The Privacy Shield now replaces the Safe Harbor scheme. The rules under the Privacy Shield are similar to the rules under the Safe Harbor scheme, in that SaaS customers and SaaS suppliers need to self-certify their compliance with the principles of the Privacy Shield.
The following core principles must be adhered to.
Core Principles
- Notice must be given to data subjects about specific issues;
- Choice to opt out of disclosure of personal data to third parties;
- Accountability for onward transfer of personal data to third parties;
- Implement reasonable and appropriate security measures to protect personal data from loss, misuse and unauthorized access, disclosure, alteration and destruction;
- Personal data must be reliable, accurate, complete and up to date;
- Individuals must be able to access personal data and have it corrected, amended or deleted;
- Independent mechanisms for dealing with complaints free of charge must be in place.
Applying for Certification
- Draft a privacy statement which complies with the notice requirements;
- Maintain appropriate documentation to demonstrate their compliance with the above Privacy Shield principles;
- Amend existing agreements that involve personal data transfers to ensure compliance with the principles;
- Train staff and introduce internal guidelines and processes to ensure compliance with the principles.
- Ensure on-going compliance with the principles of the Privacy Shield.
Validity of the Privacy Shield
It is very likely that in the near future there will be challenges to the adequacy of the Privacy Shield (on a similar basis to the challenges that lead to the invalidity of Safe Harbor) either :
- By a German Data Protection Authority; or
- An individual at the European Union Court of Justice (CJEU).
SaaS suppliers and SaaS customers should be aware of the limitations of the Privacy Shield in the long term when considering investing substantial resources and time in complying with and applying for registration under the Privacy Shield.
Alternatives
When deciding whether or not to apply for certification under the Privacy Shield SaaS customers and SaaS suppliers should consider alternative options, which are currently the use of EU Model Clauses or binding corporate rules (BCRs).
EU Model Clauses
EU model clauses are standard data processing agreements that have been approved by the EU Commission as providing adequate protection. There are currently two sets of standard contractual clauses for transfers of personal data between data controllers and one set for transfers between a data controller and a data processor. EU model clauses must be used unamended (other than where specific details may be added, as set out in the notes to the clauses).
Where personal data is transferred from:
- A data controller in the EU (SaaS customer) to a data processor outside of the EEA (SaaS supplier); or
- A SaaS supplier within the EU to a sub-processor located outside of the EEA;
the SaaS supplier will need to enter into EU model clauses with the SaaS customer or SaaS sub-processor, as applicable.
BCRs
BCRs are a set of rules adopted within a particular company or corporate group that set out legally binding obligations in relation to data processing within a company or group which cover global data transfers of personal data. BCRs include amongst other matters, details of:
- Data protection policies;
- Commitments to data protection training;
- Data protection audits.
BCRs must be approved by a lead national data protection authority (DPA), typically determined by the location of the European headquarters of a SaaS supplier. Once the lead national DPA approves the BCRs they are then responsible for coordinating approval of the BCRs with all other DPAs across Europe.
Summary
When deciding which option to use to facilitate the lawful transfer of personal data from the EU to the USA, SaaS suppliers and SaaS customers need to take into account their specific circumstances in order to determine the best method to use, as use of the Privacy Shield may not be the right long term solution for many SaaS suppliers and SaaS customers who previously relied upon Safe Harbor.
Help
Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:
irene.bodle@bodlelaw.com
www.bodlelaw.com
To register for my newsletter click here
______________________________________________________
Other related articles:
- SaaS Agreements – Data Protection – SaaS, Brexit and the GDPR
- SaaS Agreements – Data Protection – Amending EU Model Clauses
- SaaS Agreements – Data Protection – Privacy Shield Approved
- SaaS Agreements – Data Protection – Data Processing Agreement
- SaaS Agreements – Data Protection – New Obligations for SaaS Suppliers
- SaaS Agreements – Data Protection – New Obligations for SaaS Customers
- SaaS Agreements – Data Protection – Microsoft Irish Data Centre Decision
- SaaS Agreements – Legal Implications of a Brexit
- SaaS Agreements – Data Protection – Brexit and the GDPR
- SaaS Agreements – FAQs – What is SaaS and Essential Terms to include in a SaaS Agreement
- SaaS Agreements – Essential Elements
- SaaS Agreements – Essential Elements – SLAs Explained
- SaaS Agreements – Data Protection – New General Data Protection Regulation (GDPR)
- SaaS Agreements – Data Protection – The Future of Safe Harbor
- SaaS Agreements – Data Protection – Transfer of Data Outside the EEA
- SaaS Agreements – Data Protection – Safe Harbor, German Customers
- SaaS Agreements – FAQs – Prism
- SaaS Agreements – Data Protection – Which Law Applies
- SaaS Agreements – Data Protection – Microsoft must disclose data on EU server
- SaaS Agreements – Data Protection – Update on new draft EU Data Protection Regulation
- SaaS Agreements – Data Protection – The Patriot Act
- SaaS Agreements – Data Protection – Russian Data Centres