Tag: Irene Bodle

SaaS Agreements – Data Protection – Update on the EU Draft Data Protection Regulation

SaaS suppliers should be aware of the recent changes made by the EU Parliament to the draft EU Data Protection Regulation (Regulation). If this amended version of the Regulation becomes law next year the obligations of SaaS suppliers who process personal data on behalf of customers will radically change. A summary of the current main proposed provisions is set out below.

Fines

The proposed fine for breaching data protection law will be increased to the higher of:

  • 5% of annual worldwide turnover; or
  • €100 million

Currently the maximum UK fine for a breach of data protection law is £500,000.

Data Protection Officer

A data protection officer must be appointed where:

  • a SaaS supplier processes the personal data of more than 5,000 individuals in any consecutive 12 month period; or
  • special categories of data, location data, data relating to children, or employee data in large scale filing systems is processed.

The data protection officer must be appointed for:

  • a minimum of 2 years; and
  • meet specific minimum requirements set out in the Regulation.

Notification of Data Protection Breaches

SaaS suppliers must notify breaches of data protection law without undue delay.

Data Processor Obligations

The obligations and duties of SaaS suppliers (data processors) have been more specifically defined. For example SaaS suppliers should:

  • only employ staff who have given confidentiality undertakings or commitments;
  • obtain permission from SaaS customers (data controllers) before employing a sub-processor i.e. using a third party hosting centre;
  • ensure that security measures are implemented; and
  • maintain documentation of all processing operations.

Data Transfers – Prism

The transfer of an individual’s personal data to third parties has been restricted in light of recent revelations about the NSA and Prism. No transfer of personal data will be permitted in relation to a third country court decision or administrative authority (i.e. under the Patriot Act or FISA) if this does not comply with a mutual legal assistance treaty or an international agreement.

Additionally, individuals will have the right to know if their personal data has been disclosed to a public authority.

Territorial Scope

The Regulation will apply to companies located outside of the EU whenever they process the personal data of individuals located in the EU. This means that if a UK SaaS supplier uses a data centre located outside of the EU to host EU SaaS customer data the provisions of the new Regulation will apply to both the SaaS provider and the data centre. For example if a SaaS supplier uses Microsoft to host EU customer data both will be directly subject to EU data protection law.

Right to be Forgotten

This has been changed to the right to be erased. This right will not apply to data which cannot be erased due to the type of storage technology used, provided that the technology was installed prior to the Regulation coming into force.

Summary

The above is a summary of the current status of the draft Regulation. The Regulation may be amended before it becomes law in 2014 and SaaS suppliers should continue to monitor the position to ensure they are ready to adapt their existing procedures and compliance regimes to comply with any change in their legal obligations.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To learn more about SaaS and cloud computing join me at the Berlin CloudConf 2013 on 5th of December.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Confidential Information – FOIA and SARs

SaaS suppliers are increasingly dealing with subject access requests (SARs) and freedom of information requests (FOIAs) in relation to SaaS customers. Excessive time and costs can be spent dealing with such requests, unless a SaaS supplier’s obligation to comply with or assist a SaaS customer with such requests is clearly defined in the terms of the SaaS agreement.

Subject Access Request (SAR)

Under the Data Protection Act 1998 (DPA), an individual has the right to access personal data held by a SaaS supplier by making a SAR. Such requests for data usually relate to customer data held on behalf of SaaS customers. The SAR can be sent directly to a SaaS supplier or to the SaaS customer. This is not the same as a request for information under the Freedom of Information Act (FOIA).

FOIA

Under the FOIA members of the public are entitled to request disclosure of:

  • non-personal information;
  • held by public authorities.

Requests are made to the SaaS customer directly who often passes the request on to their SaaS supplier.

SAR or FOIA?

SaaS suppliers should not confuse a FOIA request with an individual’s right to request personal information under a SAR. The test for disclosure under the FOIA is to the world at large – not just the requester. This means that if a SaaS supplier mistakenly discloses personal data under an FOIA request, this could breach the DPA and result in a large fine as a substantial number of unauthorised persons may see the wrongly disclosed data.

SARs

The Information Commissioner’s Office (ICO) has issued a Subject Access Code of Practice which all SaaS suppliers should read. This provides useful advice on how to respond to a SAR.

For example, SaaS supplier’s should upon receipt of a SAR:

  • identify whether a request is actually a SAR;
  • ensure they have enough information to be certain of the requester’s identity;
  • consider whether any of the exemptions apply; and
  • provide a response in a permanent form where appropriate, stating whether a fee is payable.

The Data Commissioner has also issued guidance on how to deal with a FOIA request.

Contractual Provisions

SaaS suppliers should include specific provisions in their SaaS agreement setting out how disclosure requests will be dealt with. Note that these should not be limited to SARs and FOIAs, as there are other types of disclosure requests that can be made under English law.

The SaaS agreement should:

  • set out the extent of the assistance to be given by the SaaS supplier to SaaS customers when dealing with a disclosure request;
  • specify whether the consent of the SaaS customer is required prior to any data being disclosed; and
  • include relevant time limits for complying with any requests.

Additionally SaaS suppliers could have a data access policy setting out their specific obligations. This can be incorporated into the SaaS agreement by reference to it in the terms of the SaaS agreement.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To learn more about SaaS and cloud computing join me at the Berlin CloudConf 2013 on 5th of December.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Terms and Conditions – Renegotiating Terms

Customers are increasingly attempting to renegotiate the terms of existing SaaS agreements, to reduce costs as more SaaS suppliers enter the market offering competing and cheaper SaaS services. In order to pre-empt such discussions SaaS suppliers should review their current SaaS agreements to ensure that they have the following terms in place to deal with and counter such requests.

Annual Price Alignment

SaaS customers will argue that hosting, storage and IT costs are becoming ever cheaper, so the savings should be reflected in prices. However, even if this is true, this does not automatically have a knock-on effect on a SaaS supplier’s total costs. Wages, IT and professional indemnity costs are increasing. It is therefore prudent to have the right to increase fees included in the pricing terms of your SaaS agreement. SaaS suppliers can then decide on an individual basis whether to actually exercise this right. Without this right, SaaS suppliers will have difficulties increasing prices at all.

Merger & Restructure

Depending upon the pricing model used, SaaS suppliers may or may not align prices to the numbers of users, traffic, data storage etc. However all SaaS suppliers set their prices based upon some sort of variable – which could change in the future. For example, if a SaaS customer merges their business with a competitor, is acquired, or simply restructures its business, a SaaS supplier must have the right to adjust prices to reflect the increase in users, traffic, data storage etc. This right should be specifically included in the terms of the SaaS agreement. It should include the right to adjust prices if the scope of access to the SaaS services is to be altered or increased, to a different set or extended group of users.

Term

SaaS customers often order SaaS services for a fixed term and obtain a discounted price. The SaaS agreement often says nothing about an increase in prices after the expiry of the fixed term. SaaS suppliers should always include a right to renegotiate or increase prices prior to expiration of the fixed term. If a discount has been given in return for a fixed term then any discount should cease to apply after the fixed period expires. If there is no fixed or minimum term SaaS suppliers should include a specific contractual right to renew prices on a regular basis.

Termination

Any termination rights given to a SaaS customer in a SaaS agreement could become problematic when negotiating changes to existing terms. Customers who have the right to terminate a SaaS agreement at any time, can simply demand a lower price and then terminate if there is a disagreement. Where SaaS customers are granted more restrictive rights of termination, it will be more difficult for them to terminate if you exercise a contractual right to increase prices.

Changes in Law

The laws applicable to your SaaS agreement will change with time. SaaS suppliers should reserve the right to amend their SaaS agreement terms to incorporate any changes in mandatory applicable laws, without this triggering a wholesale renegotiation of the SaaS terms generally. For example, once the new Data Protection Directive is finalised (probably next year), SaaS suppliers may have a mandatory obligation to disclose data and security breaches which may currently be prohibited under existing SaaS agreement terms.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To learn more about SaaS and cloud computing join me at the Berlin CloudConf 2013 on 5th of December.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Hosting – Encryption of Stored Data

Under the Data Protection Act (DPA), SaaS customers are required to take “appropriate technical and organisational measures” to prevent the unauthorised or unlawful processing of personal data and accidental loss or destruction of, or damage to, personal data. SaaS providers who process personal data on behalf of SaaS customers are required to include such obligations in their SaaS agreement (or SLA).

Written Obligation

The specific obligations specify that SaaS customers must have a written contract with SaaS providers which states that:

  • the SaaS provider may only process data in accordance with the SaaS customer’s instructions; and
  • the SaaS provider undertakes to comply with the “technical and organisational measures” requirements of the DPA.

Encryption Requirement

Last year the Information Commissioner’s Office (ICO) issued some guidance on cloud computing. Amongst other issues, this advised SaaS customers to ensure that personal data in transit is secure and protected from interception by:

  • encrypting data in transit;
  • using encryption that meets recognised industry standards; and
  • obtaining assurances from SaaS providers that data in transit is appropriately secure.

The ICO also advised that data “at rest” i.e. personal data which is stored, should also be encrypted, depending upon the nature of the personal data held i.e. is it sensitive personal data and the type of processing taking place.

SaaS customers were advised to ensure that encryption keys are:

  • kept up to date, in order to maintain the level of protection; and
  • not lost, as this could render the data useless.

Compliance

SaaS customers are increasingly asking SaaS providers to include data encryption obligations in SaaS agreements. Google cloud services now:

  • automatically encrypts all data before it is stored;
  • regularly updates keys;
  • implements access controls; and
  • permits auditing procedures.

In time this could become standard for all SaaS providers. In any event you may want to check with your data centre, where you are outsourcing hosting and storage to check whether they also offer this service, which is provided to Google cloud service customers at no additional cost.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To learn more about SaaS and cloud computing join me at the Berlin CloudConf 2013 on the 5th December.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Terms & Conditions – Insolvency and ERRA

From April 2014 the UK government plans to change the Insolvency Act under the provisions of the Enterprise and Regulatory Reform Act 2013 (ERRA). This will make a SaaS supplier’s right to terminate or alter the terms of an existing SaaS agreement void if a SaaS customer becomes insolvent. From this data no SaaS agreement may be terminated or have the pricing and payment terms changed due to a customer’s insolvency. Furthermore the SaaS supplier must continue to provide SaaS services without receiving any payment or having any right to arrears.

ERRA

Section 233 of the Insolvency Act 1986 prevents suppliers of gas, water, electricity and telecoms from ceasing to supply utilities to insolvent customers. ERRA will widen the scope of section 233 to anyone designated by the Secretary of State as providing essential services and includes the “supply of a specified description of goods or services by a specified description of person where the supply is for the purpose of enabling or facilitating anything to be done by electronic means” i.e. an IT supplier. All SaaS suppliers could fall within the scope of ERRA.

Contractual Restrictions

The terms of existing SaaS agreements and any agreements entered into after April 2014 will be affected as follows:

  • SaaS suppliers will no longer be able to withdraw or suspend the supply of SaaS services from insolvent SaaS customers;
  • SaaS suppliers will no longer be able to make it a condition of continuing to supply SaaS services that all outstanding debts are paid;
  • SaaS suppliers will no longer be able to “unfairly” or “unreasonably” increase prices for the continued supply of SaaS services to an insolvent customer; and
  • Sub-contractors of SaaS suppliers, such as the hosting centre, backup providers or software developers may also be obliged to comply with the ERRA in relation to the SaaS provider’s insolvent customer.

Protection for Suppliers

SaaS suppliers should however be partially protected against being tied into loss making SaaS agreements, by being given the following rights:

  • to request a personal guarantee for payment from the insolvency practitioner of the insolvent customer as a condition for continuing to supply the insolvent SaaS customer;
  • to terminate the SaaS agreement if the relevant insolvency practitioner or a court agrees;
  • to terminate the SaaS agreement if post-insolvency charges are not paid within 28 days of the date that they fall due.

However such safeguards need to be introduced by secondary legislation.

Avoiding Potential Problems

SaaS suppliers should now check the terms of agreements with sub-contractors to ensure they are not liable to sub-suppliers for providing services to insolvent customers unless the SaaS supplier itself receives payment from the insolvent customer i.e. a software developer is working on a project specifically for the insolvent SaaS customer under a consultancy agreement.

SaaS suppliers should also review the terms of their existing SaaS agreements, in particular to check that:

  • SaaS customers have no right to assign the SaaS agreement, then an insolvency practitioner will not be able to transfer it; and
  • regular price reviews are built into the terms so that prices do not remain static indefinitely.

The consultation process on the changes to the Insolvency Act is not yet finalised and SaaS suppliers should therefore look out for further developments.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – IT Security Requirements

In January 2013 Sony was fined 250,000 GBP for failing to take “appropriate technical measures” to protect the security of personal data stored on its PlayStation Network (PSN) in breach of the Data Protection Act (DPA). In light of the lack of guidance currently provided by the Information Commissioner’s Office (ICO) on data protection security SaaS suppliers should be aware that the ICO plans to draw up new guidelines.

Appropriate Technical and Organisational Measures

Under the DPA, SaaS suppliers must take appropriate technical and organisational measures against the unauthorised or unlawful processing of personal data and accidental loss, destruction or damage to personal data. However there is currently no legal definition, or guidance from the ICO, on what are “appropriate” organisational and technical measures.

In the past the ICO has stated that personal data should be encrypted, if loss or theft of the data would cause damage or distress to the individuals concerned. More recently in the case of Sony, the ICO found that Sony’s software was not up to date and that passwords were not secure.

However, in light of the lack of any specific guidance on this matter, the ICO seems to determine fines based on the facts of each individual case.

Factors to Consider

Often the following factors are taken into consideration by the ICO:

  • the financial resources of a SaaS supplier;
  • the number of individuals whose data is affected;
  • the harm actually caused to those individuals;
  • how a SaaS supplier responds to a breach;
  • what technology the SaaS supplier uses; and
  • any mitigating factors, such as voluntarily reporting of a breach.

How to Avoid Fines

Regardless of what any future guidelines might say, SaaS suppliers should already have in place their own technical and organisational measures. Not only to avoid the risk of incurring a substantial ICO fine, but moreover to prevent substantial damage to their reputation and financial losses which could result from the publication of internal security system failures and vulnerabilities following an ICO investigation. Sony gave this as one of the reasons why they dropped their appeal against the ICO fine.

Measures to be Taken

Such technical and organisational measures should include:

  • cryptographic controls to protect passwords;
  • ensuring that sub-contractors provide sufficient technical and organisational guarantees in writing;
  • carrying out regular security risk assessments;
  • auditing the compliance of sub-contractors with their contractual obligations.

Conclusion

The ICO is increasingly taking action against companies and imposing large fines for breaches of the DPA. In August penalty notices were issued against the Bank of Scotland, Aberdeen City Council and Islington Borough Council. Statistics on the type of companies being targeted, the nature of breaches occurring and levels of fine are published quarterly on the ICO website and SaaS suppliers should review these to see if they are operating in a particular “risky” area.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Social Media – Ownership of Accounts

Increasingly SaaS suppliers encourage employees to use social media accounts i.e. LinkedIn and Twitter to promote their products and business. However this often results in a conflict arising between claims of misuse of confidential information and “ownership” of accounts and contacts when the employment relationship comes to an end.

The High Court has recently highlighted the need for SaaS suppliers to have a clear policy on the ownership of such social media accounts and contacts when they are used by employees for business purposes.

Whitmar Publication Ltd

The High Court granted an injunction to Whitmar Publication Ltd against 3 ex-employees (and their newly established rival company) to prevent the individuals and the company from using 4 LinkedIn groups. One of the individuals had been responsible for dealing with the LinkedIn groups as part of her responsibilities at Whitmar Publication Ltd.

In a ruling using arguments similar to those used in the decision of the High Court against a former Hays employee in 2008 ordering him to hand over all of his LinkedIn contacts after leaving the company to set up his own consulting business, an injunction was granted on the basis that the individuals had misused confidential information belonging to the company, infringed the company’s database rights and breached duties under their employment contracts.

Ownership

This will depend upon who set up the account, why it was set up, whether it is also being used for private use and who is paying for and maintaining it.

In the Whitmar injunction the court determined that the following factors were key:

  • the extent to which the account or group was created for the benefit of the employer; and
  • the extent to which the account or group promoted the employer’s business.

Social Media Policy

The above emphasizes the need for SaaS suppliers to have a clear social media policy in place with their employees. This should cover:

  • ownership and use of accounts on termination of employment;
  • access details to accounts;
  • use of information collected through social media accounts.

If a SaaS supplier has a signed social media policy it will restrict what ex-employees can and cannot do with social media accounts and/or contacts after leaving the company.

Employment Contracts

Additionally, SaaS suppliers should include non-solicitation or non-compete clauses in all of their employment contracts which specifically prevent ex-employees from using social media accounts or contacts upon termination of their employment. Employment contracts should also include general clauses preventing employees from using confidential information.

Conclusion

In view of the above, SaaS suppliers need to consider “ownership” of social media accounts and contacts before encouraging employees to use these tools at work. There must be a clear written agreement governing what happens to such data when an individual leaves the company – usually set out in a social media policy and/or employment contracts.

Other measures that SaaS suppliers could consider taking are:

  • simply banning all use of social media accounts such as Facebook, LinkedIn and Twitter; or
  • ensuring that relevant employees add all new social media contacts to the company’s CRM database.

By considering the risks and taking necessary measures to prevent these issues arising SaaS suppliers should be able to avoid costly litigation when employees leave, potentially taking their contacts, accounts and followers with them.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Advantages of Hosting in Switzerland

SaaS suppliers are increasingly using data centres located in Switzerland to host SaaS software and store customer data. In light of recent media revelations about “prism” and the already existing concerns over access to customer data under the Patriot Act and FISA this could be an increasing trend. The advantages of hosting SaaS data in Switzerland are summarised below.

Why Switzerland?

Switzerland is often viewed internationally as representing the following values – stability, neutrality, discretion and trustworthiness based on its banking history. For this reason Swiss law is often accepted by non-European customers in international agreements when there is a disagreement about which law or arbitration rules should apply to the contract.

Confidentiality

Currently many global SaaS suppliers use data centres located in the USA. However, when dealing with European customers, SaaS suppliers often encounter problems with customers raising concerns about the application of:

  • the Patriot Act, a US law which permits US authorities to access EU customer data stored in the USA or EU customer data stored outside of the US where there is a US parent company such as Microsoft; and
  • FISA which allows the US government to access and monitor the personal data of non-US citizens held by US public cloud providers such as Amazon or Google.

An additional benefit of using a Swiss data centre is that generally data stored in Switzerland is not traceable to a named person, but only to a number.

Safe Harbor not Adequate

SaaS customers and data protection authorities, particularly in Germany, are raising concerns about the adequacy of the safe harbor status of US companies. It is often claimed that safe harbour certification is little more than a paper exercise which in practice does not comply with European levels of data protection.

Compliance with EU Data Protection Laws

An added advantage of using Swiss data centres is that Switzerland is accepted by the EU as having equivalent protection to EU data protection laws. Therefore no additional consents are required from SaaS customers to enable data to be stored and processed in Switzerland.

Language

Although English is not one of the official languages of Switzerland, it is widely spoken and is the language of preference for business transactions. In addition French, German and Italian are official languages providing the added bonus of SaaS suppliers being able to request hosting services in any, or all, of the four languages. This makes Switzerland very attractive to global companies who are often wary of hosting outside of their territory due to language barriers.

Summary

Under the provisions of the US Patriot Act and FISA, the personal data of SaaS customers based in the EU must be shared with US law enforcers without the customer being informed, even though this conflicts with EU data protection law.

By using a data centre located in Switzerland a SaaS supplier can process and store customer data in compliance with EU data protection rules, provided that the hosting company located in Switzerland, is not owned by a US parent company.

For the above reasons some well known global companies such as Swift, Yahoo and Hewlett Packard have in recent years relocated their hosting services to Switzerland.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Prism

In light of recent and ongoing “prism” revelations, SaaS suppliers are having to deal with numerous queries about the safety of SaaS customer data. Many customers mistakenly believe that by using a non-US data centre their SaaS customer data is protected against disclosure to the US authorities. Below is a summary of the relevant laws and most common concerns being raised by SaaS customers.

What is Prism?

“Prism” refers to the National Security Agency (NSA) secretly accessing personal data stored on the servers of Microsoft, Apple, Google, Yahoo, Facebook and some other major US public companies.

Prism, FISA and the Patriot Act

Prism is not the only problem. The US government has been secretly accessing SaaS customer data for years under the Foreign Intelligence Security Act (FISA) and the Patriot Act. Prism is just part of the whole range of tools that are being used by the US to access SaaS data of EU citizens.

What is FISA?

FISA allows the US government to access and monitor the personal data of non-US citizens (located outside of the USA) held by US public cloud providers. Public cloud providers such as Amazon and Google must secretly provide all assistance, facilities and information requested by the government if they request access to SaaS customer data. The public entity is not allowed to inform the SaaS supplier that it has disclosed or been asked to disclose personal data, nor that the data is being monitored.

The Patriot Act

The Patriot Act gives US law enforcement authorities the right to access personal data held by SaaS suppliers, regardless of where in the world the data is stored. The Act also gives US law enforcers the right to prevent SaaS suppliers from informing customers that they have handed over personal data. The Act applies not just to SaaS suppliers owned by a US company but also to any SaaS suppliers using the services of a US company i.e. a US data centre.

Safe Harbor

Safe Harbor does not protect SaaS customer data against secret access by the US authorities. Safe harbor, simply means that a US company registered under the “safe harbor” scheme is deemed to have data protection principles in place which are accepted in the EU as being adequate. This simply allows SaaS customer data to be legally transferred outside of the EU i.e. to be processed in a US data centre.

Summary

Many SaaS customers falsely believe that if their SaaS data is stored in a data centre located in the EU it will be protected against disclosure to the US authorities. Under the Patriot Act, FISA (and “prism” where applicable) the personal data of SaaS customers based in the EU must be shared with US law enforcers without the customer being informed, even though this conflicts with the EU Data Protection Directive and the data protection laws of the 28 EU member states.

Local EU data protection authorities and EU member state governments are currently investigating how to resolve this conflict, for example by adding provisions preventing disclosure in the draft proposed EU data protection regulation. While the position remains unresolved, SaaS suppliers should be considering how to minimise the risk this poses to their business model, whilst assuring SaaS customers that their concerns are being addressed.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Data Controller

It is important for a SaaS supplier to understand the legal obligations imposed upon a data controller when negotiating a SaaS agreement and data processing agreement (“DPA“) as the duties of a data controller are not the same as the duties of a data processor. In a SaaS relationship the SaaS customer is always the data controller and the SaaS supplier is always the data processor of the SaaS customer.

Who is a data controller

A data controller is defined in Article 4(7) of the GDPR as follows:

“the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.”

The data controller always decides and controls the purposes for which personal data is to be collected and processed. A data processor acts on behalf of, and only on the instructions of the data controller.

Controller obligations under the GDPR

The GDPR sets out the following 7 data protection principles that a data controller must comply with.

  • Lawfulness, fairness and transparency;
  • Purpose limitation;
  • Data minimisation;
  • Accuracy;
  • Storage limitation;
  • Integrity and confidentiality (security);
  • Accountability.

Need for a Data Processing Agreement

Since the GDPR and the UK Data Protection Act 2018 came into force on the 25th of May 2018 the obligations of data controllers have become more onerous. It is now mandatory for the data processor and the data controller to enter into a written agreement – DPA, setting out each party’s obligations. The DPA must include specific minimum terms.

Liability for Personal Data

A SaaS customer will be liable to its clients/end users (whose personal data it is collecting and processing) for any breaches of the GDPR. As the SaaS supplier will be carrying out the processing on behalf of the SaaS customer, the terms of the SaaS agreement should include adequate clauses to protect the SaaS supplier and the SaaS customer against data protection breaches, bearing in mind the differing responsibilities of the data controller and the data processor.

Registration under the Data Protection Act

The UK Data Protection Act 2018 requires every data controller who is processing personal data to register with the UK Information Commissioners Office (“ICO“), unless an exemption applies. It is not just a SaaS supplier who must register. A SaaS customer must also register where it acts as a data controller, in addition to being a data processor. Failure to register is a criminal offence.

There is an annual fee for registration. Current fees are determined by the ICO and a self assessment tool on the ICO website can be used to help you determine whether or not you are a data controller who needs to pay the fee.

Subject Access Request

Data subjects (clients of the SaaS customer) have the right to make a subject access request to the data controller.

Information must be provided within strict time limits and at no cost to the data subject. The request is made to the data controller (the SaaS customer) and the SaaS customer is obliged under the GDPR to respond. However, it is often the SaaS supplier who actually needs to provide the information stored on its servers either to the SaaS customer or their clients, on the SaaS customer’s behalf.

General

When considering SaaS customer requests to change clauses relating to liability, indemnities, data and data protection in a SaaS agreement or DPA it is essential that a SaaS supplier understands the statutory obligations of the data controller and data processor and the implications of changing any terms of the SaaS agreement or DPA.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: