Tag: data controller

SaaS Agreements – Data Protection – General Data Protection Regulation (GDPR)

The General Data Protection Regulation (“GDPR”) will replace the existing EU Data Protection Directive and harmonise European data protection law from the 25th of May 2018. In the UK the GDPR will replace the Data Protection Act 1998 from the 25th of May 2018. This will have a significant effect on both SaaS suppliers and SaaS customers who will need to comply with the terms of the GDPR.

Harmonisation

SaaS suppliers and SaaS customers should be aware that the GDPR will not fully harmonise data protection law throughout Europe, as each EU country may introduce their own requirements in certain instances. However, SaaS suppliers and SaaS customers will need to start making organisational changes now to their data processing activities in order to comply with the new rules on consent, audit rights, data exports, increased administrative requirements and the new obligations of data processors.

Below is a summary of the main provisions of the GDPR that SaaS suppliers and customers need to be aware of.

New Data Processor Obligations

The GDPR applies to data controllers (SaaS customers) and data processors (SaaS suppliers) and in particular SaaS suppliers should be aware that some of the GDPR applies directly to data processors who will be subject to compliance obligations and sanctions for non-compliance.

Consent

SaaS suppliers and SaaS customers relying on consent to process personal data will need to show that the consent is:

  • freely given;
  • specific and informed; and
  • an “unambiguous indication” of a data subject’s wishes and expressed either by a statement or a clear affirmative action (i.e. ticking a consent box when visiting a website).

Consent must be purpose limited i.e. related to explicitly specified purposes.

The default age for giving valid consent and using online services is 16, however each EU country will be able to reduce this to 13.

Penalties

The maximum penalty for a breach of the GDPR will be substantially higher than under current legislation. Fines can be imposed on SaaS suppliers or SaaS customers. Fines of up to 4% of annual global turnover or up to 20m Euros (whichever is higher) can be applied.

Applicable to Non-EU Entities

The GDPR will apply not just to EU SaaS customers and suppliers but also to non-EU SaaS customers and suppliers who:

  • offer goods or services to data subjects in the EU; or
  • monitor the behaviour of EU citizens to the extent that the behaviour takes place in the EU.

Enforcement – One Stop Shop

SaaS suppliers and SaaS customers will be regulated by a single regulator in the place of their main establishment, which shall be their main administrative location in the EU. Data subjects will be able to make complaints to regulators in their own EU country.

Data Protection Officer

An independent data protection officer (“DPO”) must be appointed where an organisation’s core business involves processing personal data involving regular and systematic monitoring of data subjects or large amounts of sensitive personal data. Each EU country may enact national provisions imposing further requirements regarding the appointment of DPOs. This will be particularly relevant in Germany where this is already a legal requirement.

Notification

There is no requirement for a SaaS supplier or SaaS customer to notify local data protection authorities of any data processing activities but there is a requirement to keep records of data processing activities (subject to limited exceptions).

Breach Reporting

SaaS customers and SaaS suppliers must report breaches to the relevant local regulator without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Data subjects must be informed of breaches without undue delay where the breach is likely to result in a high risk to the data subject’s rights and freedoms unless:

  • the data has been rendered unintelligible to any third party (for example by encryption);
  • the data controller has taken steps to ensure the high risk is unlikely to materialise; or
  • it would involve disproportionate effort to inform data subjects individually, in which case a public announcement can be made.

Data processors (SaaS suppliers) are required to inform data controllers (SaaS customers) of any breach without undue delay.

Impact Assessments

SaaS customers will be required to carry out data protection impact assessments (“DPIAs”) if their proposed activities are likely to result in a high risk for the rights and freedoms of individuals, in particular, through the use of new technologies and in cases of profiling.

Data Subject Rights

The following rights shall be granted to data subjects:

  • data portability;
  • the right to be forgotten;
  • the right to prevent profiling;
  • the right to object to processing;
  • the right to rectification and erasure.
  • subject access requests (“SARs”).

SARs must be responded to by the data controller (SaaS customer) without undue delay and, at the latest, within one month of receipt of the request. The data controller only has the right to charge a reasonable fee to cover administrative costs where the requests are “manifestly unfounded or excessive”.

Preparing for Change

Although the GDPR will not come into force until the 25th of May 2018, it is essential that SaaS customers and SaaS suppliers start to prepare for the changes now. For example, by appointing a data protection officer (where appropriate), devising a documentation system for recording data processing activities, reviewing how consent is obtained from data subjects, adding written data processing agreements to existing SaaS agreements and future SaaS agreements with relevant customers and amending existing privacy policies to comply with the GDPR rules.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Direct Marketing Rules

In September 2013 the Information Commissioner’s Office (ICO) published a lengthy guide to Direct Marketing. The guide covers compliance with the Data Protection Act 1998 (DPA) and the Privacy and Electronic Communications Regulations 2003 (PECR) in relation to the sending of unsolicited marketing. SaaS suppliers who are sending unsolicited marketing to SaaS customers and prospective customers should check their compliance with the guidance. Additionally, the Direct Marketing Association (DMA) has also published its own further supplemental guide which provides detailed guidance on how and when to obtain consent to marketing from individuals.

Marketing and the DPA

The DPA applies to marketing where a SaaS supplier is using personal data. For example: if a SaaS supplier is sending marketing emails to a named person i.e. peter.smith@microsoft.com. When sends marketing emails to a named person a SaaS supplier must comply with the 8 data protection principles. In particular, the SaaS supplier must give the individual the right to object to any direct marketing (in writing).

Marketing and the PECR

The PECR complements the DPA. It sets out more detailed rules on electronic marketing i.e. email, text messages, fax and telephone calls.  Unlike the DPA, the rules apply even if the SaaS supplier does not know the name of the person it is contacting i.e. admin@microsoft.com.

The rules under the PECR also vary depending on whether the marketing is sent to a consumer (B2C) or to a business (B2B).

Obtaining Consent

Both the DPA and the PECR require that the recipient consents to being sent direct marketing. Such consent must be informed and must be freely and specifically given. Consent is only valid if:

  • it is not a condition to subscribing to a service or completing a transaction;
  • the information given is clear, prominent and not difficult to find (so that individuals understand what they are consenting to);
  • it is relevant to the type of marketing being sent; and
  • there is a positive indication of the recipient’s agreement to receive direct marketing.

This means as a general rule that pre-ticked “opt-in” boxes should not be used to obtain consent.

Marketing Emails and Texts

Where marketing messages are sent by email or text additional rules apply. Consent must be:

  • notified; and
  • specific to the type of communication.

No express consent is required where:

  • a recipient’s details are obtained in the course of a sale (or negotiation of a sale) of a product or service of the SaaS supplier to that individual;
  • the SaaS supplier is only marketing their own similar products or services; and
  • the recipient had the option to refuse or “opt-out” of the marketing at the time their details were collected, and in every subsequent email.

In order to demonstrate compliance with the rules on consent, SaaS suppliers should keep clear records of:

  • what, when and how consent was collected;
  • who gave the consent; and
  • the information provided to the individual about the consent being given.

Marketing Calls

In the UK SaaS suppliers must not make unsolicited marketing calls to numbers registered with:

  • the Telephone Preference Service (TPS) in relation to individual B2C subscribers; or
  • the Corporate Telephone Preference Service (CTPS) in relation to B2B subscribers.

Automated marketing calls can only be made to individuals who have specifically consented to receiving such calls.

Fines for Breach

Breaches of the DPA or PECR can result in a SaaS supplier receiving an enforcement notice from the ICO requiring remedial steps to be taken. Failure to comply with such a notice is a criminal offence.  In addition, the ICO can also impose a fine of up to £500,000 for serious breaches.

Summary

The above is a general summary of the complicated rules applicable to direct marketing. Before launching any direct marketing campaign, specific legal advice should be taken, in order to check full compliance with the above laws and rules to reduce the risks of substantial fines being imposed for breaches.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Russian Data Centres

SaaS Suppliers who will be processing personal data of Russian citizens on behalf of SaaS customers need to be aware of amendments to the Russian Federal Law on Personal Data. From the 1st of September 2015 changes to this Russian law may prohibit foreign SaaS suppliers from processing personal data of Russian citizens on servers located outside of Russia.

Restrictions

The amended law will apply to all ‘data operators’. A data operator combines the duties of a SaaS customer (data controller) and a SaaS supplier (data processor) so the law will apply to both SaaS customers and SaaS suppliers. Under the amended law it will be illegal for a data operator to collect personal data of Russian citizens and send it directly to servers located outside of Russia without using a database installed on a server located in Russia. This means that SaaS suppliers will need to ensure that personal data of their SaaS customers is stored in databases on servers located within Russia i.e. in a Russian data centre.

Export of Data outside of Russia

No explicit restriction on the transfer of personal data outside of Russia is contained in the amendment to the law. The amendment simply says that personal data must be stored in Russia.

It is therefore currently unclear whether the processing of personal data of Russian citizens should only take place in Russia or whether under existing laws personal data can be transferred outside of Russia if the following conditions are met:

  • the prior written consent of the data subject is obtained; and
  • the transfer is to one of the 46 countries which is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data Personal Data.

In March 2015, the Russian Internet Ombudsman proposed that foreign online companies be allowed to continue to store personal data of Russian citizens in a third country, if they complied with the above. However, as a number of multinational online companies such as Google are setting up servers in Russia, it seems unlikely that this exception will continue after September 2015.

Personal Data

Unlike EU data protection laws, the amendment to the Russian law does not provide clarification of the personal data to which it applies. For example the amendment to the law says nothing about whether:

  • the new rules will apply to personal data already collected from Russian citizens i.e. collected before the amendment comes into force on the 1st of September 2015;
  • the new rules apply to personal data of Russian citizens who are not resident in Russia; and
  • or not IP addresses are personal data.

Penalties

Roscomnadzor (the Russian entity responsible for monitoring compliance) will be able to block access to websites in the territory of Russia that breach the new rules. In addition fines can be imposed, although these will generally only be in the region of 150 GBP for each breach. However, the Russian Parliament is currently considering legislation to increase the level of fines and to introduce new categories of personal data breaches.

Summary

In light of the above, SaaS suppliers need to:

  • identify whether or not they have any SaaS customers collecting personal data of Russian citizens;
  • check that SaaS Customers who collect data of Russian citizens have servers physically located in Russia; and/or
  • consider providing hosting services themselves from servers located in Russia, particularly if such personal data is only being processed outside of Russia;
  • check any developments in this area.

Failure to consider the above and take appropriate actions could result in SaaS suppliers facing fines from the local Russian Roscomnadzor for breaches of the amended law.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Anonymising Data

Many SaaS suppliers use personal data, collected on behalf of SaaS customers, in an anonymised form for their own purposes, for example for benchmarking. The UK Information Commissioner’s Office (ICO) Anonymisation Code and more recently the Article 29 Working Party’s Opinion on Anonymisation provide guidance on how to check that personal data is actually anonymous.

If you are a SaaS supplier using anonymised personal data you should comply with the recommendations in these two guides, to ensure that you are properly anonymising data, otherwise you could be found to be using personal data in breach of the Data Protection Act (DPA).

Personal Data

Any SaaS supplier processing personal data must comply with the Data Protection Act 1998 (DPA). The DPA regulates the disclosure and use of personal data.

Personal data is defined in the DPA as data which relates to a living individual who can be identified from those data. Accordingly, information or a combination of information, that does not relate to and identify a living individual, is not personal data.

Information which is not personal data i.e. anonymised data can be disclosed and used more freely with fewer legal restrictions as the DPA does not apply to it. However, SaaS suppliers should ensure that any personal data they have anonymised and they intend to use, is truly anonymous.

Anonymisation Methods

Most data is anonymised using:

  • randomisation techniques, which alter the veracity of the data in order to remove the strong link between the data and the individual. If the data is sufficiently uncertain then it can no longer be referred to a specific individual; or
  • generalisation techniques, which consist of generalising/diluting the attributes of individuals by modifying the respective scale or order of magnitude (i.e. a region rather than a city, a month rather than a week).

Such methods use the following tools to make data anonymous:

  • noise addition;
  • permutation;
  • differential privacy;
  • aggregation/k-anonymity; and
  • l-diversity/t-closeness.

Risk Assessment

In order to ensure that data is properly anonymised, SaaS Supplier’s should carry out regular risk assessment audits. SaaS suppliers should test their anonymisation and randomisation techniques against the following risks to the re-identification of anonymised data:

  • singling out – is it still possible to isolate some or all records which identify an individual in the data set;
  • linkability – is it still possible to link at least two records concerning the same individual or a group of individuals;
  • inference – can information be inferred concerning an individual from the values of a set of other attributes.

Audits should also assess new risks to re-identification, as over time due to technological developments anonymised data could become re-identifiable in the future.

Pseudonymised Data and Anonymised Data

SaaS suppliers should note that the Article 29 Working Group does not accept that pseudonymised data is equivalent to anonymised data. The reason for this is that pseudonymisation allows:

  • an individual to be singled out; and
  • the individual to be linkable across different data sets.

Summary

Where any uncertainty exists about whether or not re-identification can occur, SaaS suppliers should obtain prior consent from individuals to the use of their anonymised data or they run the risk of breaching the DPA.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Which law applies?

UK SaaS suppliers who provide cloud computing services to SaaS customers located outside of the UK are increasingly being required to comply not just with UK data protection law, but also the data protection laws of the countries in which the SaaS customer and its clients are based. This increasingly creates problems for SaaS suppliers, as data protection laws generally assume that data is stored/processed in one place. However when operating in the cloud data is often moved between jurisdictions and it may be unclear exactly where data is being stored or processed and who is storing and processing it.

Two recent cases involving Facebook and Google show the extent of this developing problem.

Facebook

In February 2014, Facebook, a US owned company, with its European headquarters in Ireland, was ordered to comply with German data protection law. A German court ruled that Facebook must comply with German data protection law before sending emails to German individuals i.e. by obtaining consent even though the processing of the German personal data was carried out by the Irish company.

The German court took the view that Irish data protection law did not apply, as although Facebook had its European headquarters in Ireland, a EU country, the US parent company Google Inc. controlled the processing and was the data controller. Even though the US parent company was located outside of the EU, as it was using ‘equipment’ situated in a EU country to process the personal data i.e. setting cookies on the devices of German users, the national data protection laws of Germany applied.

Google

The European Court of Justice (ECJ) ruled in May 2014 that Google Spain, a Spanish subsidiary of the US parent company Google Inc, must comply with Spanish data protection law when processing Spanish user data, as the Spanish entity was “established” in the EU. Google had argued that because the processing of Spanish user’s personal data was carried out by the US parent company, EU data protection law did not apply.

The ECJ disagreed, arguing that Google Inc had set up a subsidiary in Spain which directed its activities towards Spanish citizens and therefore Spanish data protection law applied, even though Google Inc. was located in the USA.

EU Data Protection Directive

Both of the above cases are based upon the application of EU data protection law (Directive 95/46/EC), to companies who:

  • process personal data;
  • are a data controller; and
  • have an establishment, or use equipment in, a member state of the European Union.

Where a SaaS customer fulfils the above criteria, it will be subject to EU data protection law (and effectively the locally applicable national data protection law of the country in which the user whose personal data is being processed is based).

Summary

SaaS suppliers should be aware that the application of different national data protection laws in the cloud is primarily the problem of a SaaS customer – who is the data controller. However this becomes an issue for the SaaS supplier where the SaaS customer attempts to pass on its cross border data protection obligations to the SaaS supplier within the terms of the SaaS agreement.

Such obligations are usually disguised in the terms of the SaaS agreement by reference to the SaaS supplier complying with „all applicable laws“ or more specifically to the specific data protection laws of named countries. Such terms should not be agreed to, unless the SaaS supplier is:

  • aware of the obligations and penalties imposed by such data protection laws; and
  • sure of its ability to comply with such obligations.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Microsoft must disclose data on EU server

Many SaaS customers falsely believe that if their SaaS data is stored in a data centre located in the EU it will be protected against disclosure to the US authorities. This is incorrect. The recent US court ruling against Microsoft has confirmed the position, namely that SaaS suppliers and SaaS customers who use data centres located in the EU, owned by US companies, cannot prevent US authorities from accessing their data.

Microsoft Case

In April this year a New York court ruled that Microsoft must reveal email data stored on its servers at its Irish data centre. Microsoft received a search warrant issued pursuant to the Stored Communications Act (SCA) requiring them to disclose the data. Under the SCA a US company is obliged to produce information in its possession, custody, or control regardless of the location of that information.

Microsoft currently offers SaaS customers the option of storing all data at its data centre in Ireland, in an attempt to address valid EU customer concerns about the ability of the US authorities to access their data and in an attempt to comply with EU data protection laws. However this recent court decision undermines the effectiveness of this option, as following this decision it is clear that US authorities can access data located outside of the US.

Microsoft plans to challenge the court decision but regardless of the final outcome of this case, US authorities will still be able to access data stored in the EU using other US laws.

Prism, FISA and the Patriot Act

Ignoring the issue of “Prism” the US government can secretly access SaaS customer stored in the EU under the Foreign Intelligence Security Act (FISA) and the Patriot Act.

What is FISA?

FISA allows the US government to access and monitor the personal data of non-US citizens (located outside of the USA) held by US public cloud providers. Public cloud providers such as Amazon and Google must secretly provide all assistance, facilities and information requested by the government if they request access to SaaS customer data. The public entity is not allowed to inform the SaaS supplier that it has disclosed or been asked to disclose personal data, nor that the data is being monitored.

The Patriot Act

The Patriot Act gives US law enforcement authorities the right to access personal data held by SaaS suppliers, regardless of where in the world the data is stored. The Act also gives US law enforcers the right to prevent SaaS suppliers from informing customers that they have handed over personal data. The Act applies not just to SaaS suppliers owned by a US company but also to any SaaS suppliers using the services of a US company i.e. a US data centre.

Summary

Under the SCA, Patriot Act, FISA (and “prism” where applicable) the personal data of SaaS customers based in the EU must be shared with US law enforcers without the SaaS customer being informed, even though this conflicts with the provisions of the EU Data Protection Directive and the data protection laws of the 28 EU member states.

Local EU data protection authorities and EU member state governments are currently investigating how to resolve this conflict, for example by adding provisions preventing disclosure in the draft proposed EU data protection regulation. While the position remains unresolved, SaaS suppliers should be considering how to minimise the risk this poses to their business model, whilst assuring SaaS customers that their concerns are being addressed.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – BYOD

Employees are increasingly using their privately owned devices (i.e. Ipads, tablets, mobile phones and laptops) for business purposes and may be accessing SaaS customer data using them. SaaS suppliers who allow staff to use such “bring your own devices” (BYOD) for work purposes should be aware of their duties to protect any SaaS customer personal data being accessed by staff using such BYODs.

ICO Guidelines

In March 2013 the Information Commissioner’s Office (ICO) published guidelines providing advice on how to protect personal data that is accessed using a BYOD. The Commissioner underlined the fact that SaaS suppliers are obliged to look after personal data for which they are responsible  under the Data Protection Act 1998 (Act) regardless of ownership of the device used to carry out the processing.

In order to protect SaaS customer data and to comply with their duties under the Act, SaaS suppliers who permit staff to access data on a BYOD should:

  • ensure that the BYOD is password-protected;
  • ensure that data is encrypted when it is transferred;
  • ensure that data is encrypted when it is stored; and
  • consider having a BYOD policy for staff.

BYOD Policy

SaaS suppliers should either prohibit BYOD and the ability to access SaaS customer data for work purposes on such devices entirely or they should permit access within the scope of a BYOD policy.

A BYOD policy should contain rules on the use of personal devices by staff, setting out:

  • which employees are allowed to use a BYOD, i.e. senior management;
  • what types of devices may be used;
  • which types of data may be accessed via the device;
  • how devices will be protected against loss, theft or hacking i.e. by requiring the use of passwords, pins and/or encryption;
  • how data should be deleted when an employee leaves or disposes of a device;
  • how and when use of the device will be monitored; and
  • sanctions for breach of the BYOD policy.

Ownership and Deletion of Data

A BYOD policy should also state that any work data i.e. contact details or content i.e. business documents will remain the property of the SaaS supplier. Employees should agree to the SaaS supplier being permitted to:

  • delete work data and content from the device; and
  • make copies of work data and content if an employee leaves the company’s employment.

Summary

SaaS customers are more likely to choose SaaS suppliers who demonstrate that they control and monitor the use of SaaS customer data on BYODs. Having a clear BYOD policy in place will often satisfy a SaaS customer’s concerns about the use and storage of personal data in accordance with the SaaS agreement terms.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Update on the EU Draft Data Protection Regulation

SaaS suppliers should be aware of the recent changes made by the EU Parliament to the draft EU Data Protection Regulation (Regulation). If this amended version of the Regulation becomes law next year the obligations of SaaS suppliers who process personal data on behalf of customers will radically change. A summary of the current main proposed provisions is set out below.

Fines

The proposed fine for breaching data protection law will be increased to the higher of:

  • 5% of annual worldwide turnover; or
  • €100 million

Currently the maximum UK fine for a breach of data protection law is £500,000.

Data Protection Officer

A data protection officer must be appointed where:

  • a SaaS supplier processes the personal data of more than 5,000 individuals in any consecutive 12 month period; or
  • special categories of data, location data, data relating to children, or employee data in large scale filing systems is processed.

The data protection officer must be appointed for:

  • a minimum of 2 years; and
  • meet specific minimum requirements set out in the Regulation.

Notification of Data Protection Breaches

SaaS suppliers must notify breaches of data protection law without undue delay.

Data Processor Obligations

The obligations and duties of SaaS suppliers (data processors) have been more specifically defined. For example SaaS suppliers should:

  • only employ staff who have given confidentiality undertakings or commitments;
  • obtain permission from SaaS customers (data controllers) before employing a sub-processor i.e. using a third party hosting centre;
  • ensure that security measures are implemented; and
  • maintain documentation of all processing operations.

Data Transfers – Prism

The transfer of an individual’s personal data to third parties has been restricted in light of recent revelations about the NSA and Prism. No transfer of personal data will be permitted in relation to a third country court decision or administrative authority (i.e. under the Patriot Act or FISA) if this does not comply with a mutual legal assistance treaty or an international agreement.

Additionally, individuals will have the right to know if their personal data has been disclosed to a public authority.

Territorial Scope

The Regulation will apply to companies located outside of the EU whenever they process the personal data of individuals located in the EU. This means that if a UK SaaS supplier uses a data centre located outside of the EU to host EU SaaS customer data the provisions of the new Regulation will apply to both the SaaS provider and the data centre. For example if a SaaS supplier uses Microsoft to host EU customer data both will be directly subject to EU data protection law.

Right to be Forgotten

This has been changed to the right to be erased. This right will not apply to data which cannot be erased due to the type of storage technology used, provided that the technology was installed prior to the Regulation coming into force.

Summary

The above is a summary of the current status of the draft Regulation. The Regulation may be amended before it becomes law in 2014 and SaaS suppliers should continue to monitor the position to ensure they are ready to adapt their existing procedures and compliance regimes to comply with any change in their legal obligations.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To learn more about SaaS and cloud computing join me at the Berlin CloudConf 2013 on 5th of December.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Hosting – Encryption of Stored Data

Under the Data Protection Act (DPA), SaaS customers are required to take “appropriate technical and organisational measures” to prevent the unauthorised or unlawful processing of personal data and accidental loss or destruction of, or damage to, personal data. SaaS providers who process personal data on behalf of SaaS customers are required to include such obligations in their SaaS agreement (or SLA).

Written Obligation

The specific obligations specify that SaaS customers must have a written contract with SaaS providers which states that:

  • the SaaS provider may only process data in accordance with the SaaS customer’s instructions; and
  • the SaaS provider undertakes to comply with the “technical and organisational measures” requirements of the DPA.

Encryption Requirement

Last year the Information Commissioner’s Office (ICO) issued some guidance on cloud computing. Amongst other issues, this advised SaaS customers to ensure that personal data in transit is secure and protected from interception by:

  • encrypting data in transit;
  • using encryption that meets recognised industry standards; and
  • obtaining assurances from SaaS providers that data in transit is appropriately secure.

The ICO also advised that data “at rest” i.e. personal data which is stored, should also be encrypted, depending upon the nature of the personal data held i.e. is it sensitive personal data and the type of processing taking place.

SaaS customers were advised to ensure that encryption keys are:

  • kept up to date, in order to maintain the level of protection; and
  • not lost, as this could render the data useless.

Compliance

SaaS customers are increasingly asking SaaS providers to include data encryption obligations in SaaS agreements. Google cloud services now:

  • automatically encrypts all data before it is stored;
  • regularly updates keys;
  • implements access controls; and
  • permits auditing procedures.

In time this could become standard for all SaaS providers. In any event you may want to check with your data centre, where you are outsourcing hosting and storage to check whether they also offer this service, which is provided to Google cloud service customers at no additional cost.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To learn more about SaaS and cloud computing join me at the Berlin CloudConf 2013 on the 5th December.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – IT Security Requirements

In January 2013 Sony was fined 250,000 GBP for failing to take “appropriate technical measures” to protect the security of personal data stored on its PlayStation Network (PSN) in breach of the Data Protection Act (DPA). In light of the lack of guidance currently provided by the Information Commissioner’s Office (ICO) on data protection security SaaS suppliers should be aware that the ICO plans to draw up new guidelines.

Appropriate Technical and Organisational Measures

Under the DPA, SaaS suppliers must take appropriate technical and organisational measures against the unauthorised or unlawful processing of personal data and accidental loss, destruction or damage to personal data. However there is currently no legal definition, or guidance from the ICO, on what are “appropriate” organisational and technical measures.

In the past the ICO has stated that personal data should be encrypted, if loss or theft of the data would cause damage or distress to the individuals concerned. More recently in the case of Sony, the ICO found that Sony’s software was not up to date and that passwords were not secure.

However, in light of the lack of any specific guidance on this matter, the ICO seems to determine fines based on the facts of each individual case.

Factors to Consider

Often the following factors are taken into consideration by the ICO:

  • the financial resources of a SaaS supplier;
  • the number of individuals whose data is affected;
  • the harm actually caused to those individuals;
  • how a SaaS supplier responds to a breach;
  • what technology the SaaS supplier uses; and
  • any mitigating factors, such as voluntarily reporting of a breach.

How to Avoid Fines

Regardless of what any future guidelines might say, SaaS suppliers should already have in place their own technical and organisational measures. Not only to avoid the risk of incurring a substantial ICO fine, but moreover to prevent substantial damage to their reputation and financial losses which could result from the publication of internal security system failures and vulnerabilities following an ICO investigation. Sony gave this as one of the reasons why they dropped their appeal against the ICO fine.

Measures to be Taken

Such technical and organisational measures should include:

  • cryptographic controls to protect passwords;
  • ensuring that sub-contractors provide sufficient technical and organisational guarantees in writing;
  • carrying out regular security risk assessments;
  • auditing the compliance of sub-contractors with their contractual obligations.

Conclusion

The ICO is increasingly taking action against companies and imposing large fines for breaches of the DPA. In August penalty notices were issued against the Bank of Scotland, Aberdeen City Council and Islington Borough Council. Statistics on the type of companies being targeted, the nature of breaches occurring and levels of fine are published quarterly on the ICO website and SaaS suppliers should review these to see if they are operating in a particular “risky” area.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: