Tag: SaaS agreement

SaaS Agreements – GDPR – EU-US Privacy Shield Invalid

The EU-US Privacy Shield was declared invalid on the 16th of July 2020 by the European Court of Justice (“CJEU”). The steps SaaS suppliers now need to take depend on their international data flows and the transfer mechanisms they use, which need to be set out in the SaaS agreement. Where SaaS suppliers currently rely solely upon the EU-US Privacy Shield for transfers of personal data to the USA, they must now replace the Privacy Shield with the EU Commission’s Standard Contractual Clauses (“SCCs”).

EU-US Privacy Shield Invalid

The EU-US Privacy Shield was declared invalid due to concerns about US laws. Mainly that:

  • US law does not sufficiently prevent US intelligence services from accessing and using EU located person’s personal data;
  • no adequate remedies exist for EU located persons to dispute/query/prevent the processing of their personal data by US public authorities.

Can SCCs be used instead?

SCCs are still a valid international data transfer mechanism, but data controllers (SaaS customers) must assess the privacy laws applicable in countries where they use SCCs, if they wish to use, or continue to rely upon, them.

The CJEU stated in their decision that data controllers (SaaS customers) must carry out an assessment of the data protection afforded by each “country” (not the company itself) that personal data is transferred to. This means that the privacy laws of each country to which personal data is transferred by SaaS supplier or SaaS customers must be reviewed, in particular to see if there is access to personal data by public authorities is permitted, i.e. for surveillance purposes. If access to personal data is permitted by local privacy laws in any country then the SCCs may be invalid in individual cases. For example: In the US the Foreign Intelligence Surveillance Act (FISA) and/or Executive Order 12333 permits US security authorities to access personal data without a court order in some circumstances.

NB/ The same limitations upon relying upon Binding Corporate Rules (BCRs) in third countries also now apply.

NB/ The Swiss-US Privacy Shield is not invalidated by this decision but is no longer “adequate” for the purposes of the GDPR.

Current Guidance from Data Protection Supervisory Authorities

The Irish Data Protection Commission (DPC) has advised:

“In practice, the application of the SCCs transfer mechanism to transfers of personal data to the United States is now questionable. This is an issue that will require further and careful examination, not least because assessments will need to be made on a case by case basis”.

EU supervisory authorities are currently advising that they will be publishing updated guidance in the future:

See: ICO statement of 27th July 2020

See: EDPB FAQs on Ruling of 23rd of July 2020

However, currently there is no definitive advice from local data protection supervisory authorities on how to resolve the issues raised by the CJEU ruling and the use of SCCs and the position remains uncertain until such advice is provided.

Brexit complications

On the 1st of January 2021 the UK will no longer be part of the EU or EEA and becomes a “third country” for data processing purposes. The UK will be subject to restrictions on the flow of personal data from the EU to the UK, unless the UK is awarded an “adequacy” decision by the European Commission before the 1st of January 2021. This is unlikely. If adequacy is not granted, transfers from the EU to the UK will require a lawful transfer mechanism (such as SCCs). However, the above issues with SCCs will then apply to such transfers from the EU/EEA to the UK.

Are you affected by the Ruling?

Any SaaS supplier or SaaS customer who makes any international data transfers that fall within the list below will be affected by the CJEU ruling.

  • transfer of personal data based solely on the EU-US Privacy Shield;
  • use of any suppliers based in the US who process EU personal data;
  • use of data centres located in the US to host EU personal data;
  • use of telecommunications and/or cloud-based services based in the US;
  • use of any suppliers in other non-EEA countries who rely upon SCCs to transfer personal data.

Actions to take now

All SaaS customers (and SaaS suppliers by default) should carry out an international data transfer risk assessment to:

  • identify which US suppliers rely on EU-US Privacy Shield in their SaaS contracts;
  • identify which US suppliers may be subject to US surveillance laws (section 702 FISA and Executive Order 12333);
  • identify all transfers of personal data to entitles located in non-EEA “third countries” and the transfer mechanisms used for the data transfer specified in the SaaS contract;
  • identify where local privacy laws in any “third country” that EU personal data is transferred to conflict with the GDPR, in particular where public authorities are able to access personal data of EU located persons;
  • prepare to implement updated SCCs into existing SaaS agreements and data processing agreements. (The European Commission has indicated it will provide new versions soon);
  • regularly check UK Government & data protection supervisory authority statements on the EU-US Privacy Shield, Brexit and international data transfers for updates and guidance.

Summary

Until full guidance is provided by the various EU Data Protection Supervisory Authorities, the ICO in the UK, the European Commission and the European Data Protection Board (EDPB) it is unclear whether or not SCCs are an acceptable replacement to the EU-US Privacy Shield in the US and other “third countries”.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Brexit – Need for an EU Representative

A “no deal Brexit” or “Brexit” with a withdrawl agreement is now likely to happen in the next month or so, following the EU granting an extension until the 31st of January 2020 for the UK government to obtain parliament’s approval to the final terms of the withdrawl agreement and the general election in the UK on the 12th of December. SaaS suppliers and SaaS customers need to take steps now to ensure that they comply with the requirement to appoint an EU Representative under the GDPR, where they will no longer have any establishment in the EU, after Brexit.

When must an EU Representative be appointed.

A SaaS supplier or SaaS customer must appoint an EU representative unless:

  • the processing is occasional and does not include, on a large scale, processing of special categories of data or processing of personal data relating to criminal convictions and offences and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or
    a public authority or body: or
  • they are a public authority or body.

The EU representative is appointed by the SaaS supplier or SaaS customer to deal with supervisory authorities and data subjects on all issues related to the processing of personal data, for the purposes of ensuring compliance with the GDPR.

Do you have an EU Establishment

The GDPR does not define establishment.

However, Recital 22 of the GDPR says:

“Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.”

Therefore if a UK SaaS supplier or customer has a subsidiary incorporated in a Member State of the EU, this subsidiary will be fully subject to the GDPR, if it offers goods or services to individuals located in the EU. In this case the UK SaaS supplier or customer would not need to designate an EU representative, as it would have an establishment in the EU.

Where a SaaS supplier or customer does not have a subsidiary established in a Member State of the EU they will need to appoint an EU representative.

Who can be an EU Representative

An individual or a company. The individual or company does not have to work for or in the case of a company be owned by a linked to the SaaS supplier or SaaS customer.

Does the EU Representative have to be located in the EU

The EU representative must reside or be established in a Member State of the EU in which relevant data subjects whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, reside.

Appointing an EU Representative

The appointment must be in writing.

EEA based individuals whose personal data is being processing should be provided with the details of the EU representative.

Details of the EU representative must also be made easily accessible to supervisory authorities.

Other Brexit Considerations

SaaS suppliers and SaaS customers should be aware that following Brexit, the UK version of the GDPR will require a SaaS customer or SaaS supplier located outside of the UK, i.e. in the EU, to appoint a UK representative.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience dealing with SaaS, cloud computing matters and IT law issues. If you require assistance with any SaaS agreements, cloud computing matters or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Data Processor

It is important for a SaaS supplier to understand the legal obligations imposed upon them as a data processor when negotiating a SaaS agreement and a data processing agreement (“DPA“) as the duties of a data processor are not the same as the duties of a data controller. In a SaaS relationship the supplier is always the data processor of the SaaS customer. The SaaS customer is always the data controller of the SaaS supplier.

Who is a Data Processor

Articel 4(8) of the GDPR defines a data processor as:

“a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller”

A data processor acts on behalf of, and only on the instructions of a data controller. Whereas a data controller, determines the purposes and means of the processing of personal data.

Where a SaaS supplier does not have any purpose of its own for processing the personal data and they only act on a SaaS customer’s instructions, they are a data processor – even if the SaaS supplier make some technical decisions about how to process the personal data.

Need for a Data Processing Agreement

Since the GDPR and the UK Data Protection Act 2018 came into force on the 25th of May 2018 the obligations of data processors have become much more onerous. It is now mandatory for the data processor and the data controller to enter into a written agreement – DPA, setting out each party’s obligations. The DPA must include specific minimum terms.

Liability for Personal Data

A SaaS customer will be liable to its clients/end users (whose personal data it is collecting and processing) for any breaches of the GDPR. As the SaaS supplier will be carrying out the processing on behalf of the SaaS customer, the terms of the SaaS agreement and not just the DPA should include adequate clauses to protect the SaaS supplier and the SaaS customer against data protection breaches, bearing in mind the differing responsibilities of the data controller and the data processor.

Subject Access Request

Data subjects (clients of the SaaS customer) have the right to make a subject access request to the data controller.

Information must be provided within strict time limits and at no cost to the data subject. The request is made to the data controller (the SaaS customer) and the SaaS customer is obliged under the GDPR to respond. However, it is often the SaaS supplier who actually needs to provide the information stored on its servers either to the SaaS customer or their clients, on the SaaS customer’s behalf.

General

When considering SaaS customer requests to change clauses relating to liability, indemnities, data and data protection in a DPA or a SaaS agreement it is essential that a SaaS supplier understands the statutory obligations of the data controller and data processor and the implications of changing any terms of the DPA or SaaS agreement.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Personal Data

It is essential for SaaS providers and SaaS customers to understand what consitutes personal data to ensure that they comply with their respective legal obligations when acting as data controllers and/or data processors.

What is Personal Data?

Articles 4(1) of the General Data Protection Regulation (“GDPR“) defines personal data as:

“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

It is important to note that the GDPR only applies to personal data.

Examples of Personal Data

If an individual is directly identifiable from the information, the data is personal data. For example:

  • Name; or
  • Email address.

If, by looking solely at the data you can distinguish an individual from other individuals, that individual will be identified (or identifiable). Remember you don’t have to know someone’s name for them to be directly identifiable, a combination of other identifiers may be sufficient to identify the individual. For example the following identifiers:

  • Location data;
  • Online identifiers – such as an IP address or cookie identifier;
  • Identification data.

Categories of Personal Data

Some personal data is more sensitive in nature. The GDPR refers to this type of personal data as “special categories of personal data”.

Special categories of personal data include personal data about an individual’s:

  • race;
  • ethnic origin;
  • political opinions;
  • religious or philosophical beliefs;
  • trade union membership;
  • genetic data;
  • biometric data (where this is used for identification purposes);
  • health data;
  • sex life; or
  • sexual orientation.

Is Pseudonymised data personal data?

Pseudonymisation is a technique used to change personal data so that it can no longer be attributed to a specific data subject without the use of additional information. Provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person then the data is pseudonymised.

Is anonymous data personal data?

If personal data is truly anonymised i.e. the data cannot be combined with any other data to identify an individual, then the anonymised data is not personal data.

Is information about companies personal data?

Information about companies or public authorities is not personal data as a company or public authority is not a natural person. However, information about individuals acting as sole traders, employees, partners and company directors where they are individually identifiable and the information relates to them as an individual may be personal data.

Is data about a deceased individual personal data?

Information about a deceased person is not personal data.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – GDPR – Personal Data Breaches and How to Avoid them

Recently there have been a number of high profile cases involving the UK’s data protection authority (the “ICO”), imposing very large fines on Marriott and British Airways for serious data breaches. SaaS customers and SaaS suppliers should be reviewing the appropriateness of their technical and organisational measures to avoid the risk of being fined up to 4% of global turnover for serious personal data breaches.

Complaints

According to the ICO’s annual general report 2018 – 2019 published in July 2019, complaints from members of the public to the ICO have doubled in the last 12 months. The largest proportion of complaints relates to subject access requests, but this is followed by data breaches.

What is a Personal Data Breach

The GDPR defines a personal data breach as: “the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed”.

Personal data means any information concerning or relating to an identified or identifiable individual. SaaS suppliers and SaaS customers should be aware that a personal data breach can cover a lot more than just ‘losing’ personal data. It also includes any breach of security that leads to accidental or unlawful destruction, alteration or disclosure of personal data. For example, resulting from accidents (such as sending an email to the wrong recipient) as well as deliberate acts (such as phishing).

SasS customers and suppliers should be aware that a personal data breach is a security incident that negatively impacts the confidentiality, integrity, or availability of personal data. Accordingly, all personal data breaches are security incidents, but not all security incidents are necessarily personal data breaches.

Recent Personal Data Breaches

British Airways

On the 8th July 2019, the ICO announced its intention to fine British Airways £183m for personal data breaches relating to user traffic to the British Airways website being diverted to a fraudulent site where customer details could be harvested by attackers. The personal data breach involved around 500,000 customer’s data and included log in, payment card, and travel booking data, as well name and address data.

Marriott

On the 9th July, the ICO announced its intention to fine Marriott International £99m for personal data breaches which began in 2014 and was only discovered in 2018. The personal data breach involved the personal data of around 339 million guest records worldwide (30 million related to EU residents, of which 7 million related to UK residents).

ICO Actions:

One Stop Shop

Under the ‘one stop shop’ provisions of the GDPR, Marriott and British Airways are being investigated by the ICO – who is the lead supervisory authority. The lead supervisory authority investigates the breach on behalf of all data protection supervisory authorities in the EU whose residents have been affected by the breach. Each national data protection supervisory authority in the EU will have the chance to comment on the ICO’s findings.

Fines

In the above 2 cases no fines have yet been imposed by the ICO. The ICO has at this stage, notified both British Airways and Marriott of its intention to fine them. Each company now has an opportunity to make representations to the ICO in relation to the proposed findings and sanctions.

In determining the proposed level of the fine the ICO commented that both companies had co-operated with the ICO investigation and had made improvements to their security arrangements since these events came to light.

The ICO will now need to consider the representations of Marriott and British Airways and the other concerned national EU supervisory authorities before it make a final decision on the level of each fine and any other sanctions.

Preventing a Data Breach

In light of the above, SaaS suppliers and SaaS should ensure that they have in place appropriate technical and organisational measures to keep personal data safe. The measures taken should be appropriate to the risk the processing represents.

The following security measures should always be taken:

  • Having firewalls, anti-virus applications and malware protection to protect hardware, devices and networks in place;
  • Using up to date software and operating systems;
  • Installing patches and updates without delay.

The following internal organisational measures should as a minimum be implemented:

  • Having a security policy;
  • Having a data protection policy;
  • Having a business continuity plan/disaster recovery plan.
  • Training staff on data protection issues;
  • Carrying out regular risk assessments of staff, systems and suppliers.

Summary

Since the GDPR came into force on the 25th of May 2018 the potential fines that the ICO can impose on a SaaS supplier and/or SaaS customer for a personal data breach can be very large, as shown by the recent fines proposed for Barclays and Marriott. Whether you are a SaaS supplier or SaaS customer you should ensure that you are taking appropriate actions to minimise the risks of a personal data breach as this could in the long run have a serious knock on effect on the level of any subsequent fine proposed by the ICO.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Brexit – Preparing for a No Deal Brexit

SaaS Agreements – Brexit – EU data Transfers to the UK after Brexit

SaaS Agreements – Brexit – Amendments to SaaS Terms and Conditions

SaaS Agreements – Data Protection – SaaS, Brexit and the GDPR

SaaS Agreements – GDPR – The General Data Protection Regulation

SaaS Agreements – FAQs – Personal Data

SaaS Agreements – FAQs – Data Processor

SaaS Agreements – GDPR – Local Derogations

The General Data Protection Regulation (“GDPR”) now applies to all SaaS customers and SaaS suppliers collecting or processing the personal data of individuals located within the EU.  SaaS suppliers and SaaS customers must comply with the terms the GDPR. SaaS suppliers and SaaS customers should be aware that the GDPR does not however fully harmonise data protection law throughout the EU, as each EU country may introduce their own requirements in certain instances (“derogations”) under their own local data protection laws. SaaS suppliers and SaaS customers who operate in, or collect or process personal data from persons located in different EU countries therefore need to be aware of the different data protection laws effective in each EU country, from which they collect or process data of individuals located there.

Derogations

Most EU countries have now passed their own local data protection law setting out derogations. For example, in the UK the provisions of the Data Protection Act 2018 (“DPA”) apply in addition to the GDPR and include many derogations from the GDPR. SaaS suppliers and SaaS customers must keep up to date on changes that are made to local national data protection laws in each EU country, a summary of the current position is set out below.

Current Local Data Protection Laws

The following EU countries have their own additional data protection law, or have amended their existing local data protection laws setting out the derogations from the GDPR:

  • UK, Ireland
  • Austria, Belgium, Bulgaria
  • Croatia, Cyprus, Denmark
  • Estonia, Hungary, Italy
  • France, Finland, Germany
  • Latvia, Lithuania, Luxembourg
  • Malta, Netherlands, Poland
  • Portugal, Romania, Slovakia
  • Slovenia, Spain, Sweden

Greece is the only EU country which has confirmed that it will not derogate from the GDPR.

Draft Local Data Protection Laws

The Czech Republic only has a proposed local data protection law setting out the exact derogations from the GDPR applicable in the Czech Republic.

Summary

Where SaaS suppliers or SaaS customers are collecting or processing the personal data of individuals within the EU, they will need to regularly check the rules for each EU country in which they are collecting or processing personal data. Technical and legal measures will need to be implemented and updated to ensure that the local derogations from the GDPR are complied with in each applicable EU country. This will apply not only to EU SaaS suppliers and SaaS customers, but any entity located outside of the EU who collects or processes personal data of persons located within the EU.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – GDPR – Data Processing Agreement

Since the General Data Protection Regulation (GDPR) came into force on the 25th of May 2018, SaaS suppliers and SaaS customers are legally obliged to include a written data processing agreement (DPA) in the terms of their SaaS agreements. The DPA usually forms a schedule to the SaaS agreement and must include the specific and detailed mandatory obligations set out in the GDPR. SaaS suppliers should use their own DPA and resist any attempt by a SaaS customer to have them sign up to the SaaS customer’s DPA for the following reasons.

Mandatory Terms

Although the GDPR clearly sets out that the DPA should include all data processor and data controller obligations. However, many DPAs provided by SaaS customers do not include:

  • All mandatory obligations required under the GDPR; and
  • Any data controller (SaaS customer) obligations at all.

Additional Obligations

Many SaaS customer DPAs seek to impose additional or far more onerous obligations on the part of SaaS suppliers in the terms of their own DPA than are required under the GDPR. For example, a SaaS supplier, (the data processor) has to report a data breach without undue delay but often SaaS customers, (the data controller) try to impose an obligation to report immediately or within 24 hours.

Liabilities and Indemnities

SaaS customers often add unlimited liabilities and indemnities to the DPA that only apply to the SaaS supplier, retaining their own limited liability for any breaches. Any limitations on liability included in the SaaS agreement should also apply to breaches of the DPA, particularly in light of the high fines (20 million Euros or 4% of annual worldwide turnover) that can be imposed for a breach of the GDPR.

Security Policy

It is mandatory to set out the technical and administrative security provisions that the SaaS supplier has in place to protect personal data. As the SaaS customer cannot know what security provisions the SaaS supplier and its sub-contractors i.e. the data centre have in place, it is entirely unrealistic for the SaaS customer to dictate what these should be, as they will not reflect the actual practices adopted by the SaaS supplier and its sub-contractors. The SaaS supplier should therefore always provide these details.

Applicable Data Protection Law

The DPA should refer to the GDPR and for UK SaaS suppliers, the Data Protection Act 2018. References to the EU Data Protection Directive are now obsolete (unless they refer to amendments or replacement legislation) and should be updated.

Providing Assistance

Many SaaS customer DPAs contain onerous and wide ranging obligations on SaaS suppliers to assist with audits, DPIAs, data subject requests and return and deletion of data which go far beyond the SaaS supplier’s obligations set out in the GDPR. These clauses should be carefully reviewed and amended to reflect the mandatory obligations of the SaaS supplier under the GDPR and should include provisions for a SaaS supplier to be paid for providing assistance.

Subcontractors

Any exclusion on the use of subcontractors should be removed from the DPA – as all SaaS suppliers use subcontractors, due to the nature of cloud computing – all SaaS suppliers use a data centre. The provisions on how and when subprocessors can be used and in which jurisdictions, should be carefully drafted to ensure that these permit the actual practices of the SaaS supplier in providing the SaaS services. EU standard contractual clauses must be used where any UK or EU personal data is transferred outside of the EEA.

Controller or Processor DPA

To avoid the above issues, SaaS suppliers should:

  • Draft their own GDPR compliant DPAs;
  • Send existing SaaS customers their DPA for inclusion in the existing SaaS agreement without delay;
  • Include their own DPA in their current SaaS agreements as a schedule for new SaaS customers.

Where a SaaS supplier agrees to use a SaaS customer’s DPA the SaaS supplier should have the terms of the DPA checked by a lawyer who will be able to:

  • Identify which obligations are not mandatory under the GDPR;
  • Which obligations of either party are missing;
  • Adapt the terms to protect the interests of the SaaS supplier in compliance with the requirements of the GDPR.

Help

IIrene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – GDPR – Data Protection Act 2018

The UK Data Protection Act 2018 Act came into force on the 25th of May 2018 (DPA). The DPA replaced the Data Protection Act 1998 in its entirety and applies the standards of the General Data Protection Regulation (GDPR), whilst also attempting to prepare the UK data protection law for Brexit. SaaS customers and SaaS suppliers should familiarise themselves with the terms of the DPA in addition to the provisions of the GDPR – as both apply. The DPA also includes a number of derogations from the GDPR.

Derogations

Each of the 28 EU member states is permitted to derogate from some of the provisions of the GDPR by enacting their own local data protection laws. SaaS customers and SaaS suppliers will need to be aware of the additional or differing rules in each of the EU countries in which they collect or process personal data.

Below is a summary of the main derogations in the UK that SaaS suppliers and SaaS customers should be aware of.

Age of Consent

Under the GDPR personal data cannot be collected from children under the age of 16 without obtaining parental consent. The DPA has lower the age of consent to 13 years of age in the UK. This means that SaaS customers may collect personal data from children from the age of 13, without the need to obtain parental consent. However, SaaS customers and SaaS suppliers should be aware that this derogation will only apply in the UK. SaaS customers. SaaS suppliers and SaaS customer will need to bear in mind when collecting and processing personal data from children in other countries within the EU that:

  • The GDPR restriction of 16 may apply; or
  • Other EU countries may have set a different age of consent.

Right to be Forgotten

Under the GDPR data subjects have the right to be forgotten. The DPA restricts a data subject’s right to access and delete data where there is a strong public policy justification, for example, national security.

Health Data

The DPA includes exceptions to the need to obtain consent from a data subject when processing medical information. Where the derogation applies, there will be no need to obtain advance consent from the data subject. SaaS suppliers and SaaS customers may process personal data concerning health for the purpose of insurance and pension policies.

Automated Processing/Profiling

The GDPR includes the right for a data subject to prevent processing based on automated decision making. The DPA includes exemptions, for example: for credit reference checking. However, data subjects must still be permitted to object to decisions made by automated means.

Criminal Convictions and Offences Data

Under the DPA, bodies other than public authorities will be lawfully permitted to process criminal convictions and offences data. For example, employers will be allowed to process criminal convictions data as part of their pre-employment checks and insurers can process criminal convictions data for anti-fraud purposes.

Criminal Offences

The DPA creates two new criminal offences for:

  • Intentionally or recklessly re-identifying individuals from anonymised or pseudonymised data; or knowingly handling or processing such data; and
  • For a SaaS supplier or SaaS customer altering records with the intent of preventing disclosure under a subject access request.

Ensuring compliance

SaaS suppliers and SaaS customers should check that their privacy policies and data processing agreements reflect the UK derogations and that data processing activities reflect the obligations set out in such policies and agreements. Additionally, SaaS customers and SaaS suppliers must ensure that they also comply with other applicable laws which apply to the particular industry in which they operate, as such laws may impose mandatory additional responsibilities in relation to the age of consent, duration of storage and obligations to delete personal data.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience dealing with SaaS, cloud computing matters and IT law issues. If you require assistance with any SaaS agreements, cloud computing matters or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – GDPR – Age of Consent

The General Data Protection Regulation (“GDPR”) and the new Data Protection Act 2018 (“DPA”) now apply in the UK. SaaS suppliers and SaaS customers must comply with the terms of both the GDPR and the DPA. SaaS suppliers and SaaS customers should be aware that the GDPR does not fully harmonise data protection law throughout the EU, as each EU country may introduce their own requirements in certain instances (“derogations”). SaaS suppliers and SaaS customers who operate in, or collect or process personal data from persons located in different EU countries need to be aware of  the different rules in each EU country.

One example of a derogation is the age of consent which will be discussed in detail below.

Age of Consent

Under the GDPR the default age for obtaining parental consent to the processing of personal data of children using online services is 16. Each EU country can derogate from this general rule and lower the age of consent to 13.

Derogations

To date, only a few EU countries have enacted their own local data protection law setting out such a derogation to the age of consent. For example, in the UK the DPA states that the age of consent for children is 13. In Germany the new data protection law (“BDSG”) does not derogate from the GDPR age of consent which remains at the default age of 16.

Many EU countries have not yet passed their own local data protection law setting out derogations, so the positon on the age of consent in such countries is currently the default of 16, but this may change when each country passes its own local data protection law.

Current Local Variations

Currently the following EU countries have either lowered the age of consent in their local data protection law or have indicated that they will do so:

  • 13 years of age – UK, Belgium, Czech Republic, Denmark, Estonia, Portugal, Spain, Sweden
  • 14 years of age – Bulgaria
  • 13 or 15 years of age – Finland
  • 15 years of age – France, Slovenia

Parental Consent

Where SaaS suppliers or SaaS customers are collecting or processing the personal data of children, they will need to regularly check the rules for each country in which they are collecting or processing the personal data of children. Technical and legal measures will need to be implemented and updated to ensure that the local rules on parental consent are complied with in each applicable EU country. This will apply not only to EU SaaS suppliers and SaaS customers, but any entity located outside of the EU which collects or processes the personal data of children located within the EU.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – GDPR – US Companies

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change existing UK data protection laws. The GDPR does not just apply to SaaS suppliers and SaaS customers located in the EU. The GDPR also applies outside the EU, i.e. to SaaS suppliers and SaaS customers located in the USA and other non-EU countries.

GDPR Applies to US SaaS Customers and SaaS Suppliers

The GDPR will apply to SaaS suppliers and SaaS customers located in the USA if:

  • They offer goods or services to SaaS customers located within the EU; or
  • They monitor the behaviour of EU data subjects;

Even though the SaaS supplier or SaaS Customer is not located within the EU.

US SaaS suppliers and US SaaS customers must therefore comply with the provisions of the GDPR from the 25th of May 2018.

Offering Goods or Services

In order for a US SaaS customer or supplier to be deemed to be offering SaaS goods or services it must be clear that the US company envisages offering SaaS goods or services to data subjects in one or more EU countries. This will be determined by looking at:

  • The use of any country specific domain names, e.g. co.uk;
  • The languages in which goods or services are offered, e.g. French;
  • The currencies in which goods or services are offered e.g. Euros.

Monitoring Behaviour of EU Data Subjects

In order for a US SaaS customer or supplier to be deemed to be monitoring the behaviour of EU data subjects, this will be the case if you track individuals on the Internet for profiling purposes, e.g. through the use of cookies.

Fines for Non-compliance

Data subjects will be able to claim damages directly from SaaS suppliers or SaaS customers who breach any obligations under the GDPR.

In addition data protection authorities will be able to fine SaaS suppliers and/or SaaS customers up to 4% of annual global turnover or 20m Euros (whichever is higher) for breaches of the GDPR.

How to Comply

US SaaS customers and SaaS suppliers need to take the following actions to comply with the GDPR by the 25th of May 2018:

  • Identify what personal data of data subjects located in the EU they collect/process;
  • Review and amend SaaS agreement terms for compliance with the GDPR;
  • Create GDPR compliant data processing agreements (DPA);
  • Amend existing privacy policies to comply with the GDPR;
  • Implement the security, technical and administrative changes required to comply with the GDPR and set out in the above legal documentation.

NB/ US SaaS customers or SaaS suppliers who do not, or cannot, comply with the GDPR, should enact measures to prevent orders being placed on their websites by EU data subjects.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: