Tag: lawyer Berlin

SaaS Agreements – Data Protection – Prism and US Laws

SaaS suppliers should be aware of relevant US laws when outsourcing SaaS services (data storage and hosting) to US companies or companies located in the USA. SaaS customers are becoming increasingly concerned about outsourcing in the USA following media reports about “Prism”. Namely, that the National Security Agency (NSA) accesses personal data stored on the servers of Microsoft, Apple, Google, Yahoo, Facebook and a few other major US public companies. Below is a summary of the most relevant US laws that SaaS suppliers should be aware of.

FISA

If you outsource any SaaS services to a US public company the US government can access SaaS customer data pursuant to the Foreign Intelligence Security Act (FISA).

FISA allows the US government to access and monitor the personal data of non-US citizens (located outside of the USA) held by US public cloud providers (i.e. Amazon or Google). Public cloud providers must secretly provide all assistance, facilities and information requested by the government if they request access to SaaS customer data. The public entity is not permitted to inform the SaaS supplier that it has disclosed or been asked to disclose personal data, nor that the data is being monitored.

The Patriot Act

If you are a SaaS supplier owned by a US parent company or you outsource any SaaS services to a US located data centre or a US based company, US law enforcers can access SaaS customer data pursuant to the Patriot Act.

The Patriot Act gives US law enforcement authorities the right to access personal data held by SaaS suppliers, regardless of where in the world the data is stored. The Act also gives US law enforcers the right to prevent SaaS suppliers from informing their customers that they have handed over personal data. The Act applies not just to SaaS suppliers owned by a US company but also to any SaaS suppliers using the services of a US subsidiary for data processing i.e. a US data centre.

HIPAA

If you are a SaaS supplier providing SaaS services to a US customer who is a health care provider you, and your sub-contractors, must comply with the security and privacy obligations of the Health Insurance Portability and Accountability Act 1996 (“HIPAA”).

HIPAA applies to any SaaS supplier who creates, receives, maintains, or transmits protected health information (“PHI”), regardless of whether or not the SaaS supplier actually views the data. HIPAA applies even if the SaaS supplier is not located in the USA. Any subcontractors a SaaS supplier uses i.e. a data centre will also need to comply with HIPAA.

SaaS Suppliers must include the privacy and security obligations set out in HIPAA in their SaaS agreements with US health care provider customers. SaaS suppliers are directly liable for breaches of the HIPAA security and privacy rules, which includes failing to cooperate with DHHS investigations of HIPAA breaches. Liability is strict i.e. a SaaS supplier will be liable regardless of intent. The penalties for breach are severe and a SaaS supplier can be fined up to 1.5 million US dollars for all breaches in any calendar year.

Summary

Under the provisions of the US Patriot Act and FISA the personal data of SaaS customers based in the EU must be shared with US law enforcers without the customer being informed, even though this conflicts with English and EU data protection law. Under HIPAA SaaS suppliers must comply with detailed privacy and security provisions of a US law applicable to the health care industry or face severe fines.

It is therefore important that SaaS suppliers ensure they are aware of the extent of any US laws they will be subject to when:

  • contracting with US SaaS customers; or
  • outsourcing SaaS services to companies linked to or based in the USA; or
  • if they have a parent company based in the USA.

SaaS suppliers should have procedures and measures in place to deal with any applicable US laws. These procedures need to be set out clearly in the terms of the SaaS agreement with the Customer, bearing in mind mandatory obligations to comply with US laws.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

Other related articles:

SaaS Agreements – Data Protection – HIPAA

On January 25th 2013, the US Department of Health and Human Services modified the rules of the Health Insurance Portability and Accountability Act 1996 (“HIPAA”). HIPAA applies to any SaaS suppliers who process protected health information (“PHI”) on behalf of customers to whom the Act applies, regardless of whether or not the SaaS supplier is located in the USA.

HIPAA

HIPAA is a US law that places security and privacy obligations on “covered entities” in the health care field e.g. SaaS customers who are health care providers. If you are a SaaS supplier who processes PHI on behalf of a covered entity you will also be subject to the provisions of HIPAA, if you are a “business associate”.

A SaaS supplier is a “business associate” under HIPAA if it “creates, receives, maintains, or transmits” PHI even if it does not view the PHI or only does so on a random or infrequent basis. Also, any subcontractor i.e. the data centre of the SaaS supplier will be a business associate for the same reason.

Business Associates

The importance of being a business associate is that it is now mandatory for SaaS Suppliers, who are business associates to include terms covering their privacy and security obligations under HIPAA in their SaaS agreements with customers. Also, SaaS suppliers are now directly liable for breaches of HIPAA’s security and privacy rules, which includes failing to cooperate with DHHS investigations of HIPAA breaches.

Liability is strict i.e. a SaaS supplier will be liable regardless of its intent. The penalties for breach are severe and can be up to 1.5 million dollars for all breaches in any calendar year.

How to Comply with HIPAA

SaaS suppliers cannot ensure that their SaaS customers comply with HIPAA as they have no control or sometimes do not even know what data users are uploading and what particular regulatory requirements apply to users and their data, especially where users are located outside of the UK or are subject to industry specific regulations.

Therefore if you are a SaaS supplier offering SaaS services to the US health care and insurance sector and your customers are subject to HIPAA you should:

  • Consider amending the design of your SaaS software to make it more appropriate for dealing with PHI and to support compliance with HIPAA obligations;
  • Try to physically prohibit PHI from being uploaded into and stored on your SaaS system;
  • Include clauses in your SaaS agreement which prohibit SaaS customers from uploading PHI;
  • Include a SaaS customer indemnity in your SaaS agreement to protect you against any claims for breaches of HIPAA;

By drafting standard business associate clauses for inclusion in your SaaS agreement with customers and your agreements with relevant subcontractors you may be able to limit your liability for breaches of HIPAA and avoid your customers trying to impose their own more onerous clauses upon you.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

 

SaaS Agreements – FAQs – Applicable Law and Jurisdiction

It is important to understand the difference between applicable law and jurisdiction when negotiating a SaaS agreement. Applicable law specifies which country’s laws will apply to your SaaS agreement. Jurisdiction specifies which courts will have authority to deal with a dispute. Usually a UK SaaS agreement will specify the laws of England and Wales as the applicable law and the courts of England will have jurisdiction.

English or Scottish Law

Many SaaS suppliers are not aware that two legal systems exist in the UK. English law and Scottish law and each has its own courts. English law and Scottish are not the same and it is important to specify which law applies and which courts should have jurisdiction as there is no such thing as “UK law” or “UK courts”.

Other Laws

If you are a SaaS supplier used to dealing with customers located outside of the UK, you will be familiar with SaaS customers insisting on their local law applying to your SaaS agreement. Many SaaS suppliers agree to this by simply removing “English law” from the SaaS agreement and replacing it with, for example, “laws of Delaware” unaware of the consequences this will have upon their SaaS terms and conditions.

Consequences of Changing the Applicable Law

By changing the law applicable to your SaaS agreement you may automatically invalidate many of the limitations on liability contained in your SaaS agreement. You may also become liable for types of damages that you thought were excluded in your SaaS agreement, i.e. direct damages, indirect damages, typically foreseeable damages, or punitive damages, as in some countries liability cannot be limited for these types of damages, or the local understanding of what types of losses fall within these areas may differ from English law.

This could also result in you becoming subject to local laws applicable to consumer contracts, even though you are contracting with a business. For example, in France if you enter into a SaaS agreement with a business not operating in your business sector, your SaaS customer will be a consumer and will be protected by local consumer protection laws. i.e. with rights to refunds.

By agreeing to a change of law in your SaaS agreement you may also unknowingly grant customers new rights that do not exist under English law. For example, if you agree to a change to German law under mandatory German law a customer can lower the price it pays for the SaaS services if the service is defective.

Jurisdiction

If you agree to change the applicable law when negotiating your SaaS agreement you should also consider changing the country in which the courts are located that will deal with any disputes i.e. French law and the courts of Paris.

Language

You should also specify in the SaaS agreement in which language disputes should be dealt with. If you do not speak or understand the local language of your customer you should state that all disputes must be dealt with in English. This is particularly important if the SaaS agreement has been translated into your customer’s local language. In this case you should state that the English version of the SaaS agreement will prevail if there is a discrepancy between the two versions.

Legal Costs

Also do not forget that the local rules on the amount of costs that a court can order the losing party to pay the winning party can vary substantially. In some jurisdictions and in some areas of law, no costs are recoverable at all by a winning party.

General

For the above reasons when considering SaaS customer requests to change the applicable law or jurisdiction in your SaaS agreement it is essential that you understand the difference between applicable law and jurisdiction and the implications of changing these.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Dealing with Late Payment or Non-payment of Invoices

In the current economic climate, SaaS customers often delay payment of invoices. In order to protect your SaaS business and improve your cash flow, you should consider including the following in the terms of your SaaS agreement.

Right to Claim Interest

There is no requirement to have an interest clause in your SaaS agreement, as you have a statutory right to claim interest on late payments from a business customer (BTB) under the Late Payment of Commercial Debts (Interest) Act 1998 (“Act”). The statutory interest rate to be applied is the applicable Bank of England Base Rate + 8%.

Alternatively you can specify a specific interest rate in your SaaS agreement. This can be a number i.e. 7%, or a reference to an index i.e. the European Central Bank base rate, or a combination of both i.e. the Bank of England base rate + 2%. The interest rate specified can be higher or lower than the statutory rate. Note that if you specify an interest rate in your SaaS agreement, the  statutory rate will not apply, even if the interest rate you specify is lower than the statutory rate.

SaaS suppliers should therefore consider the following when deciding whether or not to include an interest clause and specific interest rate in the terms of their SaaS agreement.

  • By specifying an interest rate in your SaaS agreement you are inviting a business customer to negotiate a lower rate. If you have a weaker bargaining position, you may have to agree to a rate much lower than 8.5%;
  • Time and money could be wasted on protracted negotiations on which index to use and the % rate applicable;
  • Many SaaS customers are not aware that you have a mandatory right to claim interest on late payment and that the statutory rate will apply.

Right to Claim Compensation

In addition to claiming statutory interest from a SaaS customer, under the Act you are also entitled to a fixed amount of compensation. The amount is based upon the amount of the outstanding invoice:

  • £40 – for debts less than £1,000;
  • £70 – for debts between £1,000 to £9,999; and
  • £100 – for debts over £10,000.

Recovery of Costs

Since the 16th of March 2013 SaaS suppliers have the additional right to claim the difference between the  fixed compensation amount and their reasonable costs in recovering the debt e.g. appointing a debt recovery company or lawyer. However this right only applies to debts accrued after the 16th of March 2013.

Right to Terminate or Suspend SaaS Services

If a SaaS customer fails to pay you on time this will be in breach of contract – but not a fundamental breach (which permits you to terminate the SaaS agreement and claim damages). SaaS supplier’s should therefore state in their SaaS terms and conditions that “time is of the essence” for all payments. If the SaaS customer then fails to pay  on time you can terminate the SaaS agreement immediately without notice and claim compensation. However many SaaS customers will not agree to time being of essence.

Alternatively you could include the following specific rights in the SaaS agreement to achieve the same  result:

  • the right of the SaaS supplier to terminate the SaaS agreement for late or non-payment; and/or
  • the right of the SaaS supplier to suspend delivery of the SaaS Services until payment is received.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Source Code

When negotiating a SaaS agreement you will come across the terms source code, object code and open source. What is the difference if any between source code, object code and open source?

Source Code

Source code is the version of a computer programme (SaaS software) that exists prior to the software being ready to compile and run on a computer. The source code consists of a number of statements created in a text form by a programmer. These statements are saved in a named file and are called the source code.

The source code is human-readable but cannot be executed directly by a computer. The source code needs to be translated so that a computer can interpret it. This is done by compiling the source code into a format that a computer can interpret – the object code.

Do note there are some exceptions to the above. For example, modern source code can often be the same as the object code where no compilation is required. An example of such code is HTML, which is used to build most websites.

Object Code

Object code is the version of a computer programme that is created when the source code has been translated and compiled by a special programme. The object code file contains a sequence of instructions that can be executed directly by a computer. The object code is difficult for a human to read or modify.

Open Source Code

Open source code (OSS) refers to the version of a computer programme (SaaS software) in which the source code is made available and licenced to the general public. The open source licence gives users the right to study, modify and distribute the source code free of charge. Open source code is often created as a collaborative effort in which programmers improve the source code and share changes within a community.

Importance of Source Code

When source code is translated into object code, a lot of information is lost. As a result of this it is not possible to fully reconstruct the original SaaS software source code from the object code. Accordingly, it is sometimes advisable to have the source code held by a third party in escrow to ensure that you have access to the SaaS source code in the event of the insolvency of, or access and maintenance issues with your SaaS supplier. If you do not have access to the source code you will be unable to continue to use the SaaS software.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Website Legal Requirements – for SaaS Suppliers

Below, I have set out the main legal requirements (including some optional recommendations) that you should comply with when operating your website in the UK. Even if you do not sell SaaS products or services online via your website, you will still need to comply with the following English laws when operating a website in the UK.

Mandatory Requirements

About Us/Contact Information

You must provide the following information in an easily accessible position on your website:

  • your legal name i.e. XYZ Ltd
  • your geographical address
  • contact details i.e. telephone number, fax number and email address
  • which country your business is registered in and the registration number
  • details of any supervisory body which regulates your business i.e. the FSA. For regulated bodies more detailed information is required.
  • where you are registered for VAT and your VAT number
  • clear details of prices and whether or not delivery and/or tax is included

Registration under the Data Protection Act

If you collect any personal data on your website – i.e. email address, name or address of a living individual, you will be processing personal data and must register as a data controller under the Data Protection Act (DPA). As a SaaS supplier the DPA will apply as soon as you require users to register in order to access your SaaS website or receive a newsletter or marketing information from you.

Privacy Policy

If you are collecting personal data it is a criminal offence not to register as a data controller under the Data Protection Act (DPA).

If you are collecting, storing or processing personal data you need to inform SaaS customers or website users how, what and why you are using their personal data in order to comply with the DPA. Even if you do not collect personal data on your website as a SaaS supplier you will be collecting and processing personal data on behalf of your SaaS customers.

Also, if you are sending marketing emails to potential SaaS customers you need to ensure that you have obtained specific consent, BEFORE such emails are sent. Consent should be covered in your privacy policy and the registration process on your website.

Cookie Policy

Cookies are small text files placed on a user’s computer which record online activity. Virtually all websites use cookies. Most use analytics cookies to measure visits and use of websites. Performance and functionality cookies are used to make repeated use of a website more comfortable for the user and advertising cookies are increasingly used to collect information about users for targeted marketing purposes.

You must provide users with clear and comprehensive information about the type of cookies being used on your website and the purposes for which the information is collected (subject to some exceptions). Users must give consent to the use of cookies. Consent can be obtained, by specifically making users aware of their acceptance of the terms of your cookie policy (or the relevant section of your privacy policy) by virtue of continuing to use your website.

Disabled Access to your Web Site

If you offer SaaS goods or services on your website you need to make your website accessible to disabled users. Level 1 compliance with the WC3 standard will usually suffice.

Trademarks and Logos

Do not use other people’s trademarks or logos without their consent on your website or you could be liable to pay damages for trademark infringements.

Copyright

Do not use other people’s content without their consent on your website, or you could be liable to pay damages for copyright infringements. If you have links to other people’s content, make sure that this is permitted in their terms of use and ensure that the information opens in a new frame.

Online Payment

If you accept online payment for your SaaS goods or services you must provide SaaS customers with specific information about their right to cancel, VAT and prices, refunds and defective goods PRIOR to the sale being concluded.

Recommended Requirements

In addition to the above mandatory rules it is advisable to include the following information on your website.

Terms of Use/Disclaimer

You should set out the rules applicable to visitors using and accessing SaaS goods and services on your website. For example, state who may access the website i.e. consumers, businesses, over 18s. You should also aim to limit your liability for information on your website. For example, state which law applies and your limits on liability. However, please note that you cannot exclude or limit certain liabilities in particular circumstances  – particularly in relation to consumers, injuries caused by goods and services, or defects in your goods and SaaS services.

Copyright Notice

Protect the information on your SaaS website by inserting a copyright notice “© company name 2013.  All rights reserved.” Without this notice, it may be difficult in some countries to take legal action against any copyright infringement.

Summary

The above are examples of the main legal requirements for UK websites. This is a very complicated area of law and the specific rules that apply to you will depend on what goods and SaaS services you are offering, whether you are acting BTB (business to business) or BTC (business to customer), where you are based, where your customers are located and many other factors.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Safe Harbor Still Adequate

Recently, the Department of Commerce’s International Trade Administration (ITA) – a US government body – published a document confirming that any SaaS suppliers based in the US (and/or SaaS suppliers using a data centre located in the US) who are “safe harbor” registered must be recognised as having an “adequate” level of data protection. The ITA rejected the view that EU data protection authorities can unilaterally refuse to recognise safe harbor certification as a valid means of demonstrating that a SaaS supplier based in the US (and/or SaaS suppliers using a data centre located in the US) has an adequate level of data protection.

Background

Under current EU data protection laws, SaaS suppliers cannot send personal data outside of the EEA (the 28 EU member states plus Norway, Iceland and Liechtenstein) unless adequate protections have been put in place or where the destination country is pre-approved as having adequate data protection. Only the following countries are pre-approved and recognised as having adequate protection: Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and Japan.

EU Position

Last year the Article 29 Working Party, a EU privacy body, claimed that SaaS customers based in the EU needed to see actual evidence that US SaaS suppliers (and/or SaaS suppliers using data centres in the US) complied with safe harbor standards. They claimed it was not enough for SaaS customers to simply rely on the fact that a SaaS supplier was registered under the safe harbor scheme.

ITA Position

The ITA disagrees with the above position. The ITA points out that the same rules apply to all SaaS suppliers under EU data protection laws regardless of whether or not they are located within the EEA, an ‘adequate’ country or are safe harbor registered. As the safe harbor framework is binding on all countries within the EEA additional requirements cannot be imposed exclusively on US SaaS suppliers (and/or SaaS supplier using data centres in the US).

Additionally, safe harbor SaaS suppliers (and/or SaaS suppliers using data centres in the US) are not obliged to use the EU model clauses in order to be recognised as adequate, as these are simply for use as an alternative approach to safe harbor. Moreover, they were specifically designed to address the adequacy requirement where safe harbor is not an option.

Additional Requirements

The ITA accepted that US SaaS suppliers (and/or SaaS suppliers using data centres in the US) must enter into a basic processing agreement with SaaS customers (which could form part of the SaaS agreement) but only to ensure that the SaaS supplier has sufficient instructions regarding use of the personal data. This requirement applies to all SaaS suppliers.

Additional requirements could only be imposed if these were required under other applicable laws. For example, under the Markets in Financial Instruments Directive (MiFID) if a US SaaS supplier (and/or SaaS supplier using data centres in the US) enters into a SaaS agreement with a SaaS customer who is providing financial services the terms of the SaaS agreement must guarantee the SaaS customer physical access to the US premises at which data is being processed.

Summary

SaaS suppliers who have SaaS customers querying their “adequacy” and compliance with EU data protection laws can use the ITA document to confirm that safe harbor registration does provide “adequate” protection. Along with the terms of the SaaS agreement, which will include specific data processing obligations, SaaS customers should be satisfied that processing in the US under safe harbor is adequate.

In addition, the European Commission has indicated that safe harbor will continue to be deemed “adequate” in the final version of the new proposed EU Data Protection Regulation.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – What is a SLA?

SLA is the common abbreviation used for a service level agreement. When providing SaaS services to customers you need to include a SLA in your SaaS agreement, either as part of the main terms of your SaaS agreement or in a specific SLA schedule. A SLA should set out the following support and maintenance services that you will provide to customers to ensure that the SaaS software is made properly available to them.

Availability

The level of availability of the SaaS software should be stated in percentage terms. The basis on which availability is calculated should be included i.e. monthly, annually and any exclusions from the calculation should be clearly stated.

Software Support and Maintenance

Customer support is usually provided to assist customers when problems arise with the availability or functioning of the SaaS software. Customer support provisions should include:

  • A description of the support services to be provided;
  • The times and days on which support will be provided;
  • How support will be provided i.e. online, via telephone;
  • Response and resolution times for dealing with SaaS software problems; and
  • Maintenance times for carrying out updates, repair and maintenance to your SaaS software.

Hardware Maintenance

SaaS providers use servers (hardware) usually located in a third party data centre to host their SaaS software. The provisions to be included in a SLA will be determined by the level of service that the third party data centre provides to the SaaS supplier. The data centre provisions should be reflected in the terms of your SLA but will generally include:

  • A brief description of the security provisions in place at the data centre;
  • A brief description of the technical infrastructure at the data centre;
  • Any applicable disaster recovery provisions;
  • Backups of data.

Commercial Considerations

The way in which you incorporate a SLA into your SaaS agreement and the degree of detail that you provide to SaaS customers will largely depend upon the following:

  • The type of SaaS products and services you are supplying;
  • How much the customer pays for the SaaS product and services;
  • Whether the SaaS product is business critical i.e. online banking;
  • What is standard in that particular business area; and
  • The terms of the hosting agreement with your data centre.

Summary

Due to the unique nature of a SLA you will need to seek specialist legal advice on the content of a SLA whether you are a supplier or a customer to ensure that your rights are adequately protected.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – FISA Customer Concerns

SaaS suppliers who use US public cloud providers to store, process or host their SaaS customer’s data as part of their SaaS services may now experience customers raising concerns about the risk of disclosure to, and monitoring of, their data by the US government under the Foreign Intelligence Security Act (FISA).

FISA

FISA (a US law) gives the US government the right to access and monitor the personal data of non-US citizens (who are located outside of the USA) held by US public cloud providers (i.e. Amazon or Google), without a warrant for a period of up to one year, for the purposes of acquiring foreign intelligence information. Public cloud providers must secretly provide all assistance, facilities and information requested by the government. They are not permitted to inform SaaS suppliers that they have disclosed or been asked to disclose personal data or that it is being monitored.

Breach of European Data Protection Laws

Data protection laws in the 27 countries of the EU all prohibit the disclosure of personal data without a data subject’s consent or knowledge. The provisions of the FISA conflict directly with English and EU data protection laws.

The recent amendment to this US law adds to the concerns raised by the Article 29 Working Party last year in their opinion on cloud computing and data protection. In this opinion, which amongst other things the working party said that EU businesses using cloud services i.e. SaaS customers must ensure that non-EU providers i.e. SaaS suppliers comply with EU data protection laws and that simply relying on a US company’s safe harbor registration was not enough.

FISI is not the only Problem

SaaS customers often falsely believe that their data is “unsafe” due to the fact that SaaS supplier’s use third party data centres to store and process their data. However the risks of personal data being disclosed apply regardless of whether or not data is stored or processed in a SaaS model. Most countries including the UK, France, Spain and Belgium have data disclosure laws that all, not just SaaS suppliers, must comply with. For example in the UK the Regulation of Investigatory Powers Act 2000 (RIPA) requires companies to disclose the content of communications to police forces.

Also data stored or processed anywhere outside of the EEA, in a country which does not have equivalent protection, will be subject to all local disclosure laws i.e. in China and India, and such local laws may be much wider than FISA.

In addition, in the USA notwithstanding FISA, the US authorities can access customer data when it is hosted outside of the USA and there is no company presence in the USA under Mutual Assistance Legal Treaties (MLAT).

Assessing the Actual Risks

SaaS customer concerns about FISA are valid but these must be considered in light of:

  • The type of data SaaS customer’s are providing;
  • The likelihood of the customer data ever being monitored or requested; and
  • The fact that customer data is already subject to similar disclosure obligations to the UK government and foreign governments under other existing laws.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

 

SaaS Agreements – Terms and Conditions – The Bribery Act 2010

If your are a SaaS supplier or SaaS customer you should be aware of the provisions of the Bribery Act when negotiating the terms of a SaaS agreement. The Bribery Act 2010 (“Act”) has been in force since July 2011. It aims to distinguish between hospitality (which is permitted) and bribes which are illegal. A breach of the Act can result in an unlimited fine and a maximum prison sentence of 10 years.

Relevance to SaaS Customers

The Act applies directly to SaaS customers. SaaS customers will be liable under the Act for any breaches of the Act caused by their agents or subcontractors i.e. their SaaS suppliers.

In order to protect themselves against such breaches, SaaS customers are increasingly requiring SaaS providers to include anti-bribery provisions in the terms of their SaaS agreements. Such provisions are generally acceptable if they simply state that the SaaS supplier complies with the 6 principles of the Act and has adequate measures in place to ensure compliance.

Relevance to SaaS Suppliers

SaaS suppliers operating mainly in the UK with UK based customers will generally not be affected by the Act, provided that the levels of hospitality that they offer to SaaS customers are proportionate to the SaaS provider’s business, i.e. the reasonable cost of meals out, tickets and travel expenses to events. No definition of excessive hospitality is given in the Act or the guidance to it. It is therefore advisable to keep records of all hospitality entertainment and its purpose so that evidence can be provided at a later date if necessary.

Note that if you are a SaaS supplier operating outside of the UK or you have SaaS customers based in developing countries you should be particularly careful about complying with the Act, as “hospitality” which is usual or acceptable in a developing country such as paying third parties in order to win a contract, could be considered a bribe under the Act.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: