Tag: software on demand

SaaS Agreements – FAQs – Disaster Recovery

Should SaaS suppliers include disaster recovery provisions in a SaaS agreement? If so, what provisions should be included in the SaaS agreement and where.

Disaster Recovery

Disaster recovery sets out the processes and procedures to be followed by a SaaS supplier in the event of its SaaS software and subsequently a SaaS customer’s  data not being accessible. The disaster usually results from a problem with the technology infrastructure on which the SaaS software is being made available, i.e. the SaaS supplier’s data centre or telecommunications provider.

Disasters

The most common disasters are:

  • power failure at the data centre;
  • physical damage at the data centre i.e. flood or fire;
  • physical damage to SaaS customer data i.e. loss, corruption or deletion;
  • insolvency of the data centre or third party telecommunications provider;
  • theft of hardware on which the SaaS software operates.

In any of these circumstances, the disaster usually makes the server on which the SaaS software is running unavailable to the SaaS customer.  As a result, the SaaS customer will not have full access to the software, SaaS services and its data. Where a SaaS customer is operating a live website, the website will cease to function correctly, or possibly at all.

Disaster Recovery Provisions

The following disaster recovery provisions should be set out in the SLA which forms part of the SaaS agreement:

  • the right of a SaaS customer to be informed of the disaster;
  • the obligation of the SaaS supplier to keep the SaaS customer informed of steps being taken to rectify the disaster;
  • the estimated time for restoring servers and SaaS customer data;
  • the right for the SaaS customer to terminate or be given a copy of SaaS customer data in the event of a disaster;
  • details of the SaaS supplier’s testing procedures i.e. how often its disaster recovery processes are tested.

Costs

The extent and speed of the disaster recovery offered by a SaaS supplier will depend upon the level of fees charged for the SaaS services. SaaS suppliers often include the costs of basic disaster recovery within their licence fees. In addition, or as an alternative, they may offer higher levels of disaster recovery for payment of additional fees. The faster and more individual the disaster recovery process is, the higher the fees will be.

Alternatives

If a SaaS supplier does not provide any disaster recovery services, or a SaaS customer is not satisfied with the disaster recovery offered, it should consider setting up its own disaster recovery procedure with a third party, particularly if a disaster would be business critical i.e. for a SaaS customer providing online banking services.

Some companies such as the NCC and Iron Mountain offer third party disaster recovery services to SaaS customers directly, whereby they  take over hosting of the SaaS services to ensure continuity of services for the SaaS customer.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience in dealing with SaaS, cloud computing and IT law issues. If you require assistance with any SaaS agreements, cloud computing concerns or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

_________________________________________________

Other related articles:

SaaS Agreements – Terms and Conditions – Limitation Clauses

SaaS suppliers should always include limitation clauses in their the SaaS terms and conditions to attempt to limit or exclude liability for certain types of losses and to cap their financial liability for breaches of contract. However, in order for limitation clauses to be valid, SaaS suppliers must ensure that the wording of the limitation clause is clear and unambiguous, otherwise the whole clause could be ruled void by a court and the SaaS supplier’s liability will then be unlimited.

Dundee City Council v Geddes

In Geddes, a Scottish case, a construction contract contained a limitation clause which attempted to limit the contractor’s liability to a local council for a failure to supply goods of satisfactory quality or reasonably fit for their purpose. The clause stated that a claim for breach must be made in writing within 24 hours of delivery unless there were “special circumstances” to justify delay.

Interpretation by the Court

The court decided that it could be argued in virtually every case that “special circumstances” would apply so the scope of the limitation was uncertain. Accordingly, the court held that the entire clause was invalid for uncertainty. This resulted in the contractor being liable to the council for its failure to supply goods of satisfactory quality or reasonably fit for the purpose.

Court Powers

SaaS suppliers should be aware that if a limitation clause in their SaaS terms and conditions is disputed, in assessing the validity of a limitation clause a court may:

  • simply delete the part of the clause excluding liability and leave the remainder standing;
  • declare the whole clause invalid; or
  • insert wording to amend the clause.

As a court can take any of these options, limitation clauses should be drafted to try to reduce the risk that none of the intended exclusions or restrictions will be valid in the event of a dispute.

Summary

SaaS suppliers should ensure that the language they use in limitation clauses:

  • is not ambiguous;
  • does not contain different types of exclusions in one single clause i.e. financial caps and restrictions on the types of losses that can be claimed should be separated.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Reseller Agreements

SaaS suppliers who decide to use a local partner to resell their SaaS software to customers outside of the countries in which they are based, will need to have a reseller/distributor agreement in place between themselves and each SaaS reseller/distributor.

What is a SaaS Reseller/Distributor?

A SaaS reseller is the same as a SaaS distributor. A reseller/distributor purchases the supplier’s SaaS software and services under the terms of a reseller/distribution agreement. The SaaS reseller/distributor then resells the SaaS software and services to its own local customers in its local territory using its own terms and conditions (and SLA).

The SaaS supplier has no legal relationship with the SaaS reseller/distributor’s customers. Customers enter into a SaaS agreement with the reseller/distributor directly.

Reasons for Using a Reseller/Distributor                                          

SaaS suppliers use resellers to facilitate sales of their SaaS software and services to customers who would not otherwise be able to purchase the SaaS software, due to the Supplier’s:

  • lack of physical presence in the customer’s country
  • lack of sales channels and contacts in the customer’s country
  • inability to speak the local language
  • inability to provide customer support in the local language
  • inability to provide customer support within the customer’s local business hours
  • terms and conditions not being written in the customer’s language, or subject to local laws and regulations

By using a SaaS reseller/distributor the above problems are resolved as the SaaS reseller sells the SaaS software directly to customers, in the local language, pursuant to local law, with local support as if the SaaS software was his own software.

Advantages

The main advantage of using a SaaS reseller is that the SaaS supplier will have no liability to customers – as there is no contract or legal relationship between the customer and the SaaS supplier. For example, any implementation issues or software errors that the customer encounters when using the SaaS software will be the SaaS reseller’s problem. The distributor will be liable to the customer and will be obliged to resolve such issues directly with the customer.

Disadvantages

The main disadvantage of using a SaaS reseller is that the SaaS supplier has no control over the sales process and in particular of the choice of customers. Also, the terms of the reseller agreement itself will be subject to local anti-competitive laws and regulations.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

 

SaaS Agreements – Data Protection – General Data Protection Regulation (GDPR)

The General Data Protection Regulation (“GDPR”) will replace the existing EU Data Protection Directive and harmonise European data protection law from the 25th of May 2018. In the UK the GDPR will replace the Data Protection Act 1998 from the 25th of May 2018. This will have a significant effect on both SaaS suppliers and SaaS customers who will need to comply with the terms of the GDPR.

Harmonisation

SaaS suppliers and SaaS customers should be aware that the GDPR will not fully harmonise data protection law throughout Europe, as each EU country may introduce their own requirements in certain instances. However, SaaS suppliers and SaaS customers will need to start making organisational changes now to their data processing activities in order to comply with the new rules on consent, audit rights, data exports, increased administrative requirements and the new obligations of data processors.

Below is a summary of the main provisions of the GDPR that SaaS suppliers and customers need to be aware of.

New Data Processor Obligations

The GDPR applies to data controllers (SaaS customers) and data processors (SaaS suppliers) and in particular SaaS suppliers should be aware that some of the GDPR applies directly to data processors who will be subject to compliance obligations and sanctions for non-compliance.

Consent

SaaS suppliers and SaaS customers relying on consent to process personal data will need to show that the consent is:

  • freely given;
  • specific and informed; and
  • an “unambiguous indication” of a data subject’s wishes and expressed either by a statement or a clear affirmative action (i.e. ticking a consent box when visiting a website).

Consent must be purpose limited i.e. related to explicitly specified purposes.

The default age for giving valid consent and using online services is 16, however each EU country will be able to reduce this to 13.

Penalties

The maximum penalty for a breach of the GDPR will be substantially higher than under current legislation. Fines can be imposed on SaaS suppliers or SaaS customers. Fines of up to 4% of annual global turnover or up to 20m Euros (whichever is higher) can be applied.

Applicable to Non-EU Entities

The GDPR will apply not just to EU SaaS customers and suppliers but also to non-EU SaaS customers and suppliers who:

  • offer goods or services to data subjects in the EU; or
  • monitor the behaviour of EU citizens to the extent that the behaviour takes place in the EU.

Enforcement – One Stop Shop

SaaS suppliers and SaaS customers will be regulated by a single regulator in the place of their main establishment, which shall be their main administrative location in the EU. Data subjects will be able to make complaints to regulators in their own EU country.

Data Protection Officer

An independent data protection officer (“DPO”) must be appointed where an organisation’s core business involves processing personal data involving regular and systematic monitoring of data subjects or large amounts of sensitive personal data. Each EU country may enact national provisions imposing further requirements regarding the appointment of DPOs. This will be particularly relevant in Germany where this is already a legal requirement.

Notification

There is no requirement for a SaaS supplier or SaaS customer to notify local data protection authorities of any data processing activities but there is a requirement to keep records of data processing activities (subject to limited exceptions).

Breach Reporting

SaaS customers and SaaS suppliers must report breaches to the relevant local regulator without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Data subjects must be informed of breaches without undue delay where the breach is likely to result in a high risk to the data subject’s rights and freedoms unless:

  • the data has been rendered unintelligible to any third party (for example by encryption);
  • the data controller has taken steps to ensure the high risk is unlikely to materialise; or
  • it would involve disproportionate effort to inform data subjects individually, in which case a public announcement can be made.

Data processors (SaaS suppliers) are required to inform data controllers (SaaS customers) of any breach without undue delay.

Impact Assessments

SaaS customers will be required to carry out data protection impact assessments (“DPIAs”) if their proposed activities are likely to result in a high risk for the rights and freedoms of individuals, in particular, through the use of new technologies and in cases of profiling.

Data Subject Rights

The following rights shall be granted to data subjects:

  • data portability;
  • the right to be forgotten;
  • the right to prevent profiling;
  • the right to object to processing;
  • the right to rectification and erasure.
  • subject access requests (“SARs”).

SARs must be responded to by the data controller (SaaS customer) without undue delay and, at the latest, within one month of receipt of the request. The data controller only has the right to charge a reasonable fee to cover administrative costs where the requests are “manifestly unfounded or excessive”.

Preparing for Change

Although the GDPR will not come into force until the 25th of May 2018, it is essential that SaaS customers and SaaS suppliers start to prepare for the changes now. For example, by appointing a data protection officer (where appropriate), devising a documentation system for recording data processing activities, reviewing how consent is obtained from data subjects, adding written data processing agreements to existing SaaS agreements and future SaaS agreements with relevant customers and amending existing privacy policies to comply with the GDPR rules.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – EU US Privacy Shield

The GDPR prohibits SaaS suppliers and SaaS customers from transferring personal data to countries or territories outside the EEA unless they are considered to provide adequate protection. Below is a summary of the current position under the EU-US Privacy Shield which has replaced the safe harbor scheme.

Safe Harbor

Until the 6th of October 2015, SaaS suppliers and SaaS customers relied upon Safe Harbor (a self-certification standard operated by the US Department of Commerce and enforced by the Federal Trade Commission) when transferring personal data to the USA.

Grace Period

Following the invalidation of safe harbor, the Art. 29 Working Party, which is comprised of European Data Protection regulators, (the “Working Party” now known as the EBDP) made clear that no actions would be taken against SaaS suppliers or SaaS customers relying upon on safe harbor until the end of January 2016. This grace period was agreed to allow the Working Party, EU countries and the European Commission time to find a suitable political, legal and technical solution to the problem of transferring personal data from EU countries to the United States in compliance with EU data protection laws.

Interim Enforcements

However, national data protection authorities retain the right to exercise their  powers to protect a data subjects’ rights upon receipt of individual complaints against SaaS suppliers or customers. For example, the German Federal and State Data Protection Commissioners (“the Commissioners”) stated that there would be no grace period and that they would immediately take action against data transfers which were based on Safe Harbor, unlike the UK Information Commissioner’s Office (“ICO”) which made it clear that SaaS suppliers and customers would be given time to adapt.

Interim Options

Accordingly, SaaS suppliers and customers had three options for continuing to lawfully transfer personal data from the EU to the USA:

  • obtain consent from each data subject to the transfer of data to the USA;
  • create and have approved binding corporate rules (“BCRs”) for transatlantic transfers of personal data within a company’s group of companies;
  • enter into EU Model Clauses with US entities to whom personal data was transferred.

Privacy Shield

The grace period has now expired and a new privacy agreement called the Privacy Shield has been agreed by the US and EU to replace the safe harbour scheme. The Privacy Shield is based upon safe harbour but has additional protections, particularly with regard to public authority access to personal data. The Privacy Shield must now be reviewed by the European Commission before it can be relied upon and adopted by SaaS suppliers or customers. The European Commission is currently assessing whether or not the Privacy Shield provides adequate protection in accordance with EU data protection laws. This process is expected to take up to 3 months.

Current Position

The Working Party has confirmed that for the time being EU Model Clauses and BCRs are valid for transfers of personal data from the EU to the USA. Accordingly, Saas suppliers and SaaS customers should continue to us BCRs, consent or EU Model Clauses when transferring personal data to the USA and whilst monitoring the status of the Privacy Shield with their local data protection authorities.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Direct Marketing Rules

In September 2013 the Information Commissioner’s Office (ICO) published a lengthy guide to Direct Marketing. The guide covers compliance with the Data Protection Act 1998 (DPA) and the Privacy and Electronic Communications Regulations 2003 (PECR) in relation to the sending of unsolicited marketing. SaaS suppliers who are sending unsolicited marketing to SaaS customers and prospective customers should check their compliance with the guidance. Additionally, the Direct Marketing Association (DMA) has also published its own further supplemental guide which provides detailed guidance on how and when to obtain consent to marketing from individuals.

Marketing and the DPA

The DPA applies to marketing where a SaaS supplier is using personal data. For example: if a SaaS supplier is sending marketing emails to a named person i.e. peter.smith@microsoft.com. When sends marketing emails to a named person a SaaS supplier must comply with the 8 data protection principles. In particular, the SaaS supplier must give the individual the right to object to any direct marketing (in writing).

Marketing and the PECR

The PECR complements the DPA. It sets out more detailed rules on electronic marketing i.e. email, text messages, fax and telephone calls.  Unlike the DPA, the rules apply even if the SaaS supplier does not know the name of the person it is contacting i.e. admin@microsoft.com.

The rules under the PECR also vary depending on whether the marketing is sent to a consumer (B2C) or to a business (B2B).

Obtaining Consent

Both the DPA and the PECR require that the recipient consents to being sent direct marketing. Such consent must be informed and must be freely and specifically given. Consent is only valid if:

  • it is not a condition to subscribing to a service or completing a transaction;
  • the information given is clear, prominent and not difficult to find (so that individuals understand what they are consenting to);
  • it is relevant to the type of marketing being sent; and
  • there is a positive indication of the recipient’s agreement to receive direct marketing.

This means as a general rule that pre-ticked “opt-in” boxes should not be used to obtain consent.

Marketing Emails and Texts

Where marketing messages are sent by email or text additional rules apply. Consent must be:

  • notified; and
  • specific to the type of communication.

No express consent is required where:

  • a recipient’s details are obtained in the course of a sale (or negotiation of a sale) of a product or service of the SaaS supplier to that individual;
  • the SaaS supplier is only marketing their own similar products or services; and
  • the recipient had the option to refuse or “opt-out” of the marketing at the time their details were collected, and in every subsequent email.

In order to demonstrate compliance with the rules on consent, SaaS suppliers should keep clear records of:

  • what, when and how consent was collected;
  • who gave the consent; and
  • the information provided to the individual about the consent being given.

Marketing Calls

In the UK SaaS suppliers must not make unsolicited marketing calls to numbers registered with:

  • the Telephone Preference Service (TPS) in relation to individual B2C subscribers; or
  • the Corporate Telephone Preference Service (CTPS) in relation to B2B subscribers.

Automated marketing calls can only be made to individuals who have specifically consented to receiving such calls.

Fines for Breach

Breaches of the DPA or PECR can result in a SaaS supplier receiving an enforcement notice from the ICO requiring remedial steps to be taken. Failure to comply with such a notice is a criminal offence.  In addition, the ICO can also impose a fine of up to £500,000 for serious breaches.

Summary

The above is a general summary of the complicated rules applicable to direct marketing. Before launching any direct marketing campaign, specific legal advice should be taken, in order to check full compliance with the above laws and rules to reduce the risks of substantial fines being imposed for breaches.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Russian Data Centres

SaaS Suppliers who will be processing personal data of Russian citizens on behalf of SaaS customers need to be aware of amendments to the Russian Federal Law on Personal Data. From the 1st of September 2015 changes to this Russian law may prohibit foreign SaaS suppliers from processing personal data of Russian citizens on servers located outside of Russia.

Restrictions

The amended law will apply to all ‘data operators’. A data operator combines the duties of a SaaS customer (data controller) and a SaaS supplier (data processor) so the law will apply to both SaaS customers and SaaS suppliers. Under the amended law it will be illegal for a data operator to collect personal data of Russian citizens and send it directly to servers located outside of Russia without using a database installed on a server located in Russia. This means that SaaS suppliers will need to ensure that personal data of their SaaS customers is stored in databases on servers located within Russia i.e. in a Russian data centre.

Export of Data outside of Russia

No explicit restriction on the transfer of personal data outside of Russia is contained in the amendment to the law. The amendment simply says that personal data must be stored in Russia.

It is therefore currently unclear whether the processing of personal data of Russian citizens should only take place in Russia or whether under existing laws personal data can be transferred outside of Russia if the following conditions are met:

  • the prior written consent of the data subject is obtained; and
  • the transfer is to one of the 46 countries which is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data Personal Data.

In March 2015, the Russian Internet Ombudsman proposed that foreign online companies be allowed to continue to store personal data of Russian citizens in a third country, if they complied with the above. However, as a number of multinational online companies such as Google are setting up servers in Russia, it seems unlikely that this exception will continue after September 2015.

Personal Data

Unlike EU data protection laws, the amendment to the Russian law does not provide clarification of the personal data to which it applies. For example the amendment to the law says nothing about whether:

  • the new rules will apply to personal data already collected from Russian citizens i.e. collected before the amendment comes into force on the 1st of September 2015;
  • the new rules apply to personal data of Russian citizens who are not resident in Russia; and
  • or not IP addresses are personal data.

Penalties

Roscomnadzor (the Russian entity responsible for monitoring compliance) will be able to block access to websites in the territory of Russia that breach the new rules. In addition fines can be imposed, although these will generally only be in the region of 150 GBP for each breach. However, the Russian Parliament is currently considering legislation to increase the level of fines and to introduce new categories of personal data breaches.

Summary

In light of the above, SaaS suppliers need to:

  • identify whether or not they have any SaaS customers collecting personal data of Russian citizens;
  • check that SaaS Customers who collect data of Russian citizens have servers physically located in Russia; and/or
  • consider providing hosting services themselves from servers located in Russia, particularly if such personal data is only being processed outside of Russia;
  • check any developments in this area.

Failure to consider the above and take appropriate actions could result in SaaS suppliers facing fines from the local Russian Roscomnadzor for breaches of the amended law.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – International Agreements – Valid Execution

Where an international SaaS agreement is entered into between a non-UK SaaS customer and a non-UK company of a SaaS supplier the parties should ensure that the SaaS agreement has been properly executed in accordance with the law of the country of incorporation of each company. Even where the SaaS agreement is governed by English law, failure to properly authorise or execute the SaaS agreement in accordance with the local law of each party could result in the SaaS agreement not being binding.

Integral Petroleum SA v SCU – Finanz

Two Swiss companies entered into a supply agreement that was governed by English law. The customer sued the supplier for breach of contract in the English courts and lost because the contract was never validly signed by the supplier in accordance with Swiss law requirements. The UK courts determined that the contract was not legally binding.

The Swiss commercial register stated that the supplier could only enter into a binding contract if two representatives of the supplier company signed the contract together. As only one representative signed the contract he had no authority to bind the supplier and the contract was held to not be legally binding. The customer therefore had no claim for breach of contract, as there was no binding contract.

Overseas Companies Regulations 2009

Regulation 4 of the Overseas Companies (Execution of Documents and Registration of Charges) Regulations 2009 sets out the requirements for the execution of documents by overseas companies under English law.

An overseas company will have validly executed a SaaS agreement if:

  • it has done so in a manner provided for in the regulation i.e. the SaaS agreement is signed by a representative acting under the company’s authority, in accordance with the company’s law of incorporation.

Law of Country of Incorporation

In light of the above, the English courts have clarified that where two non-UK SaaS companies sign a SaaS agreement governed by English law, the law that governs the validity of the execution of the SaaS agreement will depend upon where the companies are incorporated. In the above case as both companies were incorporated in Switzerland, Swiss law applied to the validity of the execution of the SaaS agreement.

Summary

Where a SaaS supplier is dealing with an overseas company, the SaaS supplier should not assume that the execution formalities are the same as in English law, even if the SaaS agreement is governed by English law. The SaaS supplier should check that whoever is signing the SaaS agreement on behalf of the SaaS customer is actually authorised to sign and where possible, seek local advice or a legal opinion for the country or countries in which the parties are located.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – International Agreements – Interest on Late Payments

SaaS customers often delay payment of invoices. In order to protect your SaaS business and improve cash flow, SaaS suppliers usually include the right to claim interest on late payments in the terms of their SaaS agreement or rely on the statutory right to interest under the Late Payment of Commercial Debts (Interest) Act 1998 (“Act”). However, following the decision in Martrade Shipping and Transport GmbH v United Enterprises Corporation SaaS suppliers should be aware of the limitations of relying upon the Act, particularly where the SaaS customer or SaaS supplier is a non UK entity.

Contractual Right to Claim Interest

SaaS suppliers can state a specific interest rate in their SaaS agreement terms under which interest for any late payment will be claimed. This can be a number i.e. 5%, or a reference to an index i.e. the European Central Bank base rate, or a combination of both i.e. the Bank of England base rate + 2%. The interest rate specified can be higher or lower than the statutory rate.

Statutory Right to Claim Interest

Alternatively, SaaS suppliers can simply say nothing about interest in the SaaS agreement and rely upon their statutory right to claim interest on late payments from a business customer (BTB) under the Act. The statutory interest rate to be applied is the applicable Bank of England Base Rate plus 8%.

Right to Claim Compensation

In addition to claiming statutory interest from a SaaS customer, under the Act SaaS suppliers can claim a fixed amount of compensation. The amount is based upon the amount of the outstanding invoice:

  • £40 – for debts less than £1,000;
  • £70 – for debts between £1,000 to £9,999; and
  • £100 – for debts over £10,000.

Recovery of Costs

Since the 16th of March 2013 SaaS suppliers have the additional right to claim the difference between the fixed compensation amount and their reasonable costs in recovering the debt e.g. the costs of appointing a debt recovery company or lawyer. However this right only applies to debts accrued after the 16th of March 2013.

Limitation to the Right to Claim Statutory Interest

Following the decision in Martrade in June 2014 the High Court disallowed a claim for interest for late payment under the Act on the basis that the parties had no substantial connection to England. Both parties were non-English entities but the contract was governed by English law and provided for arbitration in London.

The restriction imposed by the court is nothing new, it is included in section 12 of the Act, but many SaaS suppliers are unaware of it. Section 12 of the Act only permits the application of statutory interest to late payments if one or both of two further requirements are fulfilled:

  • There must be a significant connection between the contract and England; or
  • the contract must be one which would be governed by English law apart from the choice of law.

The High Court said that the Act did not apply in this case as by simply including a London arbitration or English court jurisdiction clause in the contract was not a connecting factor, as the decision to have disputes heard in London does not connect the substantive transaction itself to England. This therefore prevented the application of the Act and excluded the parties the right to claim penalty interest under the Act.

Implications for International SaaS Agreements

The above decision does not however mean that the application of the Act will be excluded from all international SaaS agreements. The Act and the high interest rate payable under it will apply if there is a substantial connection between the SaaS agreement and England

A substantial connection could for example be:

  • the SaaS supplier or the SaaS customer being an English entity;
  • England being the place of performance of obligations under the SaaS agreement;
  • where the parties carry out some relevant part of the SaaS services in England; or
  • where the SaaS agreement is governed by English law apart from the choice of English law.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Anonymising Data

Many SaaS suppliers use personal data, collected on behalf of SaaS customers, in an anonymised form for their own purposes, for example for benchmarking. The UK Information Commissioner’s Office (ICO) Anonymisation Code and more recently the Article 29 Working Party’s Opinion on Anonymisation provide guidance on how to check that personal data is actually anonymous.

If you are a SaaS supplier using anonymised personal data you should comply with the recommendations in these two guides, to ensure that you are properly anonymising data, otherwise you could be found to be using personal data in breach of the Data Protection Act (DPA).

Personal Data

Any SaaS supplier processing personal data must comply with the Data Protection Act 1998 (DPA). The DPA regulates the disclosure and use of personal data.

Personal data is defined in the DPA as data which relates to a living individual who can be identified from those data. Accordingly, information or a combination of information, that does not relate to and identify a living individual, is not personal data.

Information which is not personal data i.e. anonymised data can be disclosed and used more freely with fewer legal restrictions as the DPA does not apply to it. However, SaaS suppliers should ensure that any personal data they have anonymised and they intend to use, is truly anonymous.

Anonymisation Methods

Most data is anonymised using:

  • randomisation techniques, which alter the veracity of the data in order to remove the strong link between the data and the individual. If the data is sufficiently uncertain then it can no longer be referred to a specific individual; or
  • generalisation techniques, which consist of generalising/diluting the attributes of individuals by modifying the respective scale or order of magnitude (i.e. a region rather than a city, a month rather than a week).

Such methods use the following tools to make data anonymous:

  • noise addition;
  • permutation;
  • differential privacy;
  • aggregation/k-anonymity; and
  • l-diversity/t-closeness.

Risk Assessment

In order to ensure that data is properly anonymised, SaaS Supplier’s should carry out regular risk assessment audits. SaaS suppliers should test their anonymisation and randomisation techniques against the following risks to the re-identification of anonymised data:

  • singling out – is it still possible to isolate some or all records which identify an individual in the data set;
  • linkability – is it still possible to link at least two records concerning the same individual or a group of individuals;
  • inference – can information be inferred concerning an individual from the values of a set of other attributes.

Audits should also assess new risks to re-identification, as over time due to technological developments anonymised data could become re-identifiable in the future.

Pseudonymised Data and Anonymised Data

SaaS suppliers should note that the Article 29 Working Group does not accept that pseudonymised data is equivalent to anonymised data. The reason for this is that pseudonymisation allows:

  • an individual to be singled out; and
  • the individual to be linkable across different data sets.

Summary

Where any uncertainty exists about whether or not re-identification can occur, SaaS suppliers should obtain prior consent from individuals to the use of their anonymised data or they run the risk of breaching the DPA.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles: