software on demand – Page 9

SaaS Agreements – Data Protection – New Proposed EU Rules – Part 1

02/03/2012 Irene Bodle

On the 25^th of January 2012 the European Commission published a proposal for a new Data Protection Regulation to replace the existing EU Data Protection Directive. The proposal sets out a general data protection framework aimed at unifying the current differing data protection rules in the EU. I have summarised the major changes this will make to EU data protection law in two articles, part 1 of which is set out below and how this will effect SAAS suppliers and customers.

Data Protection Authority

Currently each EU country has its own data protection agency which enforces that country’s law. Processing of personal data by businesses established in more than one EU country will in the future be monitored by one single data processing authority (DPA) – the “lead authority”. Generally the lead authority will be the DPA of the country where the business has its main establishment.

The main establishment of a business will be determined according to objective criteria, such as where the central administration of a business is located i.e. the headquarters where management decisions are usually made. However, individuals located in other EU countries, will still be able to refer privacy complaints to their local supervisory DPA.

One EU-wide Data Protection Law

If the Regulation is adopted, there will be one EU data protection law that SaaS suppliers will need to comply with. The new rules will apply throughout the EU and SaaS suppliers established in more than one EU country will no longer need to cope with the national rules of each relevant EU country. In the long term this means that current local data protection provisions – mainly exemptions that have been introduced by EU countries for national reasons – would disappear.

Non-EU Companies

The new data protection rules will also apply to non-EU based businesses who offer their goods or services to EU customers based in the EU (or who monitor their behaviour). For example a US company with a subsidiary in the EU will be required to comply with the new EU data protection law as well as their own local US laws.

There are exceptions where the data controller (SaaS customer) is established in a country outside the EEA that ensures an adequate level of protection (for example a business registered under the Safe Harbor scheme in the USA), or if the data controller acts for a small or medium sized business or public authority.

Penalties for Breaches

A breach of the new data protection rules could result in a fine of up to €1 million or 2% of the global annual turnover of a company. Fines will be imposed by the DPA. Currently the maximum fine in the UK for a breach of data protection law is £500,000.

Notification

Serious data protection breaches must be notified to both the DPA and data subjects, although it is not clear whether the lead authority or the company itself will be obliged to inform the public of data protection breaches.

Notification should be without undue delay and, where feasible, within 24 hours. Companies will need to have adequate procedures in place to deal with these new requirements and it may be worth considering purchasing obtaining cyber risk insurance.

When will the Rules Change

The draft Regulation must be approved by all EU countries and the European Parliament before it comes into effect, possibly in about 3 years time. The rules will introduce significant and onerous new obligations upon SaaS suppliers and customers, who will need to implement time consuming measures to ensure compliance, in order to avoid the risks of facing substantial fines.

Preparing for Change

Although the proposals could be substantially amended before they are approved, it is advisable that SaaS suppliers and customers start to prepare for the proposed changes. For example, by devising a documentation system for recording data processing activities, reviewing how consent is obtained from data subjects and revising all data processing agreements.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Liability – Online Comments

19/02/2012 Irene Bodle

New proposed UK defamation laws recommend that web hosts (SaaS suppliers) and ISPs (internet service providers) should be allowed to keep allegedly defamatory comments online, as long as the author of the comment is identified and a notice of complaint is published next to the comment.

Current Law and Liability

Currently web hosts and ISPs must immediately remove online comments upon gaining actual knowledge that the comments are defamatory. Failure to remove defamatory comments exposes the web host/ISP to a claim for damages for defamation. Actual knowledge is deemed to occur once the web host/ISP is informed that the comments are defamatory or the web host/ISP moderates comments on the website.

Under the E-Commerce Regulations SaaS suppliers are usually exempt from liability for defamation if they merely act as conduit or cache or host material, provided that they:

do not initiate the transmission of defamatory comments;
do not select who receives the comments; or
do not select or modify information in the transmission of the comments.

New Proposed Rules

Currently most web hosts/ISPs do not moderate comments or content on websites in order to take advantage of the exclusion set out above. Thus they avoid having “actual knowledge” of any defamatory comments on websites that they host.

The proposed change to defamation laws aims to incentivize web hosts and ISPs to moderate comments and/or content. SaaS suppliers should comply with the rules set out below taking into account the new distinction between anonymous and identified author comments.

Anonymous Comments

Upon receipt of a complaint a SaaS supplier should immediately taken down anonymous comments unless;

the SaaS supplier believes that it is in the public interest for the material to remain on the website i.e. whistle blowing; or
the author promptly responds positively to a request to identify themselves, then a notice of complaint should be posted.

Identified Author Comments

Upon receipt of a complaint a SaaS supplier should;

publish a complaint notice beside the comment; and
then have a judge decide whether or not the comment should be removed.

Avoiding Liability

If a SaaS supplier complies with the above rules they should not be liable for online comments. However, if the SaaS supplier fails to comply with the above, they could be sued as publisher of the content or comment along with the anonymous author – who may not be identifiable.

Regardless of whether or not the proposed changes are implemented, SaaS suppliers should always include a clause in their SaaS agreement permitting them to remove content from customer websites they are hosting in order to enable them to minimise the risks of being pursued for a defamation claim.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Software – Copyright Protection

10/02/2012 Irene Bodle

SaaS Software with the same functionality can co-exist without there being an infringement of copyright, following the recent opinion of the Advocate General in SAS Institute and World Programming Ltd. The Advocate General advised that it is the methods used to create the means for the software to carry out its functions, not the functions of the software and the programming language which can be protected by copyright.

What is Copyright?

Copyright is the right to stop others from copying works without permission. Copyright in SaaS software derives from the software being an original literary work. Copyright protects the expressions of ideas in the SaaS software NOT the ideas themselves.

SAS Institute and World Programming Ltd

The High court referred this case to the European Court of Justice (ECJ). World Programming Ltd was accused of infringing copyrights in SAS Institute software as a result of using information contained in the SAS Institute manuals (not the source code) to develop rival software. SAS Institute argued that the functions of its software were copyright protected pursuant to the Computer Programs Directive. This Directive protects copyright in the expression in any form of a computer programme. It does not however cover ideas and principles which underlie any element of a computer programme, including those which underlie a computer programme interfaces.

Are Software Functionalities Protected by Copyright?

The Advocate General ruled that the functionalities of software are simply “the service which the user expects” from the computer programme. For example, when using software to book an airline ticket the functionalities of the booking process will be the same regardless of which company’s software you use. Such services cannot be protected by copyright. However, what can be protected by copyright, is the means by which the functionalities are achieved as this reflects the author’s own intellectual creation. Protection will depend upon the degree of originality in the writing of the software.

This is not the end of the matter, as the ECJ still has to make a ruling on this case. However the ECJ usually follows the opinion of the Advocate General. In which case, the ability of SaaS software suppliers to prevent the functionality of their software being replicated in the future will be limited, if it is not the SaaS software source code that is replicated.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Reseller/Distribution – Terms to Include

20/01/2012 Irene Bodle

When using a local partner to resell your SaaS software to customers outside of the countries in which you are based, you will need to have a distributor/reseller agreement in place between yourself and each distributor/reseller. This will in part mirror your standard SaaS terms and conditions but will also need to include additional clauses to cover the issues set out below.

Applicable Law and Language

Usually your reseller will be located in another country. The reseller will be selling your SaaS software to its customers using its own local terms and conditions. These will probably be subject to local law i.e. German law if the reseller is in Germany and in the local language, German. However, there is no reason why your reseller agreement should be in German and subject to German law, as you the supplier have no relationship with the customers. You should resist any attempt by the reseller to use its local law and language.

As a compromise, it is worth allowing the reseller to have the reseller agreement translated into their local language “for convenience”, in parallel to the English version. However if you have two language versions ensure that the English version of the agreement prevails if there are any discrepancies between the two different language versions.

Please note that in some countries it is mandatory under local law to have the agreement in the local language.

IPR

It is essential that you control the use of your name, trademarks and intellectual property rights by your resellers. You should set out clearly in the reseller agreement whether or not the reseller is permitted to register local domain names, company names and trademarks on your behalf for your SaaS application and products. You may require this, as in certain countries you need to be a resident national of that country or have a company located in the country to make such registrations.

If you do grant the reseller such rights, it is essential that you regulate what happens to ownership of the trademarks, domains and use of your name if the reseller agreement is terminated or expires.

Territories

You should identify the territories in which the reseller may resell your SaaS application and products. List country names and do not refer to unclear terms such as EMEA, the Middle East or North Africa – there is no agreed definition of which countries these include. You should also decide whether or not your reseller should have exclusive or non-exclusive rights in the territories. If you grant the reseller exclusive rights ensure that you retain the right to make passive sales to customers, or you will be in breach of EU competition law.

EU and Local Competition Law

Depending upon the country in which you are based and the country in which the SaaS distributor is based, you will need to comply with the various anti-competitive laws that will automatically apply to the reseller agreement. Failure to comply with relevant competition laws could make not just an individual clause in the reseller agreement, but the whole agreement invalid. Additionally you could be subject to very large fines based on a substantial percentage of your annual turnover for breaches of competition law.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Need for an Escrow Agreement

20/12/2011 Irene Bodle

As a SaaS supplier you may want to consider offering escrow agreements to your customers, particularly if you run SaaS applications which are critical to your customer’s business.

What is Escrow

Escrow refers to a third party holding a copy of the SaaS software source code on behalf of the customer and the supplier.

What is an Escrow Agent

An escrow agent is a third party who stores a copy of the SaaS software source code. The escrow agent will release a copy of the source code to the customer if any of the events set out in the escrow agreement occur.

Why use Escrow

This is usually a customer driven requirement resulting from the fact that the source code for the SaaS software, the expertise to implement it and rights to the SaaS software are only licensed to, and not owned by, the customer for the term of the SaaS agreement.

Customers are concerned that the supplier may:

fail to maintain the software;
transfer ownership of intellectual property rights in the SaaS software;
become insolvent; or
become unable to carry on supporting and maintaining the software for some other reason.

By having an escrow agreement in place the customer has the right to continue to use the software, if the supplier is in default of its obligations under the SaaS agreement.

Advantages of an Escrow Agreement

Having an escrow agreement in place protects all parties involved in the development, supply and use of business critical SaaS applications. It provides customers with peace of mind for securing long-term availability of a critical SaaS application by enabling customers to update software and fix any bugs even if the supplier is no longer able to support them.

Disadvantages of an Escrow Agreement

Having the right to use the software under an escrow agreement is in reality of little use if the customer does not have the know-how and resources to actually use, maintain and support the source code itself.

Also, the costs of setting up an escrow agreement and maintaining it are relatively expensive. Escrow costs are usually paid for by the customer.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Reseller/Distribution – Need for a Reseller Agreement

06/12/2011 Irene Bodle

If you decide to use a local partner to resell your SaaS software to customers outside of the countries in which you are based, you will need to have a distribution/reseller agreement in place between yourself and each distributor/reseller.

What is a Reseller/Distributor?

A reseller is the same as a distributor. A reseller/distributor purchases the supplier’s SaaS software and services under the terms of a reseller/distribution agreement. The reseller/distributor then resells the SaaS software and services to its own local customers in the territory using its own terms and conditions (and SLA). The SaaS supplier has no legal relationship with the reseller/distributor’s customers. Customers enter into a SaaS agreement with the reseller/distributor directly.

Why use a Reseller/Distributor?

Most SaaS suppliers use distributors to enable them to sell their software and services to SaaS customers who would not otherwise purchase the SaaS software, due to the Supplier’s:

Lack of physical presence in the SaaS customer’s country;
Lack of sales channels and contacts in the SaaS customer’s country;
Inability to speak the local language;
Inability to provide SaaS customer support in the local language;
Inability to provide customer support within the SaaS customer’s local business hours;
Terms and conditions not being written in the SaaS customer’s language, or subject to local laws and regulations.

By using a distributor/reseller the above problems are resolved as the distributor/reseller sells the SaaS software directly to SaaS customers, in the local language, pursuant to local law, with local support as if the SaaS software was his own software.

Advantages

The main advantage of using a reseller/distributor is that the SaaS supplier will have no liability to SaaS customers – as there is no contract or legal relationship between the SaaS customer and the SaaS supplier. For example, any implementation issues or software errors that the SaaS customer encounters when using the SaaS software will be the reseller’s problem. The reseller will be liable to the SaaS customer and will be obliged to resolve such issues directly with the SaaS customer.

Disadvantages

The main disadvantage of using a reseller/distributor is that the SaaS supplier has no control over the sales process and in particular of the choice of SaaS customers. Also, the terms of the SaaS agreement itself will be subject to local anti-competitive laws and regulations.

Is an Agent the same as a Distributor?

Agents are often confused with distributors, but there are clear legal differences. An agent is a person or company who acts on behalf of the SaaS supplier to find leads and/or assist with sales of the supplier’s SaaS software to local SaaS customers in the agent’s territory.

An agent has no legal relationship with the SaaS customer as the agent has no contract with the SaaS customer. The SaaS supplier enters into a SaaS agreement, with the SaaS customer using the SaaS supplier’s own terms and conditions and SLA. The SaaS supplier is liable to the SaaS customers for issues and errors that may arise during use of the SaaS software.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements and cloud computing with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SLA – Security Issues

25/10/2011 Irene Bodle

As a SaaS supplier you will have noticed the increasing concerns about security voiced by SaaS customers. Your SaaS agreement should therefore provide comfort to your customer by including security provisions in the service level agreement (SLA). The specific matters you should consider including are set out below.

Access

The persons able to access the hosting centre should be very limited and the individuals should be defined. Access should only be allowed for hardware and software maintenance. A record of all visits should be logged, which can be easily achieved if swipe cards are used. Remember that when using a third party hosting centre, access will be controlled by, and should reflect, the terms of your hosting agreement with the hosting centre.

Physical Security

This should prevent unauthorised access to the hosting centre to prevent damage, loss or theft to hardware and software. Surveillance of the hosting centre is essential and details of whether or not this is 24 x 7, via video camera, watchmen or electronic alarm systems should be included in the SLA. Within the hosting centre itself, racks themselves should be separately secured.

Hosting Environment Security

In order to provide a continuous service to customers, the hosting centre must have:

an uninterrupted power supply;
a dual power source;
air conditioning; and
fire and flood detection systems.

Server Security

In order to protect your servers, you should use:

up to date virus protection;
up to date security patches; and
firewalls.

Data Security

In order to protect customer data you should set out:

how, where and when data will be backed up;
how often data will be backed up;
where backups will be stored; and
when discs/tapes will be rotated.

ISO 27001 Certification

ISO 27001 is an internationally recognised security certification which is often required by SaaS customers who are looking for assurance that adequate levels of data security are in place to protect their data. Having this certification demonstrates to customers your commitment to data security by confirming that you comply with “best practice” security management.

Disaster Recovery

Is this offered at all, consider whether is it included in your standard subscription fee, or if a premium will be charged. Also, remember that your disaster recovery centre should be physically remote from your hosting centre, and with a different provider.

Commercial Considerations

The level of security obligations offered to SaaS customers will depend upon:

how much a customer pays for the SaaS solution, maintenance and support;
whether the SaaS application is business critical i.e. online banking;
what is standard in that particular business area.

Exclusions

Ensure that your SaaS agreement contains appropriate security obligations applicable to your customer, for example using up to date virus programmes. Exclude liability for any security breaches which are caused by something beyond your control or an act, omission or breach of your customer’s security obligations under the SaaS agreement.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Entire Agreement Clauses

26/09/2011 Irene Bodle

In the recent Court of Appeal decision Axa Sun Life Services Plc v Campbell Martin Ltd an entire agreement clause did not exclude liability for pre-contractual misrepresentations although the clause was reasonable under the Unfair Contract Terms Act (UCTA).

What is an Entire Agreement Clause?

An entire agreement clause asserts that the SaaS agreement constitutes the whole agreement between the parties and seeks to prevent the parties from relying on any preceding agreements, negotiations or discussions in any subsequent claims.

Entire agreement clauses form part of the standard provisions of many SaaS agreements, and are frequently used by SaaS suppliers to argue that a customer cannot rely upon pre-contractual misrepresentations. (e.g. verbal promises, product claims, or previous agreements).

Unfair Contract Terms Act (UCTA)

The validity of an entire agreement clause in a SaaS agreement will be determined by a court by applying UCTA. In the AXA case as the agreement was based on AXA’s standard terms of business, UCTA states that a party contracting on its standard terms cannot exclude or restrict liability in respect of its breach unless the clause is reasonable.

Axa Sun Life Services Plc v Campbell Martin Ltd

AXA standard terms contained the following entire agreement clause:

“This Agreement…constitute[s] the entire agreement and understanding between you and us in relation to the subject matter thereof…[and] shall supersede any prior promises, agreements, representations, undertakings or implications where made orally or in writing”

The Court of Appeal held that this entire agreement clause did not exclude AXA’s liability for pre-contractual misrepresentations, even though it was reasonable under UCTA.

Excluding Liability for Pre-Contractual Misrepresentation

It is essential that clear wording is used to exclude liability for misrepresentation. It is not enough to simply state that the agreement “supersedes” any previous representations. The entire agreement clause of your SaaS agreement should state that you have no liability in respect of errors or misleading information that may have been communicated by one party to another and liability for misrepresentation must be specifically excluded.

However, note that under English law liability for fraudulent misrepresentation cannot be excluded or limited.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – E-Discovery

09/09/2011 Irene Bodle

As a SaaS supplier you may be ordered by a court as part of a litigation process to identify and disclose physical documents and electronically stored information (e-discovery). This creates problems for SaaS suppliers on a number of levels.

Location of the ESI

Data is often stored or replicated in an external hosting centre, the SaaS software application itself or a corporate data centre. If numerous data centres are used they are usually in different physical locations and in various countries. Discovery rules may conflict with compliance and privacy requirements in the countries where the data is held, however for the purposes of complying with your obligations under a country’s e-discovery rules the actual location of the data is irrelevant.

For example in AccessData Corporation v ALSTE Technologies GmbH a US court ordered a German company to disclose emails stored in Germany as part of the disclosure process in a court case, although the company argued that this breached the German Data Protection Act.

Compliance Issues

SaaS agreements should therefore permit SaaS suppliers and customers to comply with e-discovery requests, to avoid breaches of requests for disclosure. Although it is unlikely that any sanctions will be taken by the court against the SaaS supplier, the customer may try to claim damages for any losses it sustains. The SaaS supplier should therefore ensure that they exclude liability under the SaaS agreement for a technical or any other type of failure to comply with a disclosure request.

Help

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: