when transferring data to the USA;
  • model contractual clauses with data processors;
  • transfer to a country that is approved by the European Commission as having adequate levels of data protection in place i.e. New Zealand.
  • obtaining specific consent to the transfer from individuals via privacy policies.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Recent ICO Fines

The Information Commissioner’s Office (ICO) has started to issue very high fines to a number of companies and individuals, not just for serious breaches of the Data Protection Act (DPA), but also for breaches of the Privacy and Electronic Communications Regulations (PECR). Below is a summary of the recent fines and the reasons for them being imposed.

Tetrus Telecoms – Fined £440K for sending Illegal Spam Text Messages

Tetrus sent unsolicited text messages to individuals whose numbers they had purchased from lists. Once individuals responded to the spam text, their numbers were then sold on to a third party.

In breach of the PECR, Tetrus were found to be transmitting unsolicited marketing messages (including concealing the identity of the sender). The ICO found that Tetrus was in serious, deliberate and informed breach of the PECR due to the:

  • volume of text messages it sent; and
  • the number of complaints received.

In addition a criminal prosecution is being pursued against the two individuals for breaches of the DPA.

Scottish Council – Fined £250k for failing to Manage Outsourcers

A Scottish council hired a third party to electronically archive its paper employee pension records. Over 600 paper files containing Council employees names, addresses, national insurance numbers, salary and bank account details were dumped in a supermarket’s paper recycling bank once the records had been electronically stored.

The Council was fined for breaching the DPA due to its failure to:

  • have a written contract with the outsourcing company governing the scope of the processing activities; and
  • set out its data security requirements.

In particular, the Council failed to have in place proper technical and organisational security measures governing the processing. It also failed to take reasonable steps to ensure compliance of the third party with these obligations. i.e. that the third party would return or destroy the paper documents after digitally archiving them.

Sony – Fined £250K for Security Lapses

The personal data of millions of UK Sony customers (including names, addresses, email addresses, dates of birth and passwords) was stolen when hackers accessed the Sony PlayStation Network Platform.

The ICO found that in breach of the DPA Sony did not have an appropriate standard of security in place to protect the personal data as it had:

  • failed to take appropriate technical measures (such as cryptographic controls to protect passwords) to prevent the loss of vast amounts of personal data; and
  • stored excessive amounts of personal data.

Sony is currently appealing the decision.

Why these Cases are Important

As a SaaS supplier you will be storing and processing personal data on behalf of your SaaS customers. Under the DPA you are a data processor and you must ensure that you comply with your obligations under the DPA. SaaS customers will often require you to indemnify them for breaches of the DPA in your SaaS agreement i.e. you could become directly liable for ICO fines imposed on your SaaS customers.

How to Avoid Fines

Choose a reputable organisation when outsourcing personal data processing i.e. to a hosting centre.

Have a written contract with the SaaS outsourcer which specifies:

  • that appropriate technical and organisational measures are in place to prevent the unauthorised or unlawful processing of personal data and to protect them against accidental loss, destruction or damage; and
  • that your outsourcer is obliged to report any security breaches or other problems to you.

Note that under the new proposed EU Data Protection Directive (which has not yet been finalised) the ICO will be given the authority to impose much higher fines for breaches of the DPA – up to 2% of a company’s turnover.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

 

 

SaaS Agreements – Data Protection – German Customers and Data Processing Agreements

If you are negotiating sales of SaaS solutions with German customers, you may be surprised by their insistence on having a separate written data processing agreement in addition to your SaaS agreement. This is a mandatory requirement under German data protection law (The BDSG) which imposes onerous obligations far beyond those found in most other EU data protection laws on the SaaS customer and the SaaS supplier.

Obligations under the BDSG

Under German data protection law in addition to many provisions which are similar to those existing under the English law the data processor (SaaS supplier) is also obliged to:

  • keep all personal data secret;
  • take necessary technical and organisational measures (as set out in the BDSG section 9 and its Annex) to protect data;
  • permit automated retrieval processes;
  • appoint a data protection officer who monitors data processing;
  • have a written agreement with the data controller setting out the scope of the personal data being processed, the way in which and the purpose for which personal data is collected, used and processed. The agreement must also specifically set out the issues (listed in section 11(2) of the BDSG) and identify the necessary technical and organisational measures referred to in the Annex to section 9 of the BDSG);
  • permit the SaaS customer to use independent and approved experts to carry out data protection and security audits.

Written Agreement with the Data Processor

There must be a written data processing agreement in place between the SaaS supplier and the SaaS customer. This must set out the technical and organisational measures used by the SaaS supplier for the processing of personal data as generically listed in the Annex to section 9 of the BDSG.

No details or guidelines are provided in the BDSG on what specific information should be included. This will depend on the type of personal data a SaaS supplier stores and the current state of the art at the time you enter into the SaaS agreement with the SaaS customer.

In addition the data processing agreement must specifically include the following:

  • the subject and duration of the processing;
  • the extent, type and purpose of the intended collection, processing or use of personal data;
  • the type of personal data and category of data subjects;
  • the right to rectify, erase and block personal data;
  • any right to sub-contract;
  • the right of the SaaS customer to appoint independent third parties to audit compliance with data protection laws, including the right to publish the results of any audits;
  • the obligation of the SaaS supplier to notify breaches of data protection law; and
  • the return of personal data and deletion.

Appointment of a Data Protection Officer

A SaaS supplier must appoint a data protection officer if it:

  • collects, processes or uses personal data in the course of business for the purpose of transfer or for the purpose of transfer in an anonymised form; or
  • processes sensitive personal data, (e.g., information on a person’s racial and ethnic origin, political opinions, religious or philosophical convictions, union membership, health or sex life) or personal data that is intended to appraise the data subject’s personality are automatically processed.

The appointment of a data protection officer must be made in writing. The data protection officer must monitor the proper use of the data processing programmes and familiarise the persons dealing with data processing with the relevant data protection provisions. The data protection officer is also responsible for providing information on stored data and dealing with data protection complaints.

Secrecy and Confidentiality

The SaaS supplier and its employees involved in collecting, processing or using personal data must give confidentiality undertakings to the SaaS customer that obliges them to keep data secret in the same way as the SaaS customer is obliged to the data subjects during and after the customer contract terminates.

Summary

As this law is specific to German SaaS customers, SaaS suppliers do not need to amend their SaaS terms generally but should instead create a separate data processing agreement specifically for use with German customers.

The advantages of having a separate document are that:

  • this document can be updated as and when the BDSG is changed or amended; and
  • the agreement will be in the form “expected” by German customers.

This will encourage the SaaS customer to sign your data processing agreement rather than giving you their own more onerous version full of extra non-mandatory clauses, such as indemnities and unlimited liabilities.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

 

Website Legal Requirements – Privacy Policy – Basics for your Website

If you are operating a website and require users to register in order to use your website or you are simply using Google analytics on your website then you are collecting and processing personal data. Under the Data Protection Act 1998, if you collect, store or process personal data you must provide specific information to the persons whose personal data you are using. This information is usually provided to users in a privacy policy which should be published on your website.

The following basic issues should be covered in your privacy policy.

Personal Data Practices

Your privacy statement should reflect your personal data practices. For example, it should include details of:

  • The type of data being collected;
  • Why the data is collected;
  • How the data is used and why;
  • If and why personal data will be disclosed to third parties;
  • How and where data is stored;
  • How complaints or queries about personal data will be dealt with.

Cookies

Cookies are small text files placed on a user’s computer which record online activity. Virtually all websites use cookies. Most use analytics cookies to measure visits and use of websites. Performance and functionality cookies are used to make repeated use of a website more comfortable for the user and advertising cookies are increasingly used to collect information about users for targeted marketing.

In your privacy policy you must provide users with clear and comprehensive information about the type of cookies being used on your website and the purposes for which the information is collected.

Where should the Privacy Policy Appear on my Website

The privacy policy should be easy to find on your home page and/or at the point where you obtain consent to the collection of the personal data i.e. where a user registers on your website. It is advisable to have links between the privacy policy and all references made to it on your website. For example, if you are providing online recruitment services you should place your privacy policy on your home page and also have a link to it when users register to use your website or services. In addition you should have a process for the user to confirm acceptance of your privacy policy i.e. by actively clicking an acceptance box or a double opt-in email process.

Compliance with other Laws

You will need to consider your compliance with any other applicable laws or rules, which will apply in relation to the collection of a user’s personal data. Which other laws apply will depend upon a number of factors. For example if you are selling or providing services to children (persons under the age of 18) you must have additional safeguards in place on your website. For example, you will need to obtain parental consent before you collect any personal data for children of certain ages. Or if you are providing services to children which include advertising or marketing you will need to comply with the CAP Code.

The type of products or services that you are offering online and the countries in which you are making these available will also be relevant – as this will determine whether national, EU and/or international laws will also apply to your website. Depending on the business sector in which you operate, the rules of self-regulatory schemes may also apply. For example, if you are providing email marketing services to users you will need to comply with applicable email marketing and advertising rules.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Policies and Procedures

SaaS suppliers must have adequate data protection policies, procedures and checks in place when employees or third parties are handling SaaS customer data or face the risk of being heavily fined by the Information Commissioner’s Office (ICO) for breaches of the Data Protection Act 1998 (DPA).

Torbay Care Trust

A health trust in Torquay was recently fined £175,000 for breaches of the DPA after it accidentally published sensitive date of more than 1,000 staff on its website. The sensitive data contained the names, religion, sexuality, date of birth and National Insurance numbers of employees – which had been collected in an internal diversity response exercise.

Obligations under the DPA

Under the DPA you must have:

  • appropriate organisational measures to prevent the unauthorised use of personal data; and
  • effective policies and procedures for handling personal data,

in place.

The Trust was found to be in breach of both of these obligations, as it had no internal guidance on what should and should not be published online and had no adequate checks in place to identify potential data disclosure problems.

Appropriate Organisational Measures & Effective Policies

In order to avoid similar breaches (and fines) for disclosure of SaaS customer data, SaaS suppliers should have a data protection policy in place that all staff have read, accepted and understood. This should be regularly updated to reflect changes in the law and staff should be provided with basic data protection training on a regular basis.

In addition, SaaS suppliers should have robust procedures in place for managing SaaS customer information. For example access to the customer’s information should be controlled and monitored in order to make the information more secure and thus minimise the risk of any accidental or unauthorised disclosure.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: