Tag: sub-contractor

SaaS Agreements – Data Protection – EU US Privacy Shield

The GDPR prohibits SaaS suppliers and SaaS customers from transferring personal data to countries or territories outside the EEA unless they are considered to provide adequate protection. Below is a summary of the current position under the EU-US Privacy Shield which has replaced the safe harbor scheme.

Safe Harbor

Until the 6th of October 2015, SaaS suppliers and SaaS customers relied upon Safe Harbor (a self-certification standard operated by the US Department of Commerce and enforced by the Federal Trade Commission) when transferring personal data to the USA.

Grace Period

Following the invalidation of safe harbor, the Art. 29 Working Party, which is comprised of European Data Protection regulators, (the “Working Party” now known as the EBDP) made clear that no actions would be taken against SaaS suppliers or SaaS customers relying upon on safe harbor until the end of January 2016. This grace period was agreed to allow the Working Party, EU countries and the European Commission time to find a suitable political, legal and technical solution to the problem of transferring personal data from EU countries to the United States in compliance with EU data protection laws.

Interim Enforcements

However, national data protection authorities retain the right to exercise their  powers to protect a data subjects’ rights upon receipt of individual complaints against SaaS suppliers or customers. For example, the German Federal and State Data Protection Commissioners (“the Commissioners”) stated that there would be no grace period and that they would immediately take action against data transfers which were based on Safe Harbor, unlike the UK Information Commissioner’s Office (“ICO”) which made it clear that SaaS suppliers and customers would be given time to adapt.

Interim Options

Accordingly, SaaS suppliers and customers had three options for continuing to lawfully transfer personal data from the EU to the USA:

  • obtain consent from each data subject to the transfer of data to the USA;
  • create and have approved binding corporate rules (“BCRs”) for transatlantic transfers of personal data within a company’s group of companies;
  • enter into EU Model Clauses with US entities to whom personal data was transferred.

Privacy Shield

The grace period has now expired and a new privacy agreement called the Privacy Shield has been agreed by the US and EU to replace the safe harbour scheme. The Privacy Shield is based upon safe harbour but has additional protections, particularly with regard to public authority access to personal data. The Privacy Shield must now be reviewed by the European Commission before it can be relied upon and adopted by SaaS suppliers or customers. The European Commission is currently assessing whether or not the Privacy Shield provides adequate protection in accordance with EU data protection laws. This process is expected to take up to 3 months.

Current Position

The Working Party has confirmed that for the time being EU Model Clauses and BCRs are valid for transfers of personal data from the EU to the USA. Accordingly, Saas suppliers and SaaS customers should continue to us BCRs, consent or EU Model Clauses when transferring personal data to the USA and whilst monitoring the status of the Privacy Shield with their local data protection authorities.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Terms and Conditions – Safe Harbor Adequacy

European data protection authorities have recently raised serious reservations about the effectiveness of the safe harbor scheme and its ability to adequately protect SaaS customer data to the same standard as European data protection laws. If you are a SaaS supplier and are considering/or are already using a company located in the US to provide part of your SaaS services i.e. for hosting, you should be aware of the existence and limitations of the safe harbor scheme.

What is Safe Harbor

Safe Harbor allows an EU based SaaS supplier to lawfully transfer SaaS customer data concerning EU individuals to a sub-contractor located in the USA (usually a data centre), provided that the US sub-contractor has signed up to the principles of the safe harbor scheme.

Safe Harbor Registration

Safe harbor is a voluntary scheme and no company located in the USA is obliged to register. Companies chose to sign up to the safe harbor scheme by notifying the U.S. Department of Commerce that:

  • they have committed to comply with the safe harbor principles in their privacy statement; and
  • they agree to self-certify annually (to the Department of Commerce) that they comply with the principles.

EU Concerns

In light of recent Prism revelations, national EU data protection authorities have voiced growing concerns about the adequacy of the safe harbor scheme. On the 27th of November 2013, the EU Commission published its own concerns about the scheme. The Commission made the following 13 recommendations which should apply to all safe harbor registered companies:

Transparency

Companies should:

  • publicly disclose their privacy policies;
  • always include a link to the Department of Commerce Safe Harbour website in their privacy policy;
  • publish the privacy conditions of any contracts concluded with sub-contractors, e.g. cloud computing services;
  • clearly flag on the Department of Commerce website all of their group companies which are not members of the scheme.

Redress

  • privacy policies should include a link to the alternative dispute resolution (ADR) provider named;
  • ADR should be readily available and affordable;
  • the Department of Commerce should monitor ADR providers more systematically.

Enforcement

  • following certification/recertification, a certain percentage of companies should be investigated for compliance with their privacy policies;
  • if found to be non-compliant, the company should be subject to a follow-up investigation after 1 year;
  • the competent EU data protection authority should be informed of doubts about a company’s compliance or any pending complaints;
  • false claims of safe harbor adherence should be investigated.

Access by US Authorities

  • privacy policies should include information on the extent to which US law allows public authorities to collect and process data transferred under the safe harbor scheme. In particular indicating when exceptions apply i.e. to meet national security, public interest or law enforcement requirements.
  • the national security exception should only be used to the extent that it is strictly necessary or proportionate.

Summary

In light of the above and rising SaaS customer awareness of the limitations of safe harbor, if you are a SaaS provider using a sub-contractor based in the US you should be including additional provisions in the terms of your SaaS agreement to cover the above concerns. You should ensure that you are granted the right to check your sub-contractors actual compliance with its safe harbor obligations, for example: by adding the right to audit compliance with the provisions of its privacy statement.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Further Fines by Data Commissioner

On the 8th of February 2011 Ealing and Hounslow Councils were fined £80,000 and £70,000 respectively by the Data Commissioner for serious breaches of the Data Protection Act (DPA) following the theft of two laptops from the house of an employee of Ealing Council.

Data Protection Act 1998

The Data Commissioner has the power to impose a fine of up to £500,000 on a data controller who seriously breaches the DPA, if the contravention was of a kind likely to cause substantial damage or substantial distress. The contravention must either have been deliberate or the data controller must have known or ought to have known that there was a risk that a contravention would occur and failed to take reasonable steps to prevent it.

Ealing and Hounslow County Council Cases

Ealing Council operated an out-of-office service on behalf of both councils using nine staff working from home with laptops. As part of the service information about individuals  including names, dates of birth, gender, ethnicity, addresses and telephone numbers were stored on the laptops. Following the theft of two laptops the personal data of approximately 1,000 clients of Ealing Council and 700 clients of Hounslow Council was potentially compromised.

Reason for the Fines

According to the ICO, Ealing Council breached the Seventh Data Protection Principle of the 1998 UK Data Protection Act, as it issued unencrypted laptops, and had insufficient processes in place to check that the relevant policies were being followed or understood by staff. Hounslow Council was found to have breached the Act for failing to have a written contract in place with Ealing Council.

The fines were imposed even though to date there is no evidence that any data on the computers has been accessed and no complaints have been received by the data controller from clients.

How to Avoid Fines

If the Council had taken the simple step of encrypting the data (in accordance with its own policies), thousands of people’s privacy would not have been potentially compromised.

In view of the above, it is imperative that you take reasonable steps to avoid data protection breaches to limit your exposure to having such fines imposed. The following basic precautions should be taken:

  • ensure that all laptops, memory sticks and backup tapes are encrypted;
  • have appropriate data protection policies and procedures in place;
  • carry out due diligence on your security procedures and those of your sub-contractors and third parties;
  • audit compliance with your  security procedures of sub-contractors and third parties regularly.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: