Tag: customer data

Website Legal Requirements – Privacy Policy – Basics for your Website

If you are operating a website and require users to register in order to use your website or you are simply using Google analytics on your website then you are collecting and processing personal data. Under the Data Protection Act 1998, if you collect, store or process personal data you must provide specific information to the persons whose personal data you are using. This information is usually provided to users in a privacy policy which should be published on your website.

The following basic issues should be covered in your privacy policy.

Personal Data Practices

Your privacy statement should reflect your personal data practices. For example, it should include details of:

  • The type of data being collected;
  • Why the data is collected;
  • How the data is used and why;
  • If and why personal data will be disclosed to third parties;
  • How and where data is stored;
  • How complaints or queries about personal data will be dealt with.

Cookies

Cookies are small text files placed on a user’s computer which record online activity. Virtually all websites use cookies. Most use analytics cookies to measure visits and use of websites. Performance and functionality cookies are used to make repeated use of a website more comfortable for the user and advertising cookies are increasingly used to collect information about users for targeted marketing.

In your privacy policy you must provide users with clear and comprehensive information about the type of cookies being used on your website and the purposes for which the information is collected.

Where should the Privacy Policy Appear on my Website

The privacy policy should be easy to find on your home page and/or at the point where you obtain consent to the collection of the personal data i.e. where a user registers on your website. It is advisable to have links between the privacy policy and all references made to it on your website. For example, if you are providing online recruitment services you should place your privacy policy on your home page and also have a link to it when users register to use your website or services. In addition you should have a process for the user to confirm acceptance of your privacy policy i.e. by actively clicking an acceptance box or a double opt-in email process.

Compliance with other Laws

You will need to consider your compliance with any other applicable laws or rules, which will apply in relation to the collection of a user’s personal data. Which other laws apply will depend upon a number of factors. For example if you are selling or providing services to children (persons under the age of 18) you must have additional safeguards in place on your website. For example, you will need to obtain parental consent before you collect any personal data for children of certain ages. Or if you are providing services to children which include advertising or marketing you will need to comply with the CAP Code.

The type of products or services that you are offering online and the countries in which you are making these available will also be relevant – as this will determine whether national, EU and/or international laws will also apply to your website. Depending on the business sector in which you operate, the rules of self-regulatory schemes may also apply. For example, if you are providing email marketing services to users you will need to comply with applicable email marketing and advertising rules.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Policies and Procedures

SaaS suppliers must have adequate data protection policies, procedures and checks in place when employees or third parties are handling SaaS customer data or face the risk of being heavily fined by the Information Commissioner’s Office (ICO) for breaches of the Data Protection Act 1998 (DPA).

Torbay Care Trust

A health trust in Torquay was recently fined £175,000 for breaches of the DPA after it accidentally published sensitive date of more than 1,000 staff on its website. The sensitive data contained the names, religion, sexuality, date of birth and National Insurance numbers of employees – which had been collected in an internal diversity response exercise.

Obligations under the DPA

Under the DPA you must have:

  • appropriate organisational measures to prevent the unauthorised use of personal data; and
  • effective policies and procedures for handling personal data,

in place.

The Trust was found to be in breach of both of these obligations, as it had no internal guidance on what should and should not be published online and had no adequate checks in place to identify potential data disclosure problems.

Appropriate Organisational Measures & Effective Policies

In order to avoid similar breaches (and fines) for disclosure of SaaS customer data, SaaS suppliers should have a data protection policy in place that all staff have read, accepted and understood. This should be regularly updated to reflect changes in the law and staff should be provided with basic data protection training on a regular basis.

In addition, SaaS suppliers should have robust procedures in place for managing SaaS customer information. For example access to the customer’s information should be controlled and monitored in order to make the information more secure and thus minimise the risk of any accidental or unauthorised disclosure.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:


SaaS Agreements – Data Protection – Customer Privacy Policy

SaaS Customers often ask or expect SaaS supplier’s to provide them with a privacy policy for use in conjunction with their SaaS products. SaaS suppliers should firmly refuse such requests. Firstly, as they could face liability claims from the customer if the privacy policy is in appropriate and secondly while you will have no adequate knowledge of the issues set out below, which will need to be covered in the privacy policy.

Personal Data Practices

The customer’s privacy statement should reflect its personal data practices. For example, it should include details of:

  • The type of data being collected;
  • Why the data is collected;
  • How the data is used and why;
  • If and why personal data will be disclosed to third parties;
  • How and where data is stored;
  • How complaints or queries about personal data will be dealt with.

Compliance with Applicable Laws

SaaS customers will also need to review their compliance with any applicable laws relating to the collection and use of personal data. The laws that apply will depend upon a number of factors. If the SaaS customer is selling or providing services to people under the age of 18 additional laws applicable to the protection of children will apply.

The type of products or services being sold and the countries in which they are being sold will also be relevant – as this will determine whether national, EU and/or international laws will apply. Depending on the business sector in which your SaaS customer is operating, the rules of self-regulatory schemes may also apply. For example, if your customer is providing email marketing services they will need to comply with applicable email marketing and advertising rules.

Where on a Website should the Privacy Policy Appear

This will usually be on your SaaS customer’s home page and/or at the point that they obtain consent to collection of the data. It is also advisable to have links between the privacy policy and all references made to it on the customer website. For example, if your SaaS customer is providing online recruitment services they should place their privacy policy on their home page. Also, when users register to use services there should be a link to the privacy policy and a process for users to accept the terms of the privacy policy.

Practical Issues

If your SaaS customer insists on you assisting in the creation of a privacy policy you should charge for this additional service, as this is a consultancy service. In addition you should try to limit your assistance to simply providing a template for your customer to customise and adapt. You should always limit your liability for any omissions or errors in the template and state that the template is provided on an “as is” basis.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Anonymising Data

Often SaaS suppliers or SaaS customers anonymise personal data for use in statistical or marketing information but are unaware that by using such anonymised data they could be breaching the Data Protection Act 1998 (DPA). The Information Commissioner’s Office (ICO) has recently confirmed that anonymised personal data may be disclosed without the consent of the data subject, provided that the anonymised data when linked with other information will not lead to the identification of an individual.

Anonymisation

Under the DPA personal data must be processed fairly and lawfully and for specific, explicit and legitimate purposes. It is therefore essential that personal data is effectively anonymised so that it is no longer personal data and thus excluded from the strict requirements of the DPA. For example data controllers must consider whether the anonymised data when combined with other information would result in a disclosure of personal data.

Consent

In order to anonymise personal data it must first be processed. Organisations may therefore need to obtain consent to the anonymisation of personal data, in order to be able to later disclose such anonymised information. Such consent can be obtained by using an appropriate privacy policy, or some other form of notification which explains the anonymisation process and its consequences for individuals. This will be particularly relevant where a data controller is required to disclose data in compliance with a request under the Freedom of Information Act.

Re-Identification

Where there is a risk that an individual could suffer “damage, distress or financial loss” as a result of “re-identification” following disclosure of anonymised information, consent to the discourse should be obtained from the individuals concerned.

ICO Anonymisation Code of Practice

By following the above basic steps set out in more detail in the ICO’s draft code of practice on anonymisation, organisations can publish or share useful information derived from personal data, whilst protecting the privacy rights of individuals. The draft guide will be finalised later this year after the consultation period ends on the 23rd of August.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS, ASP Agreements – Data Protection Issues with Sub-contractors – Standard Contractual Clauses

Using a sub-contractor to process your SaaS customer data is a problem under data protection law, where the sub-processor is based outside of the European Economic Area (EEA). Incorporating EU standard contractual clauses into your SaaS agreement is NOT the solution to this common problem.

EU Standard Contractual Clauses

Under data protection law personal data may only be transferred to countries outside of the EEA where there is adequate protection. In order to deal with the problem of transfers of personal data from a customer (data controller) in the EEA i.e. in the UK, to a SaaS supplier (data processor) outside of the EEA i.e. a SaaS supplier in Asia, the EU drafted standard contractual clauses. When such clauses are included in a SaaS agreement, the requirement to provide adequate protection for the data being transferred will be met.

New EU Standard Contractual Clauses

In July 2010 the EU standard Contractual Clauses were amended to cover the position where personal data is transferred from a data controller in the EEA (customer) to a data processor outside of the EEA (supplier) and then a transfer to a sub-processor located outside of the EEA.

This is a common scenario in a SaaS agreement where a customer based in the UK is accessing SaaS software provided by a supplier outside of the EEA and the supplier is using a hosting centre or outsourced IT development centre located in India or Asia to process the customer data.

Sub-Processor located outside of the EEA

Despite the above changes to the EU model clauses, where a data processor (supplier) based inside the EEA, instructs a sub-processor based outside of the EEA, to process a customer’s data, the transfer of data is not covered by the new or old standard contractual clauses. This is a common scenario in SaaS agreements where the customer and supplier are both based in the EEA but the SaaS supplier uses a data centre or IT personnel outside the EEA i.e. in Asia to process the customer data.

The transfer of customer data to the sub-processor will not comply with data protection law if the new or old standard contractual clauses are used and an alternative solution will need to be found. This will usually take the form of an additional data protection agreement between the relevant parties.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: