Tag: IT lawyer

SaaS Agreements – Data Protection – New Proposed EU Rules – Part 2

On the 25th of January 2012 the European Commission published a proposal for a new Data Protection Regulation to replace the existing EU Data Protection Directive. The proposal sets out a general data protection framework aimed at unifying the current differing data protection rules in the EU. Following on from my first article – part 1, I have summarised the remainder of the major changes this will make to EU data protection law below and how this will effect SaaS suppliers and customers.

Data Protection Officer

An independent data protection officer must be appointed by public authorities and businesses with 250 or more employees or businesses whose core activities involve processing operations which require regular and systematic monitoring. The data protection officer must maintain an internal register which the DPA has the right to inspect.

Data Controller                                                                                             

Stricter express duties will be imposed on data controllers. For example they must:

  • maintain documents regarding all processing;
  • implement specific data security requirements;
  • perform data processing impact assessments; and
  • obtain prior authorisation for certain processing activities.

Data Processor

The obligations and duties of data processors will be more specifically defined. For example they should:

  • only employ staff who have given confidentiality undertakings or commitments;
  • obtain the permission of the data controller before employing a sub-processor;
  • ensure that security measures are implemented; and
  • maintain documentation of all processing operations.

Consent

Explicit consent must be obtained from data subjects by SaaS customers. It will not be acceptable for customers to assume consent from a data subject’s silence or inactivity or through generic terms and conditions. Consent must be given by a data subject in a clear statement or via an affirmative action (i.e. ticking a consent box when visiting a website). The data subject must have the right to withdraw consent at any time.

There is an additional requirement that explicit parental consent must be given when processing the data of a child under the age of 13.

Right to be Forgotten

Data subjects will have the right to be forgotten. This will allow individuals to have all personal data that a SaaS supplier holds on them deleted. This will include all photos and any public links to, or copies of, personal data that can be found on the Internet, for example in social networks or via search engines.  SaaS suppliers will be required to permanently delete the individual’s data unless there are legitimate grounds for retaining it.

Right to Copy of Personal Data

In certain circumstances individuals will be able to obtain a copy of their personal data. They will also have the right to have their data transferred automatically between SaaS suppliers, for example from one social network to another. This means that SaaS suppliers will need to implement data exporting tools to enable users to download their data and move it to another provider.

When will the Rules Change

The draft Regulation must be approved by all EU countries and the European Parliament before it comes into effect, probably in about 3 years time. The rules will introduce significant and onerous new obligations upon SaaS suppliers, who will need to implement time consuming measures to ensure compliance, in order to avoid the risks of facing substantial fines.

Preparing for Change

Although the proposals could be substantially amended before they are approved, it is advisable that businesses start to prepare for the proposed changes now. For example by appointing a data protection officer (where appropriate), devising a documentation system for recording data processing activities, reviewing how consent is obtained from data subjects and revising all data processing agreements.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – New Proposed EU Rules – Part 1

On the 25th of January 2012 the European Commission published a proposal for a new Data Protection Regulation to replace the existing EU Data Protection Directive. The proposal sets out a general data protection framework aimed at unifying the current differing data protection rules in the EU.  I have summarised the major changes this will make to EU data protection law in two articles, part 1 of which is set out below and how this will effect SAAS suppliers and customers.

Data Protection Authority

Currently each EU country has its own data protection agency which enforces that country’s law. Processing of personal data by businesses established in more than one EU country will in the future be monitored by one single data processing authority (DPA) – the “lead authority”. Generally the lead authority will be the DPA of the country where the business has its main establishment.

The main establishment of a business will be determined according to objective criteria, such as where the central administration of a business is located i.e. the headquarters where management decisions are usually made. However, individuals located in other EU countries, will still be able to refer privacy complaints to their local supervisory DPA.

One EU-wide Data Protection Law

If the Regulation is adopted, there will be one EU data protection law that SaaS suppliers will need to comply with. The new rules will apply throughout the EU and SaaS suppliers established in more than one EU country will no longer need to cope with the national rules of each relevant EU country. In the long term this means that current local data protection provisions – mainly exemptions that have been introduced by EU countries for national reasons – would disappear.

Non-EU Companies

The new data protection rules will also apply to non-EU based businesses who offer their goods or services to EU customers based in the EU (or who monitor their behaviour). For example a US company with a subsidiary in the EU will be required to comply with the new EU data protection law as well as their own local US laws.

There are exceptions where the data controller (SaaS customer) is established in a country outside the EEA that ensures an adequate level of protection (for example a business registered under the Safe Harbor scheme in the USA), or if the data controller acts for a small or medium sized business or public authority.

Penalties for Breaches 

A breach of the new data protection rules could result in a fine of up to €1 million or 2% of the global annual turnover of a company. Fines will be imposed by the DPA. Currently the maximum fine in the UK for a breach of data protection law is £500,000.

Notification

Serious data protection breaches must be notified to both the DPA and data subjects, although it is not clear whether the lead authority or the company itself will be obliged to inform the public of data protection breaches.

Notification should be without undue delay and, where feasible, within 24 hours. Companies will need to have adequate procedures in place to deal with these new requirements and it may be worth considering purchasing obtaining cyber risk insurance.

When will the Rules Change

The draft Regulation must be approved by all EU countries and the European Parliament before it comes into effect, possibly in about 3 years time. The rules will introduce significant and onerous new obligations upon SaaS suppliers and customers, who will need to implement time consuming measures to ensure compliance, in order to avoid the risks of facing substantial fines.

Preparing for Change

Although the proposals could be substantially amended before they are approved, it is advisable that SaaS suppliers and customers start to prepare for the proposed changes. For example, by devising a documentation system for recording data processing activities, reviewing how consent is obtained from data subjects and revising all data processing agreements.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Need for an Escrow Agreement

As a SaaS supplier you may want to consider offering escrow agreements to your customers, particularly if you run  SaaS applications which are critical to your customer’s business.

What is Escrow

Escrow refers to a third party holding a copy of the SaaS software source code on behalf of the customer and the supplier.

What is an Escrow Agent

An escrow agent is a third party who stores a copy of the SaaS software source code. The escrow agent will release a copy of the source code to the customer if any of the events set out in the escrow agreement occur.

Why use Escrow

This is usually a customer driven requirement resulting from the fact that the source code for the SaaS software, the expertise to implement it and rights to the SaaS software are only licensed to, and not owned by, the customer for the term of the SaaS agreement.

Customers are concerned that the supplier may:

  • fail to maintain the software;
  • transfer ownership of intellectual property rights in the SaaS software;
  • become insolvent; or
  • become unable to carry on supporting and maintaining the software for some other reason.

By having an escrow agreement in place the customer has the right to continue to use the software, if the supplier is in default of its obligations under the SaaS agreement.

Advantages of an Escrow Agreement

Having an escrow agreement in place protects all parties involved in the development, supply and use of business critical SaaS applications. It provides customers with peace of mind for securing long-term availability of a critical SaaS application by enabling customers to update software and fix any bugs even if the supplier is no longer able to support them.

Disadvantages of an Escrow Agreement

Having the right to use the software under an escrow agreement is in reality of little use if the customer does not have the know-how and resources to actually use, maintain and support the source code itself.

Also, the costs of setting up an escrow agreement and maintaining it are relatively expensive. Escrow costs are usually paid for by the customer.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SLA – Security Issues

As a SaaS supplier you will have noticed the increasing concerns about security voiced by SaaS customers. Your SaaS agreement should therefore provide comfort to your customer by including security provisions in the service level agreement (SLA). The specific matters you should consider including are set out below.

 Access

The persons able to access the hosting centre should be very limited and the individuals should be defined. Access should only be allowed for hardware and software maintenance. A record of all visits should be logged, which can be easily achieved if swipe cards are used. Remember that when using a third party hosting centre, access will be controlled by, and should reflect, the terms of your hosting agreement with the hosting centre.

Physical Security

This should prevent unauthorised access to the hosting centre to prevent damage, loss or theft to hardware and software. Surveillance of the hosting centre is essential and details of whether or not this is 24 x 7, via video camera, watchmen or electronic alarm systems should be included in the SLA. Within the hosting centre itself, racks themselves should be separately secured.

Hosting Environment Security

In order to provide a continuous service to customers, the hosting centre must have:

  • an uninterrupted power supply;
  • a dual power source;
  • air conditioning; and
  • fire and flood detection systems.

Server Security

In order to protect your servers, you should use:

  • up to date virus protection;
  • up to date security patches; and
  • firewalls.

Data Security

In order to protect customer data you should set out:

  • how, where and when data will be backed up;
  • how often data will be backed up;
  • where backups will be stored; and
  • when discs/tapes will be rotated.

ISO 27001 Certification

ISO 27001 is an internationally recognised security certification which is often required by SaaS customers who are looking for assurance that adequate levels of data security are in place to protect their data. Having this certification demonstrates to customers your commitment to data security by confirming that you comply with “best practice” security management.

Disaster Recovery

Is this offered at all, consider whether is it included in your standard subscription fee, or if a premium will be charged. Also, remember that your disaster recovery centre should be physically remote from your hosting centre, and with a different provider.

Commercial Considerations

The level of security obligations offered to SaaS customers will depend upon:

  • how much a customer pays for the SaaS solution, maintenance and support;
  • whether the SaaS application is business critical i.e. online banking;
  • what is standard in that particular business area.

Exclusions

Ensure that your SaaS agreement contains appropriate security obligations applicable to your customer, for example using up to date virus programmes. Exclude liability for any security breaches which are caused by something beyond your control or an act, omission or breach of your customer’s security obligations under the SaaS agreement.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

Website Legal Requirements – Contact and Company Information

Does your website comply with the legal requirements for providing contact information and company information in the UK?

Contact Information

The following contact information must be provided in an easily accessible position on your website:

  • an email address
  • telephone number
  • fax number (if you have one)

Increasingly companies do not provide an email address and/or telephone number to avoid receiving unwanted spam emails and telephone calls.

Instead many companies only allow customers to contact them by completing an online contact form. This may breach the Electronic Commerce (EC Directive) Regulations 2002.

Can I use a Contact Form?

The European Court of Justice has ruled that an electronic contact form complies with the E-commerce Directive, where the supplier answers queries sent by customers within a period of 30 to 60 minutes. However, if a customer requests a non-electronic means of communication from the supplier in the contact form i.e. a telephone number, the supplier must provide this.

How to Use a Contact Form Successfully

If you decide to use a contact form instead of giving a contact telephone number or email address ensure that you respond to e-mail queries from customers in a timely manner. You do not automatically need to provide a  contact telephone number, but you must be able to do so, should a customer request this.

Please note you must provide a contact email address on your website.

About Us Information

In addition to the above you are required to provide the following information on your website:

  • your legal name i.e. XYZ Ltd. If this is different from your trading name any differences should be explained.
  • your geographical address,  which must be the registered office if you are a company.
  • which country your business is registered in
  • the registration number of your company
  • details of any supervisory body which regulates your business i.e. the FSA. For regulated bodies more detailed information is required.
  • your VAT number
  • where you are registered for VAT
  • clear details of prices and whether or not delivery and/or tax is included

Help

To have your website reviewed for compliance with English law or for  queries about compliance with the contact and information requirements of the E-Commerce Directive please contact:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: