Category: SAAS

SaaS Agreements – Data Protection – Does your DPA and Sub-Processor List need updating?

Meta were fined 1.2 billion Euros for breaches of EU data protection law and for transferring personal data of EU users to the US despite, using standard contractual clauses, (SCCs), having in place supplemental measures and carrying out data transfer impact assessments, (DTIAs). Google has also been pursued in various EU member states for similar breaches.

In light of these decisions, SaaS suppliers should review their own data protection practices and documentation to ensure that they are up to date and comply with the current rules.

Use of the correct SCCs

New EU SCCs

Since the 27th of December 2022 the new EU SCCs must be used for all transfers of EU personal data to a third country. Any SaaS agreements that still include the old EU SCCs must be updated to include the new EU SCCs.

New UK SCCs

All SaaS agreements concluded on or before the 21st of September 2022 must use the new UK SCCs.

SaaS suppliers and SaaS customers can only continue to use the old EU SCCs in existing SaaS agreements until the 21st of March 2024 provided that the processing operations that are the subject matter of the agreement remain unchanged.

Supplemental Measures

In addition to using the correct, and up to date SCCs, SaaS suppliers must carry out due diligence on any sub-processors they plan to use to process personal data, where the sub-processors rely upon SCCs to transfer personal data outside of the EEA. Details of the supplemental measures used must be included in the sub-processor list.

The only supplemental measures that are compliant with the European Data Protection Board, (EDPB) guidelines are:

  • Encryption of data at rest and in transit; and
  • Storage of encryption keys within the EEA.

Data Impact Transfer Assessments

Following the Schrems II decision, the court made clear that SaaS suppliers and SaaS customers must carry out and document data transfer impact assessments when using SCCs as a transfer mechanism for restricted transfers.

SaaS suppliers should check their Article 30 GDPR data mapping document to identify which sub-processors rely upon SCCs, then they must;

  • Carry out a Schrems II data transfer impact assessment, for each transfer from the EU;
  • Carry out an ICO data transfer assessment for each transfer from the UK, (DTA) using the ICO tool or using an EU DTIA.

Summary

When reviewing compliance with the above rules SaaS suppliers and SaaS customers should not just check their SaaS agreements with customers. They will also need to review existing group data transfer agreements and existing agreements and DPAs with all third parties, i.e. suppliers, resellers, partners and sub-contractors.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements: EU-US Adequacy Decision – Update

Following the Schrems II judgment, the EU-US Privacy Shield was declared invalid, meaning that SaaS suppliers and SaaS customers have to use standard contractual clauses (SCS) or BCRs when making transfers of EEA (or UK) personal data to the USA. In addition, SaaS customers and SaaS suppliers are required to carry out a data transfer impact assessment (DTIA) prior to transferring any personal data from the EEA or UK to a “third country” i.e. the USA.

New US Adequacy Decision

In December 2022, the European Commission published its draft adequacy decision for the new EU-US Data Privacy Framework (DPF). If the European Data Protection Board (EDPB), the EU Member States and the European Parliament approve the DPF, the USA will be granted adequacy by the EU Commission and SCCs and BCRs will no longer be required for transfers of EEA personal data to the USA.

The final adequacy decision of the EU Commission is expected to be made by July 2023.

Similar to the EU-US Privacy Shield, companies in the USA can choose to join the DPF and must commit to certain privacy obligations.

Unlike the EU-US Privacy Shield, the DPF now:

  • limits access to EEA personal data by US intelligence agencies to what is necessary and proportionate; and
  • provides an independent and impartial complaints mechanism and a Data Protection Review Court.

UK Adequacy Decision

The UK government intends to grant its own adequacy decision for the USA. However, it is likely that the content of a UK adequacy decision may differ from the EU’s adequacy decision.

Schrems Challenge

In light of recent comments made by Max Schrems on the DPF, it is very likely that Mr Schrems will challenge the validity of the DPF in the European Court of Justice on the basis that:

  • the US Data Protection Review Court does not adequately protect data subject’s rights; and
  • the scope of permitted surveillance by US authorities under the DPF is too wide.

If the DPF is challenged, any UK – US adequacy decision would probably also be challenged.

Advantages of using the DPF

If the DPF is granted “adequacy” by the European Commission, SaaS suppliers and SaaS customers can use the DPF instead of relying upon SCCs or BCRs. Furthermore, as the DPF will be recognised in the EU as a lawfully valid transfer mechanism for transfers of personal data to the USA (until declared otherwise by the ECJ). This means that there will be no need for SaaS suppliers and SaaS customers to carry out any data transfer impact assessments (DTIA) in addition.

A legal challenge to any EU-US adequacy decision would probably take a couple of years to be resolved, meaning once in place, the DPF can be used as a valid transfer mechanism for transfers to the USA in the near future, provided that an adequacy decision is issued by the EU Commission.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Retention and Deletion

GDPR Obligations

In compliance with their respective obligations under the GDPR, SaaS suppliers and SaaS customers must only keep personal data for as long as necessary and as specified to data subjects. SaaS suppliers should include their obligations in relation to retention and deletion of personal data when acting as a data processor in their SaaS agreement and when acting as a data controller in their privacy policy.

Data Retention Policy

In order to determine how long personal data should be kept, SaaS suppliers should create a data retention policy that identifies:

  • the types of personal data it processes; and
  • the purposes for which personal data are processed.

Once this information is collected, a SaaS supplier can then decide how long each type of personal data will be kept. The factors considered in determining retention periods should be recorded in the data retention policy. Exceptions should also be recorded, for example where any personal data may need to be held longer to comply with particular laws that apply to the SaaS supplier.

Personal data must then be deleted in accordance with the data retention policy.

When to Delete

Before a SaaS supplier deletes any personal data, they should:

  • identify the relevant personal data to be deleted;
  • consider whether any personal data needs to be kept for longer; and
  • decide whether the personal data should be permanently deleted or anonymised.

The date of deletion or anonymisation of the personal data should be recorded by the SaaS supplier so that evidence of the deletion can be produced, if required in a later dispute or if a disclosure request is made.

How to Delete

Any personal data must be securely deleted by the SaaS supplier. This includes backup copies of the personal data being deleted.

If any personal data needs to be retained for longer, such data should be anonymised where possible. SaaS suppliers must ensure that any personal data they use to create aggregated statistics or historical analysis is anonymised. Anonymisation means that all personal identifiers are removed from the data, so that is it truly anonymised i.e. it cannot identify an individual even if linked with other information. If truly anonymised, the GDPR does not apply to the date – as anonymised data is no longer personal data.

Remember: Pseudonymised data is still personal data – as individuals can be re-identified from this. The GDPR applies to pseudonymised data.

What to Delete

SaaS suppliers should physically destroy all physical records i.e. shredding or burning. A third party can be used for the destruction process, provided there is a data processing agreement in place between the SaaS supplier and the third party – as the third party will be the SaaS supplier’s processor.

Electronic records such as emails, text messages and recordings will also need to be destroyed.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – EU Standard Contractual Clauses

SaaS Agreements – GDPR – Data Processing Agreement

SaaS Agreements – FAQs – EU Standard Contractual Clauses

When entering into a SaaS agreement with a SaaS customer a SaaS supplier will often need to transfer customer data that contains EU personal data outside of the European Economic Area (EEA). This could be at the request of a SaaS customer or more usually because the SaaS supplier uses a sub-contractor located outside of the EEA to provide part of the services on its behalf (as a sub-processor). For example: a data centre, online customer support centre or email service provider provided by a company located in the USA.

SaaS suppliers and SaaS customers must use EU standard contractual clauses in order to comply with their duties under the GDPR when making such restricted transfers of EU personal data.

EU Data Protection Law

The General Data Protection Regulation (GDPR) applies to the processing of EU personal data, i.e. names, email addresses, dates of birth or national insurance numbers of any living individual located in the EU. Data protection law sets out different duties for data controllers and data processors. In a SaaS agreement, the customer is always the data controller and the SaaS supplier is their data processor.

A data controller is not permitted to transfer personal data of EU citizens outside of the EEA unless:

  • it has the specific consent of the data subject,
  • it has entered into binding corporate rules (BCRs),
  • the transfer is to a country which has adequate protection, for example: to the UK, Switzerland, Canada and other countries recognised by the EU data protection authorities as having adequate protection); or
  •  EU standard contractual clauses are used.

EU Standard Contractual Clauses

EU standard contractual clauses are a set out of standard clauses that have been approved by the EU Commission as providing adequate protection, when used to transfer EU personal data from the EU to a third country located outside of the EEA. Up until June 2021 there were two sets of standard contractual clauses that could be used for transfers of personal data between data controllers, and one set for transfers between a data controller and a data processor, (old EU SCCs). There were no clauses for transfers between data processors.

In June 2021 the EU Commission replaced the old EU SCCs with one new set of standard contractual clauses, (new EU SCCs) to cover 4 different types of data transfers in one document in 4 different modules:

  • Module 1: covers transfers from a data controller (SaaS supplier) to a data controller outside of the EEA (third party);
  • Module 2: covers transfers from a data controller (SaaS customer) to a data processor outside of the EEA (SaaS supplier);
  • Module 3: covers transfers from a data processor (SaaS supplier) to a data processor outside of the EEA (sub-processor); and
  • Module 4: covers transfers from a data processor (SaaS supplier) to a data controller (third party) outside of the EEA.

NB/ Please note that whenever EU SCCs are relied upon as a data transfer mechanism a data transfer assessment must also be carried out.

Binding Corporate Rules

Please note that BCRs only cover international transfers of personal data between companies within the same group.

EU-US Privacy Shield

Please note that since the 16th of July 2020, the EU-US Privacy Shield was declared invalid by the European Court of Justice and can no longer be used for the transfer of personal data to US entities.

Summary

Any transfer of personal data by a SaaS customer or SaaS supplier to any country outside of the EEA which is not approved by the EU Commission as having adequate protection will be illegal, unless specific consent is obtained, or the new EU SCCs or BCRs are used AND a data transfer assessment is carried out.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Website Legal Requirements

Does your website comply with the various legal requirements applicable to SaaS suppliers who opeate a UK website?

Below, I have set out the main legal requirements (including some optional recommendations) that apply to a SaaS supplier’s website.

Mandatory Requirements

SaaS suppliers must provide the following information in an easily accessible position on their website:

About Us/Contact Information

  • Legal name of the company i.e. XYZ Ltd;
  • Geographical address of the company;
  • Contact details i.e. telephone number and email address;
  • The country in which the company is registered and the company registration number;
  • Details of any supervisory body who regulates the company i.e. the FSA. For regulated bodies more detailed information is required;
  • If the SaaS supplier is registered for VAT and the VAT number;
  • Clear details of prices and whether or not delivery and/or tax is included (where online sales can be made);

Registration under the Data Protection Act

If a SaaS supplier collects any personal data in the operation of its business, including when visitors use its website such as, email address, name, telephone number or address of a living person, the SaaS supplier is collecting and processing personal data and must register as a data controller under the UK Data Protection Act. It is a criminal offence not to register.

Privacy Policy

If a SaaS supplier collects, stores or processes personal data as a data controller, they must set out how and why personal data is being collected and used in order to comply with the provisions of the UK Data Protection Act and the GDPR. The privacy policy must include:

  • Detailed information about the SaaS supplier;
  • The data being collected and processed; and
  • All mandatory information set out in applicable data protection laws that a data controller is required to provide to a data subject.

Cookie Banner and Cookie Notice

Before any cookie or similar technology used to track use of a website (such a web beacon, pixel etc.) can be placed on a user’s device explicit “opt in” consent must be obtained from the visitor. Consent is obtained via a cookie banner. If no consent is obtained from users no cookies other than essential cookies may be set.

The Privacy and Electronic Communications (Amendment) Regulations and the GDPR set out the obligations of website operators to provide users with information about cookies and any other similar technology that tracks the use of a website and the need to obtain a user’s prior consent to the use of cookies. Failure to comply with the rules can result in GDPR fines. SaaS suppliers must have a cookie banner on their website, they track use of the website and this should contain a direct link to the SaaS supplier’s cookie policy.

Trademarks and Logos

Do not use any third party’s trademarks or logos on your website without the third party’s consent or you could be liable to pay damages for trademark infringement. This includes displaying logos of your SaaS customers, where you do not have their specific consent to use their logos for this purpose.

Copyright

Do not use any third party’s content on your website without the third party’s consent or you could be liable to pay damages for copyright infringements. If you have links to any third party’s content, make sure that this is permitted by the third party’s terms of use and ensure that the information opens in a new frame.

Recommended Requirements

In addition to the above mandatory rules it is advisable for SaaS suppliers to have the following, in addition.

Terms of Use/Disclaimer

SaaS suppliers should set out the rules applicable to persons using and accessing the free goods and services available on their website. For example: state who may access the website i.e. businesses, persons over 18 years old. SaaS suppliers should also aim to limit their liability for information provided on their website. For example: state which law applies and limits on liability.

Copyright Notice

Protect your information on your website by inserting a copyright notice “© company name 2022.  All rights reserved.” Without this notice,  it may be difficult in some countries to take any action against a copyright infringement.

The above are examples of the main legal requirements for SaaS supplier websites. However, this is a very complicated area of law and the specific rules that apply to you will depend on what goods and services you are offering, whether you are acting BTB (business to business) or BTC (business to customer), where your SaaS business is physically located, where your customers are located and many other factors.

Help

If you would like to have your website reviewed for compliance with English law or have any queries about compliance please contact:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – New UK SCCs – IDTA and UK Addendum

Background

Since the EU-US Privacy Shield was declared invalid in 2020 by the European Court of Justice in the Schrems II decision, SaaS suppliers and SaaS customers have had to use EU standard contractual clauses, (“EU SCCs”) or binding corporate rules (“BCRs”) as the transfer mechanism when transferring personal data from the EEA, UK or Switzerland to a third country. A third country is a country which the EU has determined does not have laws that protect personal data to the same standard as the EU and is therefore not deemed “adequate” by the European Commission, for example, the USA.

The EU SCCs were drafted more than 10 years ago and were not really suitable for the actual types of data transfers that SaaS customers and SaaS suppliers make today under complex cloud computing models. Accordingly the EU created a new version of the EU SCCs.

New EU SCCs

On the 27th of June 2021, the European Commission replaced the existing EU SCCs with new EU SCCs. The new EU SCCs cover four different transfer scenarios in one document:

  • Controller to controller – module 1
  • Controller to processor – module 2
  • Processor to controller – module 3
  • Processor to processor – module 4

However, the new EU SCCs only apply to international transfers of personal data from the EEA (not the UK) to third countries. The UK continued to use the “old” EU SCCs for international transfers of personal data from the UK to third countries. The UK has now created new UK SCCs.

New UK SCCs

The Information Commissioner’s Office (“ICO”) on the 21st of March 2022 and has advised that the new UK SCCs must be used instead of the “old” EU SCCs for transfers of personal data from the UK to third countries.

The new UK SCCs consist of two separate documents:

SaaS suppliers and SaaS customers can choose whether to use the IDTA or the UK Addendum.

IDTA

The IDTA is designed to enable SaaS suppliers and SaaS customers to transfer personal data from the UK to a third country, i.e. the USA.

UK Addendum

The UK Addendum is an addendum to the EU SCCs. It is designed to enable SaaS suppliers and SaaS customers to transfer data from the EU and the UK using the new EU SCCs, by incorporating the UK Addendum into the new EU SCCs. The UK Addendum allows SaaS suppliers and SaaS customers to use the new EU SCCs to cover both transfers, avoiding the need to use both the EU SCCs and the IDTA.

When must the new UK SCCs be used

SaaS suppliers and SaaS customers can continue to use the old EU SCCs until the 21st of March 2024 for all agreements concluded on or before the 21st of September 2022, provided that the processing operations that are the subject matter of the agreement remain unchanged.

All agreements concluded after the 21st of September 2022, must either use: (i) the IDTA; or (ii) the UK Addendum together with the new EU SCCs.

IDTA or the UK Addendum?

The choice will largely depend upon the locations of the SaaS supplier, SaaS customer, their group companies and the countries to which each transfers personal data.

Where a SaaS supplier transfers personal data from both the EU and the UK, it makes sense to use the UK Addendum, as:

  • The EU SCCs can be used for transfers from the EU and from the UK (with a UK Addendum added for the UK transfers);
  • This makes the drafting of the SCCs much simpler;
  • This should reduce discussions between SaaS customers and sub-processors;
  • This will make the contractual provisions for all personal data transfers more consistent.

Where a SaaS supplier only transfers personal data from the UK to third countries, or most transfers are from the UK, use of the IDTA makes sense, as:

  • The SaaS agreement is incorporated into the IDTA;
  • The structure is simpler to follow and does not include the complicated modular approach of the new EU SCCs;
  • More flexible commercial provisions can be added to the IDTA.

Where a US SaaS supplier transfers personal data from both the EU and the UK, the UK Addendum should be used.

Actions to take now

SaaS suppliers and SaaS customers will need to take the following steps to implement changes to their existing data processing agreements to add the UK Addendum or IDTA, as appropriate, in line with the above time lines. They will need to:

  • Carry out a data mapping to identify international data transfers from the EU and UK;
  • Identify the data transfer mechanism relied upon for each transfer to a third country;
  • Carry out a Schrems II data transfer assessment, (“DTA”) based on the guidance from the EDPB for transfers relying upon SCCs or BCRs;
  • Carry out an ICO data transfer assessment for each transfer from the UK, (“DTA”) in due course using the template and tool being created by the ICO, see: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/;
  • Decide whether to use the UK Addendum or the IDTA for personal data transfers from the UK;
  • Review existing group data transfer agreements;
  • Review existing DPAs with all third parties i.e. customers, suppliers and sub-contractors;
  • Use the UK Addendum or IDTA for all new agreements from the 21st of September 2022;
  • Ensure the UK Addendum or IDTA is added to all existing agreements before the 21st of March 2024

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Cookies – Are your Cookie Banners Compliant

SaaS suppliers and SaaS customers should take note of three recent data protection fines issued against Facebook and Google by the French Data Protection Authority (“CNIL“) for non-compliant cookie banners on their websites.

The fines were issued pursuant to breaches of French Data Protection Law and the GDPR and highlight common non-compliant cookie banner practices that many websites use.

Fines imposed

Google were fined €150 million and Facebook €60 million.

In assessing the amount of the fines, CNIL took into account:

  • The number of users;
  • The revenue the companies raised from advertising indirectly generated by the data collected from the cookies; and
  • The fact that CNIL had repeatedly warned Google and Facebook that they were in breach.

Google

In January 2022 Google LLC and Google Ireland Limited were fined €90 million and €60 million respectively for failing to make it as easy to reject the use of cookies in their cookie banners as it was to accept the use of cookies on google.fr and youtube.com.

Consent Method

The cookie banner displayed on both websites contained a button allowing immediate acceptance of cookies, but no similar means were offered to enable a user to as easily refuse the use of cookies, as:

  • To refuse cookies, users had to perform at least five actions
    clicking on the ‘customise’ button, then clicking on each of the three buttons to select ‘disabled’ – each button corresponding to ‘personalization of the search’, ‘YouTube history’, and ‘ad personalisation’, and finally clicking on ‘confirm’;
  • To accept cookies users simply needed to click once on ‘I accept’

Breaches

The mechanism for refusing cookies was more complex than the mechanism for accepting cookies. Under French data protection law this amounted to discouraging users from refusing cookies and encouraging them to favour the “I accept” button.

In addition to fining Google, CNIL:

  • Ordered Google to make their website compliant within three months; and
  • Provided for additional fines of €100,000 per day to be imposed for non-compliance following the end of the 3 month period.

Facebook

In January 2022 Facebook Ireland Limited (now Meta Platforms Ireland Limited) was fined €60 million for failing to make it as easy to reject consent to the use of cookies as it was to accept cookies on facebook.com.

Consent Method

When a user accessed facebook.com, a pop-up window “Accept cookies from Facebook in this browser” appeared. Two buttons “Manage data parameters” and “Accept all” appeared at the bottom of the window. In order to continue browsing, the user was obliged to click on one of the two buttons.

  • If the user clicked the “Accept all” button they could continue browsing;
  • If the user clicked the “Manage data settings” button, a new pop-up window appeared, displaying 2 consent slider buttons relating to personalised ads. The two sliders were disabled. However the user had to click on the “Accept cookies” button at the bottom of this window, to continue browsing without any advertising cookies being set.

Breaches

The General Data Protection Regulation, (“GDPR”) states that consent:

  • Must be a freely given, specific, informed and unambiguous indication of the data subject’s wishes by a statement or by a clear affirmative action – Article 4(11);
  • Should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment – Recital 42.

Facebook’s cookie banner did not allow users to refuse cookies with the same degree of simplicity as required to accept them, in breach of the above rules on obtaining consent freely.

In addition to fining Facebook, CNIL:

  • Ordered Facebook to modify its methods for collecting consent to the use of cookies by offering users a means of refusing cookies as simple as the mechanism provided for acceptance of cookies; and
  • Provided for additional fines of €100,000 per day to be imposed for non-compliance following the end of the 3 month period.

CNIL also decided to publish this decision despite Facebook requesting that it did not do so. CNIL justified publication on the grounds of the seriousness of the infringement in question, the scope of the processing, and the number of people concerned.

Summary

In light of the above, SaaS suppliers and SaaS customers should ensure that their cookie banners are not adopting such practices. Many EU member state data protection authorities are now pro-actively checking cookie banners and are imposing larges fines and enforcing compliance for breaches.

Many national data protection authorities have published their own detailed cookie guidelines and these guidelines should be followed in the applicable jurisdiction.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – New EU-US Privacy Shield?

SaaS supplier and SaaS customers should be aware that discussions are currently taking place between the EU and US authorities in relation to a proposed new EU-US Privacy Shield.

Background

Following the Schrems II judgement, of the European Court of Justice, which invalidated the EU-US Privacy Shield and the subsequent European Data Protection Board (“EDPB”) guidance on data transfers, SaaS customers and SaaS suppliers are required to carry out a data transfer assessment (“DTA”) prior to transferring any personal data from the EEA to a “third country” i.e. to a country which does not have an “adequacy decision” from the EU, for example, the USA.

New Proposed EU-US Privacy Shield 2.0

In the last few weeks, the European Commission has announced it is negotiating a new EU-US Privacy Shield with the USA. Once the text of the new EU-US Privacy Shield is finalised it will need to be approved by the European Commission and then reviewed by the EDPB before it can be granted an “adequacey decision” by the European Commission. If the new EU-US Privacy Shield is granted an “adequacy decision” it can be used instead of standard contractual clauses or BCRs as a valid transfer mechanism for data transfers to the USA without the need to carry out any DTA.

When can the EU-US Privacy Shield be used

Currently there is no published text for the adequacy process to be started.

This means that until an “adequacy decision” is issued by the European Commission the new EU-US Privacy Shield cannot be used as a valid transfer mechanism. This will take months to obtain, from the date that the final text of the new EU-US Privacy Shield is agreed between the EU and the USA.

Does version 2.0 Solve the Problem of Transfers to the USA?

In any event, even if the new EU-US Privacy Shield is granted an “adequacy decision” it can be assumed that the validity of the new EU-US Privacy Shield will be challenged in the European Court of Justice (by Mr Schrems). Such challenge is almost pre-programmed unless the USA changes its surveillance laws, which is unlikely.

Furthermore, regardless of the validity of the new EU-US Privacy Shield, many SaaS customers will simply not agree to use the new EU-US Privacy Shield, as was the case in the past for Safe Harbor and the old EU-US Privacy Shield. So the usual problems of data transfers to the US will probably not be resolved by a new EU-US Privacy Shield 2.0.

Further information on this issue will be published as the situation evolves.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – FAQs – Cookies

What is a Cookie?

Cookies are small text files placed on a user’s hardware device, such as a computer, tablet or mobile phone which record online activity. The majority of websites use cookies to measure visits and the use of websites (analytics cookies). Cookies are often also used to save user names, passwords and user preferences to make repeated use of a website more comfortable for the user. However, increasingly cookies are being used to collect information about users for the purposes of targeted marketing, tracking and other non essential purposes.

Opt In Consent Required

It is unlawful to use cookies to collect user data without first obtaining consent. There is an exception when a cookie is strictly necessary for a service which a user has requested i.e. where a user places an item in an online shopping basket and there is the need to ensure that payment is for the goods actually purchased.

Compliance and Fines

The UK Information Commissioners Office (ICO) investigates and prosecutes companies for breaches of the Privacy and Electronic Communications (Amendment) Regulations and the GDPR. These two laws set out the obligations of website operators to provide users with information about cookies and any other similar techonlogy that track use of a website and the need to obtain obtain a user’s consent to the use of cookies. Failure to comply with the rules can result in GDPR fines.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

SaaS Agreements – Data Protection – Schrems II: Data Transfer Assessments

SaaS suppliers are now required to map all personal data that they process and carry out a data transfer assessment (DTA) prior to making any international transfers of personal data to a “third country”. A third country is a country outside of the EEA, that does not have an “adequacy” decision from the EU. i.e. the USA. This is due to the Schrems II judgement and the final European Data Protection Board (EDPB) Schrems II guidance on international data transfers.

Map all Data Transfers

Before a SaaS supplier or SaaS customer can transfer any personal data to a country outside the EEA they must identify and map all personal data used in their business. This includes mapping all controller to controller transfers, controller to processor transfers, processor to processor transfers and processor to controller transfers.

  • A controller to controller transfer takes place when a SaaS supplier makes lead referrals to a company, or shares personal data with another SaaS supplier.
  • A controller to processor transfer takes place when a SaaS customer transfers personal data to a SaaS supplier when using their cloud services.
  • A processor to processor transfer takes place when a SaaS supplier transfers personal data to its sub-contractors, for example to a data centre, email services or backup provider.

Verify the Transfer Mechanism

Once personal data has been mapped SaaS suppliers and SaaS customers must identify whether any transfers of data are made to outside of the EEA. Where such international transfers are made the transfer tool relied upon must be identified. The possible transfer tools are:

  • the transfer is made to a country with an adequacy decision from the EU Commission i.e. a transfer of personal data is made from the EU to the UK; or
  • the transfer is made using SCCs;
  • the transfer is made pursuant to Binding Corporate Rules (BCRs); or
  • the transfer is based on an Article 49 derogation, such as consent.

Assess the Effectiveness of the Transfer Mechanism

Where the transfer mechanism used is SCCs, the SaaS supplier and SaaS customer must assess whether the transfer tool provides a level of protection in the third country “essentially equivalent” to the EEA protections. They must assess whether there is anything in the law and/or practice in force in the third country that impinges on the effectiveness of the SCCs. For example: requests made to a US company under Section 702 of the U.S. Foreign Intelligence Surveillance Act (FISA) by US intelligence agencies to access data without a data subject’s consent or knowledge.

The level of protection should be assessed not just when the data is imported into the third country, but also when in transit (i.e. during the process of data being transferred). In other words, where public authorities in a third country, can access data with or without the data importer’s knowledge, through the importer or through any telecommunications providers.

The assessment should include:

  • consideration of any legislation and practices relevant to the specific data transferred; and
  • the documented practical experience of the data importer with respect to relevant prior access requests made by public authorities in the third country.

Where the data importer or data exporter is subject to “problematic legislation”, transfers are still permitted where:

  • the data exporter has no reason to believe such legislation will be applied in practice to the data exporter or data importer; or
  • supplementary measures can be implemented.

The data importer must provide the data exporter with relevant sources and information on local laws and data practices. All sources must be relevant, objective, reliable, verifiable and publicly available or otherwise accessible and clearly documented. Annex 3 of the SCCs includes a non-exhaustive list of such sources.

Identify and Implement Supplementary Protection Measures

Supplementary protection measures must be adopted if the data transferred is not afforded a level of protection “essentially equivalent” to the EEA level of protection.

The EDPB guidance provides a non-exhaustive list of examples of technical, organizational and contractual supplementary measures and case studies with examples of technical measures that would or would not be effective. SaaS suppliers and SaaS customers should be aware that transfers of unencrypted data to cloud services or other processors when providing SaaS services are not protected or equivalent, if there is any “problematic legislation” in the third country “in practice”.

Actions to Take

SaaS suppliers and SaaS customers now need to:

  • carry out a data mapping exercise to identify all data transfers;
  • identify and assess the transfer mechanisms used to transfer data to third countries;
  • review and amend technical and organisational measures and implement supplementary protection measures where necessary;
  • use new SCCs in all new contracts entered into from 27th of September 2021;
  • replace the current SCCs with the new SCCs in all existing contracts by the 27th of December 2022.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: