access

SaaS Agreements – Data Protection – Prism and US Laws

08/07/2013 Irene Bodle

SaaS suppliers should be aware of relevant US laws when outsourcing SaaS services (data storage and hosting) to US companies or companies located in the USA. SaaS customers are becoming increasingly concerned about outsourcing in the USA following media reports about “Prism”. Namely, that the National Security Agency (NSA) accesses personal data stored on the servers of Microsoft, Apple, Google, Yahoo, Facebook and a few other major US public companies. Below is a summary of the most relevant US laws that SaaS suppliers should be aware of.

FISA

If you outsource any SaaS services to a US public company the US government can access SaaS customer data pursuant to the Foreign Intelligence Security Act (FISA).

FISA allows the US government to access and monitor the personal data of non-US citizens (located outside of the USA) held by US public cloud providers (i.e. Amazon or Google). Public cloud providers must secretly provide all assistance, facilities and information requested by the government if they request access to SaaS customer data. The public entity is not permitted to inform the SaaS supplier that it has disclosed or been asked to disclose personal data, nor that the data is being monitored.

The Patriot Act

If you are a SaaS supplier owned by a US parent company or you outsource any SaaS services to a US located data centre or a US based company, US law enforcers can access SaaS customer data pursuant to the Patriot Act.

The Patriot Act gives US law enforcement authorities the right to access personal data held by SaaS suppliers, regardless of where in the world the data is stored. The Act also gives US law enforcers the right to prevent SaaS suppliers from informing their customers that they have handed over personal data. The Act applies not just to SaaS suppliers owned by a US company but also to any SaaS suppliers using the services of a US subsidiary for data processing i.e. a US data centre.

HIPAA

If you are a SaaS supplier providing SaaS services to a US customer who is a health care provider you, and your sub-contractors, must comply with the security and privacy obligations of the Health Insurance Portability and Accountability Act 1996 (“HIPAA”).

HIPAA applies to any SaaS supplier who creates, receives, maintains, or transmits protected health information (“PHI”), regardless of whether or not the SaaS supplier actually views the data. HIPAA applies even if the SaaS supplier is not located in the USA. Any subcontractors a SaaS supplier uses i.e. a data centre will also need to comply with HIPAA.

SaaS Suppliers must include the privacy and security obligations set out in HIPAA in their SaaS agreements with US health care provider customers. SaaS suppliers are directly liable for breaches of the HIPAA security and privacy rules, which includes failing to cooperate with DHHS investigations of HIPAA breaches. Liability is strict i.e. a SaaS supplier will be liable regardless of intent. The penalties for breach are severe and a SaaS supplier can be fined up to 1.5 million US dollars for all breaches in any calendar year.

Summary

Under the provisions of the US Patriot Act and FISA the personal data of SaaS customers based in the EU must be shared with US law enforcers without the customer being informed, even though this conflicts with English and EU data protection law. Under HIPAA SaaS suppliers must comply with detailed privacy and security provisions of a US law applicable to the health care industry or face severe fines.

It is therefore important that SaaS suppliers ensure they are aware of the extent of any US laws they will be subject to when:

contracting with US SaaS customers; or
outsourcing SaaS services to companies linked to or based in the USA; or
if they have a parent company based in the USA.

SaaS suppliers should have procedures and measures in place to deal with any applicable US laws. These procedures need to be set out clearly in the terms of the SaaS agreement with the Customer, bearing in mind mandatory obligations to comply with US laws.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – The UK Patriot Act

30/04/2012 Irene Bodle

Recently SaaS suppliers have seen a marked increase in EU customers raising concerns about disclosure of their data to US law enforcement authorities under the Patriot Act – an American anti-terrorism law – particularly where the SaaS supplier has a parent company in the USA or data is being hosted or processed in the USA. Now to add to your problems, the UK Government plans to introduce its own “Patriot Act” type law in the near future.

Proposed Increase in E-Mail and Web Monitoring in the UK

According to the BBC and Guardian websites, a controversial new English law is expected to be announced in the Queen’s speech on the 9^th of May. The proposed new law will allow the UK police and security services to access the Web and Internet phone traffic of all UK residents. This will include access to all phone calls (made via the Internet), emails, social media exchanges and website visits.

Information that may be Disclosed

The proposals will grant UK police and security services the right to see:

the time of a call, email, or website visit;
the duration of the call or visit;
which websites or phone numbers were called; and
details of the sender and recipient of emails, such as IP addresses;

without any need for first obtaining a court warrant.

If a warrant is obtained, then the content of such messages will also be disclosed upon request.

Justifications for the New Law

The proposed legislation will loosen the existing surveillance arrangements set out in the Regulation of Investigatory Powers Act. The Government claims these new rights are needed to give the police and security services extended powers to enable them to investigate serious crime and terrorism. The same argument used in the USA prior to the introduction of the Patriot Act. The new law will in effect give the UK police and security services rights very similar to those granted to US authorities under the Patriot Act.

Problem for SaaS Suppliers

If this proposed new law is adopted, UK based SaaS suppliers will face increased difficulties in:

persuading customers to move across from more traditional suppliers to the SaaS model; and
allying customer concerns about the security and confidentiality of data.

Previous problems raised by SaaS customers over the application of the Patriot Act will fade into insignificance in comparison with these new UK rights.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Patriot Act – Renewed Customer Concerns

16/04/2012 Irene Bodle

High Profile Cases

Microsoft recently admitted that United States law enforcement authorities can access their European customer data without having to obtain a court order, ask for consent or even inform data subjects of the disclosure under the terms of the Patriot Act. To add to SaaS suppliers worries it is believed that BAE recently withdrew from contract negations for a Microsoft SaaS product due to fears that defence secrets could be accessed by the US authorities under the Act.

The recent publication of the new proposed EU data protection regulation has also added to customer fears that data is not safe from disclosure under the Patriot Act. The new regulation attempts to counter the application of the US Patriot Act by stating that non-EU companies will have to comply with EU data protection rules when accessing EU citizen data.

The Patriot Act v European Data Protection Laws

The provisions of the Patriot Act conflict directly with English and EU data protection laws.

Data protection laws in the 27 countries of the EU all prohibit the disclosure of personal data without a data subject’s consent or knowledge.

Therefore if a EU company is faced with a Patriot Act disclosure request it is impossible to comply with both the US law and the EU company’s local data protection laws. In practice the US law usually prevails. Some of the largest global software and search engine companies have admitted that EU customer data has already been disclosed by them as a consequence of requests under the Patriot Act.

The Cloud is not the Problem

SaaS customers often falsely believe that their data is not safe from disclosure due to the cross-border nature of cloud computing. However this problem applies to all data whether or not it is stored or processed in a SaaS model. Most countries (the UK, France, Spain and Belgium to name a few) have laws similar to the Patriot Act that all, not just SaaS suppliers must comply with i.e. in the UK the Regulation of Investigatory Powers Act 2000 (RIPA) requires disclosure of the content of communications to police forces.

Also data stored or processed anywhere outside of the EEA, in a country which does not have equivalent protection will be subject to all local disclosure laws i.e. in China and India, and such local laws may be less restrictive than the Patriot Act with regard to the type of data that must be disclosed.

In any event, regardless of whether or not the Patriot Act applies to customer data, the US authorities can access customer data even when it is hosted outside of the USA and there is no company presence in the USA under Mutual Assistance Legal Treaties (MLAT)

Assessing the Actual Risk of Disclosure

SaaS customer concerns about the Patriot Act are valid but these must be considered in light of:

The type of data covered by a request for disclosure under the Patriot Act;
The likelihood of the customer data ever being requested; and
The fact that customer data is already subject to similar disclosure obligations to the UK government and foreign governments under other existing laws.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

SaaS Agreements – Need for an Escrow Agreement

20/12/2011 Irene Bodle

As a SaaS supplier you may want to consider offering escrow agreements to your customers, particularly if you run SaaS applications which are critical to your customer’s business.

What is Escrow

Escrow refers to a third party holding a copy of the SaaS software source code on behalf of the customer and the supplier.

What is an Escrow Agent

An escrow agent is a third party who stores a copy of the SaaS software source code. The escrow agent will release a copy of the source code to the customer if any of the events set out in the escrow agreement occur.

Why use Escrow

This is usually a customer driven requirement resulting from the fact that the source code for the SaaS software, the expertise to implement it and rights to the SaaS software are only licensed to, and not owned by, the customer for the term of the SaaS agreement.

Customers are concerned that the supplier may:

fail to maintain the software;
transfer ownership of intellectual property rights in the SaaS software;
become insolvent; or
become unable to carry on supporting and maintaining the software for some other reason.

By having an escrow agreement in place the customer has the right to continue to use the software, if the supplier is in default of its obligations under the SaaS agreement.

Advantages of an Escrow Agreement

Having an escrow agreement in place protects all parties involved in the development, supply and use of business critical SaaS applications. It provides customers with peace of mind for securing long-term availability of a critical SaaS application by enabling customers to update software and fix any bugs even if the supplier is no longer able to support them.

Disadvantages of an Escrow Agreement

Having the right to use the software under an escrow agreement is in reality of little use if the customer does not have the know-how and resources to actually use, maintain and support the source code itself.

Also, the costs of setting up an escrow agreement and maintaining it are relatively expensive. Escrow costs are usually paid for by the customer.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SLA – Security Issues

25/10/2011 Irene Bodle

As a SaaS supplier you will have noticed the increasing concerns about security voiced by SaaS customers. Your SaaS agreement should therefore provide comfort to your customer by including security provisions in the service level agreement (SLA). The specific matters you should consider including are set out below.

The persons able to access the hosting centre should be very limited and the individuals should be defined. Access should only be allowed for hardware and software maintenance. A record of all visits should be logged, which can be easily achieved if swipe cards are used. Remember that when using a third party hosting centre, access will be controlled by, and should reflect, the terms of your hosting agreement with the hosting centre.

Physical Security

This should prevent unauthorised access to the hosting centre to prevent damage, loss or theft to hardware and software. Surveillance of the hosting centre is essential and details of whether or not this is 24 x 7, via video camera, watchmen or electronic alarm systems should be included in the SLA. Within the hosting centre itself, racks themselves should be separately secured.

Hosting Environment Security

In order to provide a continuous service to customers, the hosting centre must have:

an uninterrupted power supply;
a dual power source;
air conditioning; and
fire and flood detection systems.

Server Security

In order to protect your servers, you should use:

up to date virus protection;
up to date security patches; and
firewalls.

Data Security

In order to protect customer data you should set out:

how, where and when data will be backed up;
how often data will be backed up;
where backups will be stored; and
when discs/tapes will be rotated.

ISO 27001 Certification

ISO 27001 is an internationally recognised security certification which is often required by SaaS customers who are looking for assurance that adequate levels of data security are in place to protect their data. Having this certification demonstrates to customers your commitment to data security by confirming that you comply with “best practice” security management.

Disaster Recovery

Is this offered at all, consider whether is it included in your standard subscription fee, or if a premium will be charged. Also, remember that your disaster recovery centre should be physically remote from your hosting centre, and with a different provider.

Commercial Considerations

The level of security obligations offered to SaaS customers will depend upon:

how much a customer pays for the SaaS solution, maintenance and support;
whether the SaaS application is business critical i.e. online banking;
what is standard in that particular business area.

Exclusions

Ensure that your SaaS agreement contains appropriate security obligations applicable to your customer, for example using up to date virus programmes. Exclude liability for any security breaches which are caused by something beyond your control or an act, omission or breach of your customer’s security obligations under the SaaS agreement.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: