Tag: subscription agreement

SaaS Agreements – Terms and Conditions – Data Processing Agreement

UK SaaS suppliers currently have limited obligations to SaaS customers when processing personal data as part of their SaaS services. Under the General Data Protection Regulation (GDPR) many new data processing obligations are imposed on SaaS suppliers. In particular, the obligation for SaaS suppliers to enter into a written data processing agreement with SaaS customers and subcontractors.

GDPR applies to UK SaaS Suppliers despite Brexit

Regardless of when and how Brexit takes place, the GDPR will apply to SaaS suppliers located within the UK if:

  • They offer goods or services to SaaS customers located within the EU (i.e. in any of the remaining 27 EU Member States); or
  • They monitor the behaviour of EU data subjects;

Even though UK SaaS suppliers will no longer be located within the EU themselves after a Brexit.

GDPR applies to non-EU SaaS Suppliers

The GDPR automatically applies to all SaaS suppliers located outside of the EU i.e. in the USA, if:

  • They offer goods or services to SaaS customers located within the EU; or
  • They monitor the behaviour of EU data subjects;

Even though the SaaS supplier is not located within the EU.

Written Data Processing Agreement

Under the GDPR SaaS suppliers and SaaS customers must include detailed data processing obligations in a written data processing agreement. This can form part of the SaaS Agreement or be a separate schedule or agreement.

SaaS Suppliers should be aware that they need to enter into written data processing agreements not just with all SaaS customers, but also with all entities or persons who process personal data on their behalf, such as:

  • All subcontractors i.e. data centres, penetration testing providers;
  • All subsidiaries i.e. providing customer support, software maintenance and support.

Fines for Breach

Data subjects can claim damages directly from SaaS suppliers who breach:

  • Any obligations under the GDPR; or
  • Any lawful instructions of a SaaS customer.

In addition data protection authorities can fine SaaS suppliers or SaaS customers up to 4% of annual global turnover or 20m Euros (whichever is higher) for breaches of the GDPR.

Preparing for Change

To ensure compliance with the new obligations placed on SaaS suppliers (data processors) under the GDPR, SaaS suppliers should taking the following steps:

  • Review existing data protection policies and procedures for compliance with the GDPR;
  • Adapt existing privacy, security and data breach policies to comply with the new rules before the 25th of May 2018;
  • Create a written data processing agreement which reflects the above polices and which is compliant with the GDPR;
  • Review existing SaaS agreements to check limitations on liabilities and indemnities for data protection breaches;
  • Identify any subcontractors and subsidiaries who process personal data;
  • Audit compliance of subcontractors and subsidiaries with new policies and procedures; and
  • Add written data processing agreements to all existing agreements with SaaS customers, subcontractors and subsidiaries.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience in dealing with SaaS, cloud computing and IT law issues. If you require assistance with any SaaS agreements, cloud computing concerns or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – New obligations for SaaS Customers

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change UK data protection law. The GDPR will place further more onerous obligations on SaaS customers (data controllers) in relation to all data processing. SaaS customers need to amend the terms of their existing SaaS agreements and privacy policies and implement the changes into internal policies and procedures in order to comply with the upcoming changes in UK data protection law.

Data Subject Rights

Data subjects will have more extensive rights to access, rectify and object to the storage and processing of their personal data. New rights to delete, restrict processing, rights in relation to profiling and the right to data portability will be introduced. SaaS customers will also be required to provide a lot more information to data subjects about processing activities than in the past i.e. in their privacy policies.

Fines

Data subjects will be able to take direct action against SaaS customers and claim damages resulting from breaches by SaaS customers of their obligations under the GDPR.

In addition data protection authorities will be able to fine SaaS customers up to 4% of annual global turnover for some breaches.

Preparing for the Changes

SaaS customers should review the terms of their existing SaaS agreements and privacy policies to ensure that they comply with the new rules before the GDPR comes into force.

SaaS customers should ensure that existing and future agreements with any subcontractors (data processors) impose the same data processing obligations on further subcontractors (sub-processors), as the SaaS customer could be liable to the data subject for any breaches of the new rules caused by any subcontractors.

SaaS customers should ensure their insurance cover and the terms of their SaaS agreement with all SaaS suppliers include indemnities and limitations on liability relating to personal data that are sufficient to cover the higher level of fines and claims made directly by data subjects.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – New Obligations for SaaS Suppliers

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change existing UK data protection laws. The GDPR will place direct obligations on SaaS suppliers (data processors) in relation to data processing activities. In addition SaaS customers (data controllers) and their clients (data subjects) will be able to enforce breaches of the new rules directly against SaaS suppliers. SaaS suppliers need to amend the terms of their existing SaaS agreements in order to comply with the upcoming changes in data protection law.

Written Data Processing Terms

SaaS suppliers will need to include the following minimum terms in a written data processing agreement with all SaaS customers:

  • The duration, nature and purpose of the data processing;
  • The types of data being processed;
  • The obligations and rights of the SaaS customer.

The written data processing terms must state that:

  • Personal data will only processed in accordance with documented instructions from the SaaS customer;
  • The SaaS supplier will assist the SaaS customer in complying with its own obligations as a data controller;
  • The SaaS supplier is obliged to inform the SaaS customer if it believes an instruction to give personal data to the SaaS customer breaches the GDPR or any other EU or Member State law.

Record Keeping

Unless one of the exceptions applies, the main one being that the SaaS supplier has less than 250 employees, SaaS suppliers must keep records of all categories of processing activities that they carry out.

The following details must be recorded:

  • Information about the SaaS customer and any other data processors;
  • Names of relevant data protection officers (DPOs);
  • The categories of data processing carried out;
  • Any transfers to third countries; and
  • The general technical and organisational security measures used by the SaaS supplier.

If requested by a supervisory authority, SaaS suppliers must provide such records.

Subcontracting

SaaS suppliers will need to obtain prior written consent to the subcontracting of any data processing activities. Although SaaS suppliers can include a general consent to subcontracting in their SaaS agreement, SaaS suppliers will still be obliged to inform SaaS customers before adding or replacing any sub-processors in order to give SaaS customers time to object to a change.

Breach Notification

SaaS suppliers will be required to notify SaaS customers of any breach of their obligations, without undue delay, after becoming aware of the breach.

Data Protection Officers

SaaS suppliers will be obliged to appoint a data protection officer (DPO) in some specific circumstances: for example where the SaaS supplier is processing special data (sensitive data) or if required to do so under a Member State law.

The contact details of any DPO appointed must be published and communicated to the applicable supervisory authority.

Deletion or Return of Data

SaaS suppliers must allow SaaS customers to choose between deletion or return of all personal data on termination or expiry of the SaaS agreement (unless applicable mandatory law requires storage). SaaS customers will be entitled to check compliance with this requirement.

Transfers outside the EEA

Although SaaS suppliers are required to follow a SaaS customer’s instructions with regard to data processing, SaaS suppliers may only transfer personal data outside of the EEA if the SaaS supplier or SaaS customer has provided appropriate safeguards. For example by the use of EU model clauses or Binding Corporate Rules (BCRs).

Fines and Compensation

Data subjects will be able to take action against SaaS suppliers directly and claim damages for the SaaS supplier’s breach of:

  • Any obligations under the GDPR; or
  • Any lawful instructions from the SaaS customer.

SaaS suppliers will be potentially liable to both the SaaS customer and data subjects for the same breach.

In addition data protection authorities will be able to fine SaaS suppliers up to 4% of annual global turnover for some breaches.

Preparing for Changes

SaaS suppliers need to review the terms of their existing SaaS agreements and their internal procedures to ensure that they comply with the new rules on the use of subcontractors, data security requirements, appointment of DPOs and having in place appropriate organisational and technical measures.

SaaS suppliers should ensure that existing and future agreements with their sub-processors impose the same data processing obligations on all subcontractors, as the SaaS supplier will be liable to the SaaS customer and data subjects for any breaches of the new rules caused by any subcontractors.

SaaS suppliers should ensure that their insurance cover and SaaS agreement indemnities and limitations on liability relating to use or personal data are sufficient to cover the higher levels of fines and direct claims for damages by data subjects.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Cyber Insurance

Currently most SaaS suppliers and SaaS customers do not take out specific cyber insurance and rely upon the provisions of a general insurance policy to cover liabilities in the event of a claim for a cyber incident or a data breach. This is partly due to the fact that few insurers offer adequate cyber insurance policies and SaaS customers and SaaS suppliers often fail to consider the need for a specialist policy of insurance to ensure that they are covered in the event of a claim being denied under a general insurance policy.

General Insurance

Many insurers may not have anticipated providing cover against cyber risks under their general insurance policies and it is likely that disputes will arise as to whether or not a cyber claim is covered when a SaaS supplier or SaaS customer makes a claim. Taking out cyber insurance could reduce this risk.

Professional Indemnity Insurance

Commonly PI insurance covers directors insurance, property risk and some limited cyber cover. However as cyber risks are becoming more common for SaaS suppliers and SaaS customers there is an increasing need to specifically protect against cyber risks i.e. hacking, DNS attacks, phishing etc.

Future Need for Cyber Insurance

Cyber insurance is often seen as too expensive by SaaS suppliers and SaaS customers and they actively chose not to purchase such additional insurance cover.

From the 25th of May 2018, when the new Data Protection Regulation (GDPR) comes into effect there will be a substantial increase in the risk of a cyber claim for a data breach. It is important to be aware that the GDPR applies to all SaaS customers and SaaS suppliers in the EU and any non-EU located SaaS customers and SaaS suppliers offering goods or services in the EU or who monitor the behaviour of EU data subjects. Accordingly the GDPR will apply to UK SaaS customers and SaaS suppliers regardless of if, and when, there is a “Brexit”.

GDPR Fines

The GDPR imposes more onerous obligations on both data processors and data controllers. In particular, the fines which can be applied by any EU data protection authority for breach of the GDPR will increase substantially. Fines of up to €20 million or 4% of global annual turnover for the preceding financial year can be imposed.

Summary

SaaS suppliers and SaaS customers need to consider now the need to increase existing insurance cover to encompass the above changes to data protection law, and when doing so, it could be prudent to consider taking out specialist cyber insurance.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Privacy Shield Approved

EU data protection law prohibits SaaS suppliers and SaaS customers from transferring personal data to countries or territories outside the EEA unless they are considered to provide adequate protection. Below is a summary of the current position following the recent announcement that the EU-US Privacy Shield has been adopted by the European Commission and will now replace Safe Harbor.

Safe Harbor

In the past SaaS suppliers and SaaS customers had relied upon Safe Harbor (a self-certification standard) when transferring personal data from the EEA to the USA. But following a legal challenge to the adequacy of Safe Harbor, on the 6th of October 2015 the European Commission declared that Safe Harbor was invalid. This meant that Safe Harbor could no longer be relied upon by SaaS suppliers and customers when transferring personal data from the EEA to the USA.

Current Alternatives to Safe Harbor

Following the invalidation of the Safe Harbor scheme, SaaS suppliers and customers have three options for lawfully transferring personal data from the EEA to the USA:

  • obtain consent from each data subject to the transfer of data to the USA;
  • create and have approved binding corporate rules (“BCRs”) for transatlantic transfers of personal data within a company’s group of companies;
  • enter into EU Model Clauses with US entities to whom personal data was transferred.

EU – US Privacy Shield

A new privacy agreement called the Privacy Shield was agreed between the USA and EU to replace the safe harbour scheme to permit SaaS customers and suppliers to transfer personal data from the EEA to the USA. The Privacy Shield was adopted by the EU Commission on the 12th of July 2016 and will now replace Safe Harbor.

The EU-US Privacy Shield is based upon the safe harbour scheme in an amended format. It still requires entities to self-certify their compliance annually. However there are now additional obligations, such as:

  • displaying a privacy policy on websites;
  • complying with data subject access requests;
  • deleting personal data which is no longer being used for the purposes for which it was originally collected;
  • allowing data subjects to opt out where data is to be disclosed to a third party;
  • providing recourse for breaches to EU data subjects;
  • replying promptly to any complaints.

When can the Privacy Shield be Relied upon

The US Department of Commerce will now start to operate the Privacy Shield. SaaS supplier and SaaS customers wishing to import personal data from the EU need to apply for certification under the Privacy Shield. Before applying SaaS suppliers and customers should review the terms of the Privacy Shield and adjust their internal procedures to comply with the new rules. From the 1st of August 2016 the US Department of Commerce will start to process applications to certify.

EU based SaaS suppliers and SaaS customers should continue to use BCRs, consent or EU Model Clauses when transferring personal data to the USA, until the USA entities to whom personal data is being transferred have obtained certification under the Privacy Shield.

Potential Problems with the Privacy Shield

Although the EU Commission has adopted the Privacy Shield, EU data protection regulators still have the ability to investigate data exports irrespective of this adequacy decision of the European Commission. This means that even if a SaaS customer or SaaS supplier relies upon Privacy Shield certification in due course, the transfer could still be declared invalid by a local data protection authority.

Depending on the physical location of SaaS suppliers and SaaS customers it is worth SaaS suppliers and SaaS customers considering whether they need to keep any existing EU model clauses, binding corporate rules or consents in place in addition to use of the Privacy Shield in order to avoid the risk of a local data protection authority investigating compliance with EU data protection laws.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Disaster Recovery

Should SaaS suppliers include disaster recovery provisions in a SaaS agreement? If so, what provisions should be included in the SaaS agreement and where.

Disaster Recovery

Disaster recovery sets out the processes and procedures to be followed by a SaaS supplier in the event of its SaaS software and subsequently a SaaS customer’s  data not being accessible. The disaster usually results from a problem with the technology infrastructure on which the SaaS software is being made available, i.e. the SaaS supplier’s data centre or telecommunications provider.

Disasters

The most common disasters are:

  • power failure at the data centre;
  • physical damage at the data centre i.e. flood or fire;
  • physical damage to SaaS customer data i.e. loss, corruption or deletion;
  • insolvency of the data centre or third party telecommunications provider;
  • theft of hardware on which the SaaS software operates.

In any of these circumstances, the disaster usually makes the server on which the SaaS software is running unavailable to the SaaS customer.  As a result, the SaaS customer will not have full access to the software, SaaS services and its data. Where a SaaS customer is operating a live website, the website will cease to function correctly, or possibly at all.

Disaster Recovery Provisions

The following disaster recovery provisions should be set out in the SLA which forms part of the SaaS agreement:

  • the right of a SaaS customer to be informed of the disaster;
  • the obligation of the SaaS supplier to keep the SaaS customer informed of steps being taken to rectify the disaster;
  • the estimated time for restoring servers and SaaS customer data;
  • the right for the SaaS customer to terminate or be given a copy of SaaS customer data in the event of a disaster;
  • details of the SaaS supplier’s testing procedures i.e. how often its disaster recovery processes are tested.

Costs

The extent and speed of the disaster recovery offered by a SaaS supplier will depend upon the level of fees charged for the SaaS services. SaaS suppliers often include the costs of basic disaster recovery within their licence fees. In addition, or as an alternative, they may offer higher levels of disaster recovery for payment of additional fees. The faster and more individual the disaster recovery process is, the higher the fees will be.

Alternatives

If a SaaS supplier does not provide any disaster recovery services, or a SaaS customer is not satisfied with the disaster recovery offered, it should consider setting up its own disaster recovery procedure with a third party, particularly if a disaster would be business critical i.e. for a SaaS customer providing online banking services.

Some companies such as the NCC and Iron Mountain offer third party disaster recovery services to SaaS customers directly, whereby they  take over hosting of the SaaS services to ensure continuity of services for the SaaS customer.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience in dealing with SaaS, cloud computing and IT law issues. If you require assistance with any SaaS agreements, cloud computing concerns or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

_________________________________________________

Other related articles:

SaaS Agreements – Terms and Conditions – Limitation Clauses

SaaS suppliers should always include limitation clauses in their the SaaS terms and conditions to attempt to limit or exclude liability for certain types of losses and to cap their financial liability for breaches of contract. However, in order for limitation clauses to be valid, SaaS suppliers must ensure that the wording of the limitation clause is clear and unambiguous, otherwise the whole clause could be ruled void by a court and the SaaS supplier’s liability will then be unlimited.

Dundee City Council v Geddes

In Geddes, a Scottish case, a construction contract contained a limitation clause which attempted to limit the contractor’s liability to a local council for a failure to supply goods of satisfactory quality or reasonably fit for their purpose. The clause stated that a claim for breach must be made in writing within 24 hours of delivery unless there were “special circumstances” to justify delay.

Interpretation by the Court

The court decided that it could be argued in virtually every case that “special circumstances” would apply so the scope of the limitation was uncertain. Accordingly, the court held that the entire clause was invalid for uncertainty. This resulted in the contractor being liable to the council for its failure to supply goods of satisfactory quality or reasonably fit for the purpose.

Court Powers

SaaS suppliers should be aware that if a limitation clause in their SaaS terms and conditions is disputed, in assessing the validity of a limitation clause a court may:

  • simply delete the part of the clause excluding liability and leave the remainder standing;
  • declare the whole clause invalid; or
  • insert wording to amend the clause.

As a court can take any of these options, limitation clauses should be drafted to try to reduce the risk that none of the intended exclusions or restrictions will be valid in the event of a dispute.

Summary

SaaS suppliers should ensure that the language they use in limitation clauses:

  • is not ambiguous;
  • does not contain different types of exclusions in one single clause i.e. financial caps and restrictions on the types of losses that can be claimed should be separated.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – Reseller Agreements

SaaS suppliers who decide to use a local partner to resell their SaaS software to customers outside of the countries in which they are based, will need to have a reseller/distributor agreement in place between themselves and each SaaS reseller/distributor.

What is a SaaS Reseller/Distributor?

A SaaS reseller is the same as a SaaS distributor. A reseller/distributor purchases the supplier’s SaaS software and services under the terms of a reseller/distribution agreement. The SaaS reseller/distributor then resells the SaaS software and services to its own local customers in its local territory using its own terms and conditions (and SLA).

The SaaS supplier has no legal relationship with the SaaS reseller/distributor’s customers. Customers enter into a SaaS agreement with the reseller/distributor directly.

Reasons for Using a Reseller/Distributor                                          

SaaS suppliers use resellers to facilitate sales of their SaaS software and services to customers who would not otherwise be able to purchase the SaaS software, due to the Supplier’s:

  • lack of physical presence in the customer’s country
  • lack of sales channels and contacts in the customer’s country
  • inability to speak the local language
  • inability to provide customer support in the local language
  • inability to provide customer support within the customer’s local business hours
  • terms and conditions not being written in the customer’s language, or subject to local laws and regulations

By using a SaaS reseller/distributor the above problems are resolved as the SaaS reseller sells the SaaS software directly to customers, in the local language, pursuant to local law, with local support as if the SaaS software was his own software.

Advantages

The main advantage of using a SaaS reseller is that the SaaS supplier will have no liability to customers – as there is no contract or legal relationship between the customer and the SaaS supplier. For example, any implementation issues or software errors that the customer encounters when using the SaaS software will be the SaaS reseller’s problem. The distributor will be liable to the customer and will be obliged to resolve such issues directly with the customer.

Disadvantages

The main disadvantage of using a SaaS reseller is that the SaaS supplier has no control over the sales process and in particular of the choice of customers. Also, the terms of the reseller agreement itself will be subject to local anti-competitive laws and regulations.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

 

SaaS Agreements – Data Protection – General Data Protection Regulation (GDPR)

The General Data Protection Regulation (“GDPR”) will replace the existing EU Data Protection Directive and harmonise European data protection law from the 25th of May 2018. In the UK the GDPR will replace the Data Protection Act 1998 from the 25th of May 2018. This will have a significant effect on both SaaS suppliers and SaaS customers who will need to comply with the terms of the GDPR.

Harmonisation

SaaS suppliers and SaaS customers should be aware that the GDPR will not fully harmonise data protection law throughout Europe, as each EU country may introduce their own requirements in certain instances. However, SaaS suppliers and SaaS customers will need to start making organisational changes now to their data processing activities in order to comply with the new rules on consent, audit rights, data exports, increased administrative requirements and the new obligations of data processors.

Below is a summary of the main provisions of the GDPR that SaaS suppliers and customers need to be aware of.

New Data Processor Obligations

The GDPR applies to data controllers (SaaS customers) and data processors (SaaS suppliers) and in particular SaaS suppliers should be aware that some of the GDPR applies directly to data processors who will be subject to compliance obligations and sanctions for non-compliance.

Consent

SaaS suppliers and SaaS customers relying on consent to process personal data will need to show that the consent is:

  • freely given;
  • specific and informed; and
  • an “unambiguous indication” of a data subject’s wishes and expressed either by a statement or a clear affirmative action (i.e. ticking a consent box when visiting a website).

Consent must be purpose limited i.e. related to explicitly specified purposes.

The default age for giving valid consent and using online services is 16, however each EU country will be able to reduce this to 13.

Penalties

The maximum penalty for a breach of the GDPR will be substantially higher than under current legislation. Fines can be imposed on SaaS suppliers or SaaS customers. Fines of up to 4% of annual global turnover or up to 20m Euros (whichever is higher) can be applied.

Applicable to Non-EU Entities

The GDPR will apply not just to EU SaaS customers and suppliers but also to non-EU SaaS customers and suppliers who:

  • offer goods or services to data subjects in the EU; or
  • monitor the behaviour of EU citizens to the extent that the behaviour takes place in the EU.

Enforcement – One Stop Shop

SaaS suppliers and SaaS customers will be regulated by a single regulator in the place of their main establishment, which shall be their main administrative location in the EU. Data subjects will be able to make complaints to regulators in their own EU country.

Data Protection Officer

An independent data protection officer (“DPO”) must be appointed where an organisation’s core business involves processing personal data involving regular and systematic monitoring of data subjects or large amounts of sensitive personal data. Each EU country may enact national provisions imposing further requirements regarding the appointment of DPOs. This will be particularly relevant in Germany where this is already a legal requirement.

Notification

There is no requirement for a SaaS supplier or SaaS customer to notify local data protection authorities of any data processing activities but there is a requirement to keep records of data processing activities (subject to limited exceptions).

Breach Reporting

SaaS customers and SaaS suppliers must report breaches to the relevant local regulator without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Data subjects must be informed of breaches without undue delay where the breach is likely to result in a high risk to the data subject’s rights and freedoms unless:

  • the data has been rendered unintelligible to any third party (for example by encryption);
  • the data controller has taken steps to ensure the high risk is unlikely to materialise; or
  • it would involve disproportionate effort to inform data subjects individually, in which case a public announcement can be made.

Data processors (SaaS suppliers) are required to inform data controllers (SaaS customers) of any breach without undue delay.

Impact Assessments

SaaS customers will be required to carry out data protection impact assessments (“DPIAs”) if their proposed activities are likely to result in a high risk for the rights and freedoms of individuals, in particular, through the use of new technologies and in cases of profiling.

Data Subject Rights

The following rights shall be granted to data subjects:

  • data portability;
  • the right to be forgotten;
  • the right to prevent profiling;
  • the right to object to processing;
  • the right to rectification and erasure.
  • subject access requests (“SARs”).

SARs must be responded to by the data controller (SaaS customer) without undue delay and, at the latest, within one month of receipt of the request. The data controller only has the right to charge a reasonable fee to cover administrative costs where the requests are “manifestly unfounded or excessive”.

Preparing for Change

Although the GDPR will not come into force until the 25th of May 2018, it is essential that SaaS customers and SaaS suppliers start to prepare for the changes now. For example, by appointing a data protection officer (where appropriate), devising a documentation system for recording data processing activities, reviewing how consent is obtained from data subjects, adding written data processing agreements to existing SaaS agreements and future SaaS agreements with relevant customers and amending existing privacy policies to comply with the GDPR rules.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – EU US Privacy Shield

The GDPR prohibits SaaS suppliers and SaaS customers from transferring personal data to countries or territories outside the EEA unless they are considered to provide adequate protection. Below is a summary of the current position under the EU-US Privacy Shield which has replaced the safe harbor scheme.

Safe Harbor

Until the 6th of October 2015, SaaS suppliers and SaaS customers relied upon Safe Harbor (a self-certification standard operated by the US Department of Commerce and enforced by the Federal Trade Commission) when transferring personal data to the USA.

Grace Period

Following the invalidation of safe harbor, the Art. 29 Working Party, which is comprised of European Data Protection regulators, (the “Working Party” now known as the EBDP) made clear that no actions would be taken against SaaS suppliers or SaaS customers relying upon on safe harbor until the end of January 2016. This grace period was agreed to allow the Working Party, EU countries and the European Commission time to find a suitable political, legal and technical solution to the problem of transferring personal data from EU countries to the United States in compliance with EU data protection laws.

Interim Enforcements

However, national data protection authorities retain the right to exercise their  powers to protect a data subjects’ rights upon receipt of individual complaints against SaaS suppliers or customers. For example, the German Federal and State Data Protection Commissioners (“the Commissioners”) stated that there would be no grace period and that they would immediately take action against data transfers which were based on Safe Harbor, unlike the UK Information Commissioner’s Office (“ICO”) which made it clear that SaaS suppliers and customers would be given time to adapt.

Interim Options

Accordingly, SaaS suppliers and customers had three options for continuing to lawfully transfer personal data from the EU to the USA:

  • obtain consent from each data subject to the transfer of data to the USA;
  • create and have approved binding corporate rules (“BCRs”) for transatlantic transfers of personal data within a company’s group of companies;
  • enter into EU Model Clauses with US entities to whom personal data was transferred.

Privacy Shield

The grace period has now expired and a new privacy agreement called the Privacy Shield has been agreed by the US and EU to replace the safe harbour scheme. The Privacy Shield is based upon safe harbour but has additional protections, particularly with regard to public authority access to personal data. The Privacy Shield must now be reviewed by the European Commission before it can be relied upon and adopted by SaaS suppliers or customers. The European Commission is currently assessing whether or not the Privacy Shield provides adequate protection in accordance with EU data protection laws. This process is expected to take up to 3 months.

Current Position

The Working Party has confirmed that for the time being EU Model Clauses and BCRs are valid for transfers of personal data from the EU to the USA. Accordingly, Saas suppliers and SaaS customers should continue to us BCRs, consent or EU Model Clauses when transferring personal data to the USA and whilst monitoring the status of the Privacy Shield with their local data protection authorities.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles: