SaaS legal expert – Page 4

SaaS Agreements – Heads of Terms – Entire Agreement Clause

13/08/2014 Irene Bodle

Heads of terms are often by SaaS suppliers where the final terms of the SaaS agreement have not yet been fully agreed with the SaaS customer. By using heads of terms the SaaS supplier can start to provide the SaaS services to the SaaS customer. However sometimes the parties are unaware of, or overlook, the legal implications and dangers of using heads of terms prior to finalising the terms of the SaaS agreement.

A recent court case in the UK highlights these problems.

Matchbet Ltd v Openbet Retail Ltd

A software developer claimed damages against a technology supplier for breaching the terms of a development agreement. The development agreement was based on heads of terms but the final signed development agreement contained an entire agreement clause.

Entire Agreement Clause

An entire agreement clause is a clause which states that the terms of the agreement (in this case the development agreement):

are the entire agreement and understanding between the parties; and
supersede all proposals and prior agreements, arrangements and understandings between the parties.

The purpose of an entire agreement clause is to ensure that all of the rights and obligations of the parties are in one single agreement i.e. the agreement which contains the entire agreement clause, in this case the development agreement.

Relevance of Heads of Terms

As the development agreement contained an entire agreement clause, the heads of terms were irrelevant in determining the intention of the parties, when the court had to interpret the terms of the SaaS agreement. The court had to ignore the heads of terms as they were merely part of the pre-contractual negotiations between the parties and were excluded from the terms of the final SaaS agreement by the entire agreement clause.

Important Note

In light of the above, it is important for SaaS suppliers to understand the interaction between any heads of terms they use prior to signing a final SaaS agreement and the inclusion of an entire agreement clause in the final SaaS agreement.

Where a SaaS supplier wants to ensure that all of the provisions from the heads of terms are included in the final SaaS agreement, the final terms of the SaaS agreement should specifically mirror the provisions of the heads of terms.

Additionally, where the commercial terms have substantially changed between the signing of the heads of terms and the signing of the final SaaS agreement, it is essential that the SaaS agreement includes an entire agreement clause to exclude the out of date heads of terms.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Which law applies?

15/07/2014 Irene Bodle

UK SaaS suppliers who provide cloud computing services to SaaS customers located outside of the UK are increasingly being required to comply not just with UK data protection law, but also the data protection laws of the countries in which the SaaS customer and its clients are based. This increasingly creates problems for SaaS suppliers, as data protection laws generally assume that data is stored/processed in one place. However when operating in the cloud data is often moved between jurisdictions and it may be unclear exactly where data is being stored or processed and who is storing and processing it.

Two recent cases involving Facebook and Google show the extent of this developing problem.

Facebook

In February 2014, Facebook, a US owned company, with its European headquarters in Ireland, was ordered to comply with German data protection law. A German court ruled that Facebook must comply with German data protection law before sending emails to German individuals i.e. by obtaining consent even though the processing of the German personal data was carried out by the Irish company.

The German court took the view that Irish data protection law did not apply, as although Facebook had its European headquarters in Ireland, a EU country, the US parent company Google Inc. controlled the processing and was the data controller. Even though the US parent company was located outside of the EU, as it was using ‘equipment’ situated in a EU country to process the personal data i.e. setting cookies on the devices of German users, the national data protection laws of Germany applied.

Google

The European Court of Justice (ECJ) ruled in May 2014 that Google Spain, a Spanish subsidiary of the US parent company Google Inc, must comply with Spanish data protection law when processing Spanish user data, as the Spanish entity was “established” in the EU. Google had argued that because the processing of Spanish user’s personal data was carried out by the US parent company, EU data protection law did not apply.

The ECJ disagreed, arguing that Google Inc had set up a subsidiary in Spain which directed its activities towards Spanish citizens and therefore Spanish data protection law applied, even though Google Inc. was located in the USA.

EU Data Protection Directive

Both of the above cases are based upon the application of EU data protection law (Directive 95/46/EC), to companies who:

process personal data;
are a data controller; and
have an establishment, or use equipment in, a member state of the European Union.

Where a SaaS customer fulfils the above criteria, it will be subject to EU data protection law (and effectively the locally applicable national data protection law of the country in which the user whose personal data is being processed is based).

Summary

SaaS suppliers should be aware that the application of different national data protection laws in the cloud is primarily the problem of a SaaS customer – who is the data controller. However this becomes an issue for the SaaS supplier where the SaaS customer attempts to pass on its cross border data protection obligations to the SaaS supplier within the terms of the SaaS agreement.

Such obligations are usually disguised in the terms of the SaaS agreement by reference to the SaaS supplier complying with „all applicable laws“ or more specifically to the specific data protection laws of named countries. Such terms should not be agreed to, unless the SaaS supplier is:

aware of the obligations and penalties imposed by such data protection laws; and
sure of its ability to comply with such obligations.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Reseller/Distribution – International SaaS Reseller Agreements

18/06/2014 Irene Bodle

If you decide to use a local partner to resell your SaaS software to customers outside of the countries in which you are based, you will need to have an international distribution/reseller agreement in place between yourself and each distributor/reseller.

What is a Reseller/Distributor?

A reseller is the same as a distributor. A reseller/distributor purchases the supplier’s SaaS software and services under the terms of a reseller/distribution agreement. The reseller/distributor then resells the SaaS software and services to its own local customers in the territory using its own terms and conditions (and SLA).

The SaaS supplier has no legal relationship with the reseller/distributor’s customers. Customers enter into a SaaS agreement with the reseller/distributor directly.

Is an Agent the same as a Distributor?

Agents are often confused with distributors, but there are clear legal differences. An agent is a person or company who acts on behalf of the SaaS supplier to find leads and/or assist with sales of the supplier’s SaaS software to local customers in the agent’s territory.

The agent has no legal relationship with the customer – the agent has no contract with the customer. The supplier enters into a SaaS agreement, with the customer using the supplier’s terms and conditions and SLA and the supplier is liable to the customers for issues and errors that may arise during use of the SaaS software.

Why use a Reseller/Distributor?

Most SaaS suppliers use distributors to enable them to sell their software and services to customers who would not otherwise purchase the SaaS software, due to the Supplier’s:

lack of physical presence in the customer’s country
lack of sales channels and contacts in the customer’s country
inability to speak the local language
inability to provide customer support in the local language
inability to provide customer support within the customer’s local business hours
terms and conditions not being written in the customer’s language, or subject to local laws and regulations

By using a distributor/reseller the above problems are resolved as the distributor sells the SaaS software directly to customers, in the local language, pursuant to local law, with local support as if the SaaS software was his own software.

Which law and language

The reseller will be selling your SaaS software to its customers using its own local terms and conditions. These will probably be subject to local law i.e. French law if the reseller is located in France and in the local language, French. However, there is no reason why your reseller agreement should be in French and subject to French law, as you the supplier have no relationship with customers. You should resist any attempt by the reseller to use its local law and language in the reseller/distributor agreement. English law and English language are often accepted and used for international reseller agreements.

As a compromise, it is worth allowing the reseller to have the reseller agreement translated into their local language “for convenience”, in parallel to the English version. However if you have two language versions ensure that the English version of the agreement prevails if there are any discrepancies between the two different language versions.

In some countries it is mandatory under local law to have the agreement in the local language.

Application of Local Law

When deciding to use a reseller/distributor located outside of the UK, you will need to consider the application of any local laws applicable to the reseller/distributor agreement. For example:

the terms of the agreement itself will be subject to local anti-competitive laws and regulations;
in Canada withholding tax and local income taxes could apply;
in the UAE the agreement may be registerable granting the reseller/distributor exclusive rights, rights to commission for any sales in the territory and wide reaching rights to avoid termination of the agreement.

Summary

In light of the above it is advisable to obtain expert legal advice before entering into an international reseller/distributor agreement to ensure that your legal and commercial interests are adequately protected.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Microsoft must disclose data on EU server

21/05/2014 Irene Bodle

Many SaaS customers falsely believe that if their SaaS data is stored in a data centre located in the EU it will be protected against disclosure to the US authorities. This is incorrect. The recent US court ruling against Microsoft has confirmed the position, namely that SaaS suppliers and SaaS customers who use data centres located in the EU, owned by US companies, cannot prevent US authorities from accessing their data.

Microsoft Case

In April this year a New York court ruled that Microsoft must reveal email data stored on its servers at its Irish data centre. Microsoft received a search warrant issued pursuant to the Stored Communications Act (SCA) requiring them to disclose the data. Under the SCA a US company is obliged to produce information in its possession, custody, or control regardless of the location of that information.

Microsoft currently offers SaaS customers the option of storing all data at its data centre in Ireland, in an attempt to address valid EU customer concerns about the ability of the US authorities to access their data and in an attempt to comply with EU data protection laws. However this recent court decision undermines the effectiveness of this option, as following this decision it is clear that US authorities can access data located outside of the US.

Microsoft plans to challenge the court decision but regardless of the final outcome of this case, US authorities will still be able to access data stored in the EU using other US laws.

Prism, FISA and the Patriot Act

Ignoring the issue of “Prism” the US government can secretly access SaaS customer stored in the EU under the Foreign Intelligence Security Act (FISA) and the Patriot Act.

What is FISA?

FISA allows the US government to access and monitor the personal data of non-US citizens (located outside of the USA) held by US public cloud providers. Public cloud providers such as Amazon and Google must secretly provide all assistance, facilities and information requested by the government if they request access to SaaS customer data. The public entity is not allowed to inform the SaaS supplier that it has disclosed or been asked to disclose personal data, nor that the data is being monitored.

The Patriot Act

The Patriot Act gives US law enforcement authorities the right to access personal data held by SaaS suppliers, regardless of where in the world the data is stored. The Act also gives US law enforcers the right to prevent SaaS suppliers from informing customers that they have handed over personal data. The Act applies not just to SaaS suppliers owned by a US company but also to any SaaS suppliers using the services of a US company i.e. a US data centre.

Summary

Under the SCA, Patriot Act, FISA (and “prism” where applicable) the personal data of SaaS customers based in the EU must be shared with US law enforcers without the SaaS customer being informed, even though this conflicts with the provisions of the EU Data Protection Directive and the data protection laws of the 28 EU member states.

Local EU data protection authorities and EU member state governments are currently investigating how to resolve this conflict, for example by adding provisions preventing disclosure in the draft proposed EU data protection regulation. While the position remains unresolved, SaaS suppliers should be considering how to minimise the risk this poses to their business model, whilst assuring SaaS customers that their concerns are being addressed.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – BYOD

06/05/2014 Irene Bodle

Employees are increasingly using their privately owned devices (i.e. Ipads, tablets, mobile phones and laptops) for business purposes and may be accessing SaaS customer data using them. SaaS suppliers who allow staff to use such “bring your own devices” (BYOD) for work purposes should be aware of their duties to protect any SaaS customer personal data being accessed by staff using such BYODs.

ICO Guidelines

In March 2013 the Information Commissioner’s Office (ICO) published guidelines providing advice on how to protect personal data that is accessed using a BYOD. The Commissioner underlined the fact that SaaS suppliers are obliged to look after personal data for which they are responsible under the Data Protection Act 1998 (Act) regardless of ownership of the device used to carry out the processing.

In order to protect SaaS customer data and to comply with their duties under the Act, SaaS suppliers who permit staff to access data on a BYOD should:

ensure that the BYOD is password-protected;
ensure that data is encrypted when it is transferred;
ensure that data is encrypted when it is stored; and
consider having a BYOD policy for staff.

BYOD Policy

SaaS suppliers should either prohibit BYOD and the ability to access SaaS customer data for work purposes on such devices entirely or they should permit access within the scope of a BYOD policy.

A BYOD policy should contain rules on the use of personal devices by staff, setting out:

which employees are allowed to use a BYOD, i.e. senior management;
what types of devices may be used;
which types of data may be accessed via the device;
how devices will be protected against loss, theft or hacking i.e. by requiring the use of passwords, pins and/or encryption;
how data should be deleted when an employee leaves or disposes of a device;
how and when use of the device will be monitored; and
sanctions for breach of the BYOD policy.

Ownership and Deletion of Data

A BYOD policy should also state that any work data i.e. contact details or content i.e. business documents will remain the property of the SaaS supplier. Employees should agree to the SaaS supplier being permitted to:

delete work data and content from the device; and
make copies of work data and content if an employee leaves the company’s employment.

Summary

SaaS customers are more likely to choose SaaS suppliers who demonstrate that they control and monitor the use of SaaS customer data on BYODs. Having a clear BYOD policy in place will often satisfy a SaaS customer’s concerns about the use and storage of personal data in accordance with the SaaS agreement terms.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Terms and Conditions – Risk Assessment

16/04/2014 Irene Bodle

SaaS customers often complain that the security provisions in SaaS agreements are inadequate and lack transparency. Following a risk assessment, often using external auditors and regulators, SaaS customers often ask SaaS suppliers to add numerous additional terms and warranties to their SaaS terms. By including the security provisions set out below in your standard SaaS agreement, SaaS suppliers can avoid having more rigorous provisions imposed upon them.

Right to Audit

SaaS customers increasingly want, or need, to check a SaaS supplier’s compliance with the security provisions contained in the service level agreement (SLA) for regulatory or data protection reasons. SaaS suppliers should allow SaaS customers (or their authorised third party) limited rights to carry out such security checks. These should be restricted to annual checks where reasonable written notice is given and the audit should take place during business hours.

Certification

Currently there is no harmonised security standard or certification available for SaaS suppliers. The STAR certification programme, backed by the British Standards Institute (BSI), was launched last year. Certification is based upon implementation of ISO 27001 and criteria set by the Cloud Security Alliance (CSA). The certification process provides an independent and technology neutral assessment of a SaaS supplier’s security standards.

SaaS suppliers need to demonstrate that they meet ISO 27001 on security management generally, as well as the criteria contained in the CSA’s Cloud Control Matrix (CCM), which includes:

risk management;
resiliency and security architecture;
facility security;
information security; and
operations management.

Once certified, SaaS suppliers are listed on the CSA STAR Registry as ‘Star Certified’ and can use the CSA STAR Certification logo.

Reputation

Maintaining a good reputation for data security is essential to a SaaS supplier. If security breaches have taken place in the past and attracted negative publicity, it is unlikely that potential SaaS customers will place any trust in a SaaS supplier’s ability to keep their data secure. SaaS suppliers should have an incident response plan in place before a security breach occurs. This should set out the procedures to be followed in the event of a security breach thus enabling the SaaS supplier to deal with the business impact of the breach and to mitigate any potential damage to reputation.

Insurance

Increasingly SaaS customers are requiring confirmation in the terms of the SaaS agreement that the SaaS supplier has appropriate cyber insurance in place. Such insurance covers the liability of the SaaS supplier to third parties and SaaS customers for claims arising out of the activities and conduct of the SaaS supplier in providing the SaaS services.

Such cyber insurance should cover the following risks:

damage to hardware and/or software;
loss or damage to data or computer records;
infringement of the intellectual property rights of third parties;
breaches of data protection law;
defects in computer programmes;
physical damage to customer property;
injury to visitors.

Summary

By obtaining security certification SaaS suppliers will obtain a valuable marketing tool which can be used to differentiate them from competitors. Also by having appropriate cyber insurance in place and an incident response plan SaaS suppliers will be able show SaaS customers the priority that they place on the security of data and that ongoing measures are really being taken to protect Customer data.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

________________________________________________

Other related articles:

SaaS Agreements – Legal Requirements – Online SaaS Sales

31/03/2014 Irene Bodle

SaaS suppliers making online sales of SaaS services to business customers in the UK need to ensure that they have the necessary legal documents and information available on their website to comply with English law. Simply having a SaaS agreement online will not cover all legal obligations in the UK when providing SaaS services online. Below is a summary of the documents and information that you should have available on a UK website.

SaaS Agreement

The terms and conditions under which you will be providing SaaS services to customers should be set out in your SaaS agreement. These should as a minimum include:

granting SaaS customers a licence to access the SaaS services for the term of the SaaS agreement;
retaining ownership in all intellectual property rights in the software and services;
return of SaaS customer data on termination of the SaaS agreement;
the Customer’s obligations as a data controller under the Data Protection Act 1998.

Service Level Agreement (SLA)

This should set out the hosting, support and maintenance services being provided to the SaaS customer. The SLA should specify:

where the data centre is located;
who is operating the data centre;
what security, backup and disaster recovery procedures are in place;
what support services are provided;
when and how maintenance will be carried out.

Privacy Statement

When making online SaaS sales you will be collecting and processing the personal data of your SaaS customer. Even if SaaS customers do not have to register in order to use your website you will undoubtedly be using Google analytics or setting other cookies to collect information about visitors to your website. To comply with the Data Protection Act 1998, if you collect, store or process personal data i.e. email addresses you need to have a privacy policy on your website. Your privacy policy must be easy to find and should include the following information:

the type of data being collected;
why the data is being collected;
how the data is used and why;
information about any cookies used;
if and why personal data will be disclosed to third parties;
how and where data is stored;
how complaints or queries about personal data will be dealt with.

Registration under the Data Protection Act

If you collect personal data on your website – i.e. email addresses, name or address of a living individual, you will be processing personal data and must register as a data controller under the Data Protection Act. It is a criminal offence not to register.

About Us/Contact Information

SaaS suppliers must provide the following information in an easily accessible position on their website:

legal name i.e. XYZ Ltd;
geographical address;
contact details i.e. telephone number, fax number and email address;
which country your business is registered in and the registration number;
details of any supervisory body which regulates your business i.e. the FSA;
where you are registered for VAT and your VAT number;
clear details of prices and whether or not delivery and/or tax is included.

Compliance with other Laws

SaaS supplier’s will also need to consider their compliance with any other applicable laws or rules. These will be industry specific depending on the type of SaaS services being provided.
For example, if you provide email marketing services you will need to comply with applicable email marketing and advertising rules and guidelines such as the CAP Code and the Privacy and Electronic Communications Regulations 2003.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Terms and Conditions – Safe Harbor Adequacy

02/01/2014 Irene Bodle

European data protection authorities have recently raised serious reservations about the effectiveness of the safe harbor scheme and its ability to adequately protect SaaS customer data to the same standard as European data protection laws. If you are a SaaS supplier and are considering/or are already using a company located in the US to provide part of your SaaS services i.e. for hosting, you should be aware of the existence and limitations of the safe harbor scheme.

What is Safe Harbor

Safe Harbor allows an EU based SaaS supplier to lawfully transfer SaaS customer data concerning EU individuals to a sub-contractor located in the USA (usually a data centre), provided that the US sub-contractor has signed up to the principles of the safe harbor scheme.

Safe Harbor Registration

Safe harbor is a voluntary scheme and no company located in the USA is obliged to register. Companies chose to sign up to the safe harbor scheme by notifying the U.S. Department of Commerce that:

they have committed to comply with the safe harbor principles in their privacy statement; and
they agree to self-certify annually (to the Department of Commerce) that they comply with the principles.

EU Concerns

In light of recent Prism revelations, national EU data protection authorities have voiced growing concerns about the adequacy of the safe harbor scheme. On the 27^th of November 2013, the EU Commission published its own concerns about the scheme. The Commission made the following 13 recommendations which should apply to all safe harbor registered companies:

Transparency

Companies should:

publicly disclose their privacy policies;
always include a link to the Department of Commerce Safe Harbour website in their privacy policy;
publish the privacy conditions of any contracts concluded with sub-contractors, e.g. cloud computing services;
clearly flag on the Department of Commerce website all of their group companies which are not members of the scheme.

Redress

privacy policies should include a link to the alternative dispute resolution (ADR) provider named;
ADR should be readily available and affordable;
the Department of Commerce should monitor ADR providers more systematically.

Enforcement

following certification/recertification, a certain percentage of companies should be investigated for compliance with their privacy policies;
if found to be non-compliant, the company should be subject to a follow-up investigation after 1 year;
the competent EU data protection authority should be informed of doubts about a company’s compliance or any pending complaints;
false claims of safe harbor adherence should be investigated.

Access by US Authorities

privacy policies should include information on the extent to which US law allows public authorities to collect and process data transferred under the safe harbor scheme. In particular indicating when exceptions apply i.e. to meet national security, public interest or law enforcement requirements.
the national security exception should only be used to the extent that it is strictly necessary or proportionate.

Summary

In light of the above and rising SaaS customer awareness of the limitations of safe harbor, if you are a SaaS provider using a sub-contractor based in the US you should be including additional provisions in the terms of your SaaS agreement to cover the above concerns. You should ensure that you are granted the right to check your sub-contractors actual compliance with its safe harbor obligations, for example: by adding the right to audit compliance with the provisions of its privacy statement.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SLAs – Business Continuity and Escrow Agents

23/12/2013 Irene Bodle

SaaS customers are increasingly asking for disaster recover provisions to be included within the terms of a SaaS agreement to ensure that they have access to their data and continuity of service if a problem arises at the SaaS supplier’s data centre. The costs of providing disaster recovery used to be prohibitive, due to the requirement of having mirrored servers and transferring data, however there is now a new market opening up with former escrow providers offering a variety of disaster recovery options at affordable prices.

Disaster Recovery

Disaster recovery sets out the processes and procedures to be followed in the event of a SaaS supplier’s software or customer data no longer being available. This is commonly due to a problem at the SaaS supplier’s third party data centre.

The most common problems are usually caused by:

physical damage to the data centre; or
insolvency of the party operating the data centre.

However, disaster recover does not cover the situation where the SaaS supplier itself becomes insolvent. In these circumstances a SaaS customer will have no right to access its data and backups at the data centre, as it is not a party to the hosting agreement between the data centre and the SaaS supplier.

Escrow

In the past, SaaS customers used escrow agreements to enable a third party – an escrow agent – to hold a copy of a SaaS supplier’s software (the source code) on behalf of the SaaS customer and SaaS supplier. The source code would be released to the SaaS customer if the SaaS supplier became insolvent or unable to continue to provide the SaaS services. This did not however actually ensure business continuity as SaaS customers did not generally have the technical know-how to understand and use the source code. Accordingly escrow agreements are rarely used today.

Alternative to Escrow

Many escrow providers, such as the NCC and Iron Mountain have amended the services they offer to SaaS suppliers and SaaS customers. They have replaced traditional escrow services with service continuity options which on the most basic level permit the escrow agent to step in and take over the SaaS provider’s hosting obligations, if the SaaS provider becomes insolvent or unable to provide the SaaS services. The escrow agent provides the SaaS customer with continuity of the SaaS service by hosting the SaaS software and data either:

at an alternative data centre, if there are issues at third party data centre; or
at the existing data centre in the event of the insolvency of the SaaS supplier.

For example. A SaaS customer enters into a SaaS agreement with a SaaS supplier who is hosting the SaaS service via AWS (Amazon Web Services). The SaaS supplier becomes insolvent and AWS stops hosting the SaaS services. However, if the SaaS customer had included a service continuity option in the SaaS agreement with the SaaS supplier, the escrow agent would simply have replaced the SaaS supplier in relation to the AWS hosting and the SaaS services would have continued uninterrupted.

Advantages for the SaaS Customer

There is no immediate need for the SaaS customer to obtain copies of the source code, data and find a new hosting provider. The SaaS services will continue to run uninterrupted without any loss of service which is very important if the service is being used for a business critical function. The SaaS customer will have time to transition to a new SaaS supplier and service and will also have the peace of mind that the SaaS service will not be interrupted in the interim.

Advantages for the SaaS Supplier

Providing for this type of service in your SLA offers reassurance to your SaaS customers. By proactively approaching the issues of business continuity you will have a competitive advantage over other SaaS supplier sand it will help you build trust into your customer relationship.

Summary

This is just one of the services offered by such former escrow agents. SaaS suppliers should consider discussing this option with customers in order to deal with their concerns over continuity of service, when signing up new business and/or negotiating a SaaS agreement.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Update on the EU Draft Data Protection Regulation

13/12/2013 Irene Bodle

SaaS suppliers should be aware of the recent changes made by the EU Parliament to the draft EU Data Protection Regulation (Regulation). If this amended version of the Regulation becomes law next year the obligations of SaaS suppliers who process personal data on behalf of customers will radically change. A summary of the current main proposed provisions is set out below.

Fines

The proposed fine for breaching data protection law will be increased to the higher of:

5% of annual worldwide turnover; or
€100 million

Currently the maximum UK fine for a breach of data protection law is £500,000.

Data Protection Officer

A data protection officer must be appointed where:

a SaaS supplier processes the personal data of more than 5,000 individuals in any consecutive 12 month period; or
special categories of data, location data, data relating to children, or employee data in large scale filing systems is processed.

The data protection officer must be appointed for:

a minimum of 2 years; and
meet specific minimum requirements set out in the Regulation.

Notification of Data Protection Breaches

SaaS suppliers must notify breaches of data protection law without undue delay.

Data Processor Obligations

The obligations and duties of SaaS suppliers (data processors) have been more specifically defined. For example SaaS suppliers should:

only employ staff who have given confidentiality undertakings or commitments;
obtain permission from SaaS customers (data controllers) before employing a sub-processor i.e. using a third party hosting centre;
ensure that security measures are implemented; and
maintain documentation of all processing operations.

Data Transfers – Prism

The transfer of an individual’s personal data to third parties has been restricted in light of recent revelations about the NSA and Prism. No transfer of personal data will be permitted in relation to a third country court decision or administrative authority (i.e. under the Patriot Act or FISA) if this does not comply with a mutual legal assistance treaty or an international agreement.

Additionally, individuals will have the right to know if their personal data has been disclosed to a public authority.

Territorial Scope

The Regulation will apply to companies located outside of the EU whenever they process the personal data of individuals located in the EU. This means that if a UK SaaS supplier uses a data centre located outside of the EU to host EU SaaS customer data the provisions of the new Regulation will apply to both the SaaS provider and the data centre. For example if a SaaS supplier uses Microsoft to host EU customer data both will be directly subject to EU data protection law.

Right to be Forgotten

This has been changed to the right to be erased. This right will not apply to data which cannot be erased due to the type of storage technology used, provided that the technology was installed prior to the Regulation coming into force.

Summary

The above is a summary of the current status of the draft Regulation. The Regulation may be amended before it becomes law in 2014 and SaaS suppliers should continue to monitor the position to ensure they are ready to adapt their existing procedures and compliance regimes to comply with any change in their legal obligations.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To learn more about SaaS and cloud computing join me at the Berlin CloudConf 2013 on 5th of December.

To register for my newsletter click here

______________________________________________________

Other related articles: