Tag: fine

SaaS Agreements – Data Protection – What SaaS Suppliers need to know about the GDPR

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change existing data protection laws in all 28 EU member states. The GDPR will place direct obligations on SaaS suppliers (data processors) in relation to data processing activities. In addition SaaS customers (data controllers), their clients (data subjects) and local data protection authorities will be able to enforce breaches of the new rules directly against SaaS suppliers.

SaaS suppliers need to amend the provisions of their existing SaaS agreements in order to comply with the upcoming changes in data protection law.

Written Data Processing Agreement

SaaS suppliers will need to include the following minimum terms in a written data processing agreement with all SaaS customers:

  • The duration, nature and purpose of the data processing;
  • The types of data being processed;
  • The obligations and rights of the customer.

The written data processing agreement must state that:

  • Personal data will only be processed in accordance with documented instructions from the SaaS customer;
  • The SaaS supplier will assist the SaaS customer in complying with its own obligations as a data controller;
  • The SaaS supplier is obliged to inform the SaaS customer if it believes an instruction to give personal data to the SaaS customer breaches the GDPR or any other EU or Member State law.

Record Keeping

Unless one of the exceptions applies, the main one being that the SaaS supplier has less than 250 employees, SaaS suppliers must keep records of all categories of processing activities that they carry out.

The following details must be recorded:

  • Information about the SaaS customer and any other data processors;
  • Names of relevant data protection officers (DPOs);
  • The categories of data processing carried out;
  • Any transfers to third countries; and
  • The general technical, organisational and security measures used by the SaaS supplier.

If requested by a supervisory authority, SaaS suppliers must provide such records.

Subcontracting

SaaS suppliers will need to obtain prior written consent to the subcontracting of any data processing activities: for example the using a third party hosting centre such as AWS or Microsoft Azure. Although SaaS suppliers can include a general consent to subcontracting in the provisions of their SaaS agreeents, SaaS suppliers will still be obliged to inform SaaS customers before adding or replacing any sub-processors in order to give customers time to object to a change.

Breach Notification

SaaS suppliers will be required to notify SaaS customers of any breach of their obligations, without undue delay, after becoming aware of the breach.

Data Protection Officers

SaaS suppliers will be obliged to appoint a data protection officer (DPO) in some specific circumstances: for example where the SaaS supplier is processing special data (sensitive data) or if required to do so under a Member State law.

The contact details of any DPO appointed must be published and communicated to the applicable supervisory authority.

Deletion or Return of Data

SaaS suppliers must allow SaaS customers to choose between deletion or return of all personal data on termination or expiry of the SaaS agreement (unless applicable mandatory law requires storage). SaaS customers will be entitled to check compliance with this requirement.

Transfers outside the EEA

Although SaaS suppliers are required to follow a SaaS customer’s instructions with regard to data processing, SaaS suppliers may only transfer personal data outside of the EEA if the SaaS supplier or SaaS customer has provided appropriate safeguards: for example by using of EU model clauses or Binding Corporate Rules (BCRs).

Fines and Compensation

  • Data subjects will be able to take action against SaaS suppliers directly and claim damages for the SaaS supplier’s breach of any obligations under the GDPR; or
  • SaaS suppliers will be potentially liable to both the SaaS customer and data subjects for the same breach.

In addition data protection authorities will be able to fine SaaS suppliers up to 4% of annual global turnover for some breaches.

Preparing for Change

SaaS suppliers need to review the terms of their existing SaaS agreements and their internal procedures to ensure that they comply with the new rules on the use of subcontractors, data security requirements, appointment of DPOs and having in place appropriate organisational and technical measures.

SaaS suppliers should ensure that existing and future agreements with their sub-processors impose the same data processing obligations on all subcontractors, as the SaaS supplier will be liable to the SaaS customer and data subjects for any breaches of the new rules caused by any subcontractors.

SaaS suppliers should ensure that their insurance cover and indemnities and limitations on liability contained in existing SaaS agreements relating to use of personal data are sufficient to cover the higher levels of fines and direct claims for damages by data subjects.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience dealing with SaaS, cloud computing matters and IT law issues. If you require assistance with any SaaS agreements, cloud computing matters or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Terms and Conditions – Data Processing Agreement

UK SaaS suppliers currently have limited obligations to SaaS customers when processing personal data as part of their SaaS services. Under the General Data Protection Regulation (GDPR) many new data processing obligations are imposed on SaaS suppliers. In particular, the obligation for SaaS suppliers to enter into a written data processing agreement with SaaS customers and subcontractors.

GDPR applies to UK SaaS Suppliers despite Brexit

Regardless of when and how Brexit takes place, the GDPR will apply to SaaS suppliers located within the UK if:

  • They offer goods or services to SaaS customers located within the EU (i.e. in any of the remaining 27 EU Member States); or
  • They monitor the behaviour of EU data subjects;

Even though UK SaaS suppliers will no longer be located within the EU themselves after a Brexit.

GDPR applies to non-EU SaaS Suppliers

The GDPR automatically applies to all SaaS suppliers located outside of the EU i.e. in the USA, if:

  • They offer goods or services to SaaS customers located within the EU; or
  • They monitor the behaviour of EU data subjects;

Even though the SaaS supplier is not located within the EU.

Written Data Processing Agreement

Under the GDPR SaaS suppliers and SaaS customers must include detailed data processing obligations in a written data processing agreement. This can form part of the SaaS Agreement or be a separate schedule or agreement.

SaaS Suppliers should be aware that they need to enter into written data processing agreements not just with all SaaS customers, but also with all entities or persons who process personal data on their behalf, such as:

  • All subcontractors i.e. data centres, penetration testing providers;
  • All subsidiaries i.e. providing customer support, software maintenance and support.

Fines for Breach

Data subjects can claim damages directly from SaaS suppliers who breach:

  • Any obligations under the GDPR; or
  • Any lawful instructions of a SaaS customer.

In addition data protection authorities can fine SaaS suppliers or SaaS customers up to 4% of annual global turnover or 20m Euros (whichever is higher) for breaches of the GDPR.

Preparing for Change

To ensure compliance with the new obligations placed on SaaS suppliers (data processors) under the GDPR, SaaS suppliers should taking the following steps:

  • Review existing data protection policies and procedures for compliance with the GDPR;
  • Adapt existing privacy, security and data breach policies to comply with the new rules before the 25th of May 2018;
  • Create a written data processing agreement which reflects the above polices and which is compliant with the GDPR;
  • Review existing SaaS agreements to check limitations on liabilities and indemnities for data protection breaches;
  • Identify any subcontractors and subsidiaries who process personal data;
  • Audit compliance of subcontractors and subsidiaries with new policies and procedures; and
  • Add written data processing agreements to all existing agreements with SaaS customers, subcontractors and subsidiaries.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience in dealing with SaaS, cloud computing and IT law issues. If you require assistance with any SaaS agreements, cloud computing concerns or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Email Marketing and Consent

As a SaaS supplier you will undoubtedly be sending marketing emails in your own name to existing and potential clients to advertise your own products and services, or possibly as a SaaS service on behalf of a customer. In any event you should be aware that the Information Commissioner’s Office (ICO) has issued new guidance on direct marketing, with regard to complying with the Data Protection Act (DPA) and the Privacy and Electronic Communications Regulations (PECR) both of which apply to sending direct marketing to consumers (BTC).

Consent

SaaS suppliers must obtain “extremely clear and specific” consent from individuals in order to conduct direct marketing via email or through any other form of electronic marketing i.e. text or via the telephone. SaaS suppliers cannot simply rely upon implied consent unless this is adequate.

Implied consent will not be adequate if:

  • it is obtained via acceptance of a privacy policy which is hard to find, difficult to understand, lengthy, or rarely read;
  • it must be given in order to subscribe to a service;
  • it is not freely given;
  • the individual is not specifically informed about what they are consenting to; and
  • it does not involve a positive action indicating agreement.

Specific Consent

A SaaS supplier must obtain specific consent to the type of communication in question.  For example, if an individual has consented to receive marketing texts a SaaS supplier is not permitted to send marketing emails and vice versa. Also, although a general statement of consent to receive marketing might be valid for email marketing, it will not cover telephone calls or texts as additional rules apply to these forms of marketing under the PECR.

Email Marketing Lists

The ICO guidance specifically refers to the issue of obtaining consent in relation to the use of third party email marketing lists. Often marketing lists are sold to a SaaS supplier or a SaaS customer where the seller claims to have obtained relevant consents from individuals. However, such third party consent cannot be relied upon by the SaaS supplier or the SaaS customer – unless the individual intended their consent to be passed on to the SaaS customer or SaaS supplier (whoever is actually doing the marketing).

SaaS suppliers should also be aware that other regulatory bodies have rules that apply to social media and digital advertising that must also be complied with. For example the Advertising Standards Agency (ASA), the Digital Marketing Association (DMA) and the Office of Fair Trading (OFT) have their own rules.

How to Obtain Consent

SaaS suppliers should use opt-in boxes in order to obtain explicit consent to direct marketing from individuals. Clear records should be kept of all consents, showing when and how such consent was obtained. These records can then be used as evidence if a complaint is made.

On-going Marketing

The context in which consent is obtained will determine whether SaaS suppliers can rely on consent to all future direct marketing via electronic messaging. For example, consent for a one-off message, or consent that is clearly only intended to cover a short period of time or a particular context, will not count as on-going consent for all future marketing messages.

Fines for Breach

The ICO can fine SaaS suppliers up to £500,000 for serious breaches of the DPA or PECR i.e. for sending unsolicited marketing emails, texts or live and automated marketing phone calls.

Therefore if you are a SaaS supplier offering SaaS services to consumers or you have a SaaS customer who uses your SaaS services to send marketing emails to consumers, you need to ensure that you follow the ICO guidance on direct marketing.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To learn more about SaaS and cloud computing join me at the Berlin CloudConf 2013 on 5th of December.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Policies and Procedures

SaaS suppliers must have adequate data protection policies, procedures and checks in place when employees or third parties are handling SaaS customer data or face the risk of being heavily fined by the Information Commissioner’s Office (ICO) for breaches of the Data Protection Act 1998 (DPA).

Torbay Care Trust

A health trust in Torquay was recently fined £175,000 for breaches of the DPA after it accidentally published sensitive date of more than 1,000 staff on its website. The sensitive data contained the names, religion, sexuality, date of birth and National Insurance numbers of employees – which had been collected in an internal diversity response exercise.

Obligations under the DPA

Under the DPA you must have:

  • appropriate organisational measures to prevent the unauthorised use of personal data; and
  • effective policies and procedures for handling personal data,

in place.

The Trust was found to be in breach of both of these obligations, as it had no internal guidance on what should and should not be published online and had no adequate checks in place to identify potential data disclosure problems.

Appropriate Organisational Measures & Effective Policies

In order to avoid similar breaches (and fines) for disclosure of SaaS customer data, SaaS suppliers should have a data protection policy in place that all staff have read, accepted and understood. This should be regularly updated to reflect changes in the law and staff should be provided with basic data protection training on a regular basis.

In addition, SaaS suppliers should have robust procedures in place for managing SaaS customer information. For example access to the customer’s information should be controlled and monitored in order to make the information more secure and thus minimise the risk of any accidental or unauthorised disclosure.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:


SaaS Agreements – Data Protection – Further Fines by Data Commissioner

On the 8th of February 2011 Ealing and Hounslow Councils were fined £80,000 and £70,000 respectively by the Data Commissioner for serious breaches of the Data Protection Act (DPA) following the theft of two laptops from the house of an employee of Ealing Council.

Data Protection Act 1998

The Data Commissioner has the power to impose a fine of up to £500,000 on a data controller who seriously breaches the DPA, if the contravention was of a kind likely to cause substantial damage or substantial distress. The contravention must either have been deliberate or the data controller must have known or ought to have known that there was a risk that a contravention would occur and failed to take reasonable steps to prevent it.

Ealing and Hounslow County Council Cases

Ealing Council operated an out-of-office service on behalf of both councils using nine staff working from home with laptops. As part of the service information about individuals  including names, dates of birth, gender, ethnicity, addresses and telephone numbers were stored on the laptops. Following the theft of two laptops the personal data of approximately 1,000 clients of Ealing Council and 700 clients of Hounslow Council was potentially compromised.

Reason for the Fines

According to the ICO, Ealing Council breached the Seventh Data Protection Principle of the 1998 UK Data Protection Act, as it issued unencrypted laptops, and had insufficient processes in place to check that the relevant policies were being followed or understood by staff. Hounslow Council was found to have breached the Act for failing to have a written contract in place with Ealing Council.

The fines were imposed even though to date there is no evidence that any data on the computers has been accessed and no complaints have been received by the data controller from clients.

How to Avoid Fines

If the Council had taken the simple step of encrypting the data (in accordance with its own policies), thousands of people’s privacy would not have been potentially compromised.

In view of the above, it is imperative that you take reasonable steps to avoid data protection breaches to limit your exposure to having such fines imposed. The following basic precautions should be taken:

  • ensure that all laptops, memory sticks and backup tapes are encrypted;
  • have appropriate data protection policies and procedures in place;
  • carry out due diligence on your security procedures and those of your sub-contractors and third parties;
  • audit compliance with your  security procedures of sub-contractors and third parties regularly.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: