Tag: subscription agreement

SaaS Agreements – Data Protection – Direct Marketing Rules

In September 2013 the Information Commissioner’s Office (ICO) published a lengthy guide to Direct Marketing. The guide covers compliance with the Data Protection Act 1998 (DPA) and the Privacy and Electronic Communications Regulations 2003 (PECR) in relation to the sending of unsolicited marketing. SaaS suppliers who are sending unsolicited marketing to SaaS customers and prospective customers should check their compliance with the guidance. Additionally, the Direct Marketing Association (DMA) has also published its own further supplemental guide which provides detailed guidance on how and when to obtain consent to marketing from individuals.

Marketing and the DPA

The DPA applies to marketing where a SaaS supplier is using personal data. For example: if a SaaS supplier is sending marketing emails to a named person i.e. peter.smith@microsoft.com. When sends marketing emails to a named person a SaaS supplier must comply with the 8 data protection principles. In particular, the SaaS supplier must give the individual the right to object to any direct marketing (in writing).

Marketing and the PECR

The PECR complements the DPA. It sets out more detailed rules on electronic marketing i.e. email, text messages, fax and telephone calls.  Unlike the DPA, the rules apply even if the SaaS supplier does not know the name of the person it is contacting i.e. admin@microsoft.com.

The rules under the PECR also vary depending on whether the marketing is sent to a consumer (B2C) or to a business (B2B).

Obtaining Consent

Both the DPA and the PECR require that the recipient consents to being sent direct marketing. Such consent must be informed and must be freely and specifically given. Consent is only valid if:

  • it is not a condition to subscribing to a service or completing a transaction;
  • the information given is clear, prominent and not difficult to find (so that individuals understand what they are consenting to);
  • it is relevant to the type of marketing being sent; and
  • there is a positive indication of the recipient’s agreement to receive direct marketing.

This means as a general rule that pre-ticked “opt-in” boxes should not be used to obtain consent.

Marketing Emails and Texts

Where marketing messages are sent by email or text additional rules apply. Consent must be:

  • notified; and
  • specific to the type of communication.

No express consent is required where:

  • a recipient’s details are obtained in the course of a sale (or negotiation of a sale) of a product or service of the SaaS supplier to that individual;
  • the SaaS supplier is only marketing their own similar products or services; and
  • the recipient had the option to refuse or “opt-out” of the marketing at the time their details were collected, and in every subsequent email.

In order to demonstrate compliance with the rules on consent, SaaS suppliers should keep clear records of:

  • what, when and how consent was collected;
  • who gave the consent; and
  • the information provided to the individual about the consent being given.

Marketing Calls

In the UK SaaS suppliers must not make unsolicited marketing calls to numbers registered with:

  • the Telephone Preference Service (TPS) in relation to individual B2C subscribers; or
  • the Corporate Telephone Preference Service (CTPS) in relation to B2B subscribers.

Automated marketing calls can only be made to individuals who have specifically consented to receiving such calls.

Fines for Breach

Breaches of the DPA or PECR can result in a SaaS supplier receiving an enforcement notice from the ICO requiring remedial steps to be taken. Failure to comply with such a notice is a criminal offence.  In addition, the ICO can also impose a fine of up to £500,000 for serious breaches.

Summary

The above is a general summary of the complicated rules applicable to direct marketing. Before launching any direct marketing campaign, specific legal advice should be taken, in order to check full compliance with the above laws and rules to reduce the risks of substantial fines being imposed for breaches.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Russian Data Centres

SaaS Suppliers who will be processing personal data of Russian citizens on behalf of SaaS customers need to be aware of amendments to the Russian Federal Law on Personal Data. From the 1st of September 2015 changes to this Russian law may prohibit foreign SaaS suppliers from processing personal data of Russian citizens on servers located outside of Russia.

Restrictions

The amended law will apply to all ‘data operators’. A data operator combines the duties of a SaaS customer (data controller) and a SaaS supplier (data processor) so the law will apply to both SaaS customers and SaaS suppliers. Under the amended law it will be illegal for a data operator to collect personal data of Russian citizens and send it directly to servers located outside of Russia without using a database installed on a server located in Russia. This means that SaaS suppliers will need to ensure that personal data of their SaaS customers is stored in databases on servers located within Russia i.e. in a Russian data centre.

Export of Data outside of Russia

No explicit restriction on the transfer of personal data outside of Russia is contained in the amendment to the law. The amendment simply says that personal data must be stored in Russia.

It is therefore currently unclear whether the processing of personal data of Russian citizens should only take place in Russia or whether under existing laws personal data can be transferred outside of Russia if the following conditions are met:

  • the prior written consent of the data subject is obtained; and
  • the transfer is to one of the 46 countries which is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data Personal Data.

In March 2015, the Russian Internet Ombudsman proposed that foreign online companies be allowed to continue to store personal data of Russian citizens in a third country, if they complied with the above. However, as a number of multinational online companies such as Google are setting up servers in Russia, it seems unlikely that this exception will continue after September 2015.

Personal Data

Unlike EU data protection laws, the amendment to the Russian law does not provide clarification of the personal data to which it applies. For example the amendment to the law says nothing about whether:

  • the new rules will apply to personal data already collected from Russian citizens i.e. collected before the amendment comes into force on the 1st of September 2015;
  • the new rules apply to personal data of Russian citizens who are not resident in Russia; and
  • or not IP addresses are personal data.

Penalties

Roscomnadzor (the Russian entity responsible for monitoring compliance) will be able to block access to websites in the territory of Russia that breach the new rules. In addition fines can be imposed, although these will generally only be in the region of 150 GBP for each breach. However, the Russian Parliament is currently considering legislation to increase the level of fines and to introduce new categories of personal data breaches.

Summary

In light of the above, SaaS suppliers need to:

  • identify whether or not they have any SaaS customers collecting personal data of Russian citizens;
  • check that SaaS Customers who collect data of Russian citizens have servers physically located in Russia; and/or
  • consider providing hosting services themselves from servers located in Russia, particularly if such personal data is only being processed outside of Russia;
  • check any developments in this area.

Failure to consider the above and take appropriate actions could result in SaaS suppliers facing fines from the local Russian Roscomnadzor for breaches of the amended law.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – International Agreements – Valid Execution

Where an international SaaS agreement is entered into between a non-UK SaaS customer and a non-UK company of a SaaS supplier the parties should ensure that the SaaS agreement has been properly executed in accordance with the law of the country of incorporation of each company. Even where the SaaS agreement is governed by English law, failure to properly authorise or execute the SaaS agreement in accordance with the local law of each party could result in the SaaS agreement not being binding.

Integral Petroleum SA v SCU – Finanz

Two Swiss companies entered into a supply agreement that was governed by English law. The customer sued the supplier for breach of contract in the English courts and lost because the contract was never validly signed by the supplier in accordance with Swiss law requirements. The UK courts determined that the contract was not legally binding.

The Swiss commercial register stated that the supplier could only enter into a binding contract if two representatives of the supplier company signed the contract together. As only one representative signed the contract he had no authority to bind the supplier and the contract was held to not be legally binding. The customer therefore had no claim for breach of contract, as there was no binding contract.

Overseas Companies Regulations 2009

Regulation 4 of the Overseas Companies (Execution of Documents and Registration of Charges) Regulations 2009 sets out the requirements for the execution of documents by overseas companies under English law.

An overseas company will have validly executed a SaaS agreement if:

  • it has done so in a manner provided for in the regulation i.e. the SaaS agreement is signed by a representative acting under the company’s authority, in accordance with the company’s law of incorporation.

Law of Country of Incorporation

In light of the above, the English courts have clarified that where two non-UK SaaS companies sign a SaaS agreement governed by English law, the law that governs the validity of the execution of the SaaS agreement will depend upon where the companies are incorporated. In the above case as both companies were incorporated in Switzerland, Swiss law applied to the validity of the execution of the SaaS agreement.

Summary

Where a SaaS supplier is dealing with an overseas company, the SaaS supplier should not assume that the execution formalities are the same as in English law, even if the SaaS agreement is governed by English law. The SaaS supplier should check that whoever is signing the SaaS agreement on behalf of the SaaS customer is actually authorised to sign and where possible, seek local advice or a legal opinion for the country or countries in which the parties are located.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – International Agreements – Interest on Late Payments

SaaS customers often delay payment of invoices. In order to protect your SaaS business and improve cash flow, SaaS suppliers usually include the right to claim interest on late payments in the terms of their SaaS agreement or rely on the statutory right to interest under the Late Payment of Commercial Debts (Interest) Act 1998 (“Act”). However, following the decision in Martrade Shipping and Transport GmbH v United Enterprises Corporation SaaS suppliers should be aware of the limitations of relying upon the Act, particularly where the SaaS customer or SaaS supplier is a non UK entity.

Contractual Right to Claim Interest

SaaS suppliers can state a specific interest rate in their SaaS agreement terms under which interest for any late payment will be claimed. This can be a number i.e. 5%, or a reference to an index i.e. the European Central Bank base rate, or a combination of both i.e. the Bank of England base rate + 2%. The interest rate specified can be higher or lower than the statutory rate.

Statutory Right to Claim Interest

Alternatively, SaaS suppliers can simply say nothing about interest in the SaaS agreement and rely upon their statutory right to claim interest on late payments from a business customer (BTB) under the Act. The statutory interest rate to be applied is the applicable Bank of England Base Rate plus 8%.

Right to Claim Compensation

In addition to claiming statutory interest from a SaaS customer, under the Act SaaS suppliers can claim a fixed amount of compensation. The amount is based upon the amount of the outstanding invoice:

  • £40 – for debts less than £1,000;
  • £70 – for debts between £1,000 to £9,999; and
  • £100 – for debts over £10,000.

Recovery of Costs

Since the 16th of March 2013 SaaS suppliers have the additional right to claim the difference between the fixed compensation amount and their reasonable costs in recovering the debt e.g. the costs of appointing a debt recovery company or lawyer. However this right only applies to debts accrued after the 16th of March 2013.

Limitation to the Right to Claim Statutory Interest

Following the decision in Martrade in June 2014 the High Court disallowed a claim for interest for late payment under the Act on the basis that the parties had no substantial connection to England. Both parties were non-English entities but the contract was governed by English law and provided for arbitration in London.

The restriction imposed by the court is nothing new, it is included in section 12 of the Act, but many SaaS suppliers are unaware of it. Section 12 of the Act only permits the application of statutory interest to late payments if one or both of two further requirements are fulfilled:

  • There must be a significant connection between the contract and England; or
  • the contract must be one which would be governed by English law apart from the choice of law.

The High Court said that the Act did not apply in this case as by simply including a London arbitration or English court jurisdiction clause in the contract was not a connecting factor, as the decision to have disputes heard in London does not connect the substantive transaction itself to England. This therefore prevented the application of the Act and excluded the parties the right to claim penalty interest under the Act.

Implications for International SaaS Agreements

The above decision does not however mean that the application of the Act will be excluded from all international SaaS agreements. The Act and the high interest rate payable under it will apply if there is a substantial connection between the SaaS agreement and England

A substantial connection could for example be:

  • the SaaS supplier or the SaaS customer being an English entity;
  • England being the place of performance of obligations under the SaaS agreement;
  • where the parties carry out some relevant part of the SaaS services in England; or
  • where the SaaS agreement is governed by English law apart from the choice of English law.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Anonymising Data

Many SaaS suppliers use personal data, collected on behalf of SaaS customers, in an anonymised form for their own purposes, for example for benchmarking. The UK Information Commissioner’s Office (ICO) Anonymisation Code and more recently the Article 29 Working Party’s Opinion on Anonymisation provide guidance on how to check that personal data is actually anonymous.

If you are a SaaS supplier using anonymised personal data you should comply with the recommendations in these two guides, to ensure that you are properly anonymising data, otherwise you could be found to be using personal data in breach of the Data Protection Act (DPA).

Personal Data

Any SaaS supplier processing personal data must comply with the Data Protection Act 1998 (DPA). The DPA regulates the disclosure and use of personal data.

Personal data is defined in the DPA as data which relates to a living individual who can be identified from those data. Accordingly, information or a combination of information, that does not relate to and identify a living individual, is not personal data.

Information which is not personal data i.e. anonymised data can be disclosed and used more freely with fewer legal restrictions as the DPA does not apply to it. However, SaaS suppliers should ensure that any personal data they have anonymised and they intend to use, is truly anonymous.

Anonymisation Methods

Most data is anonymised using:

  • randomisation techniques, which alter the veracity of the data in order to remove the strong link between the data and the individual. If the data is sufficiently uncertain then it can no longer be referred to a specific individual; or
  • generalisation techniques, which consist of generalising/diluting the attributes of individuals by modifying the respective scale or order of magnitude (i.e. a region rather than a city, a month rather than a week).

Such methods use the following tools to make data anonymous:

  • noise addition;
  • permutation;
  • differential privacy;
  • aggregation/k-anonymity; and
  • l-diversity/t-closeness.

Risk Assessment

In order to ensure that data is properly anonymised, SaaS Supplier’s should carry out regular risk assessment audits. SaaS suppliers should test their anonymisation and randomisation techniques against the following risks to the re-identification of anonymised data:

  • singling out – is it still possible to isolate some or all records which identify an individual in the data set;
  • linkability – is it still possible to link at least two records concerning the same individual or a group of individuals;
  • inference – can information be inferred concerning an individual from the values of a set of other attributes.

Audits should also assess new risks to re-identification, as over time due to technological developments anonymised data could become re-identifiable in the future.

Pseudonymised Data and Anonymised Data

SaaS suppliers should note that the Article 29 Working Group does not accept that pseudonymised data is equivalent to anonymised data. The reason for this is that pseudonymisation allows:

  • an individual to be singled out; and
  • the individual to be linkable across different data sets.

Summary

Where any uncertainty exists about whether or not re-identification can occur, SaaS suppliers should obtain prior consent from individuals to the use of their anonymised data or they run the risk of breaching the DPA.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Heads of Terms – Entire Agreement Clause

Heads of terms are often by SaaS suppliers where the final terms of the SaaS agreement have not yet been fully agreed with the SaaS customer. By using heads of terms the SaaS supplier can start to provide the SaaS services to the SaaS customer. However sometimes the parties are unaware of, or overlook, the legal implications and dangers of using heads of terms prior to finalising the terms of the SaaS agreement.

A recent court case in the UK highlights these problems.

Matchbet Ltd v Openbet Retail Ltd

A software developer claimed damages against a technology supplier for breaching the terms of a development agreement. The development agreement was based on heads of terms but the final signed development agreement contained an entire agreement clause.

Entire Agreement Clause

An entire agreement clause is a clause which states that the terms of the agreement (in this case the development agreement):

  • are the entire agreement and understanding between the parties; and
  • supersede all proposals and prior agreements, arrangements and understandings between the parties.

The purpose of an entire agreement clause is to ensure that all of the rights and obligations of the parties are in one single agreement i.e. the agreement which contains the entire agreement clause, in this case the development agreement.

Relevance of Heads of Terms

As the development agreement contained an entire agreement clause, the heads of terms were irrelevant in determining the intention of the parties, when the court had to interpret the terms of the SaaS agreement. The court had to ignore the heads of terms as they were merely part of the pre-contractual negotiations between the parties and were excluded from the terms of the final SaaS agreement by the entire agreement clause.

Important Note

In light of the above, it is important for SaaS suppliers to understand the interaction between any heads of terms they use prior to signing a final SaaS agreement and the inclusion of an entire agreement clause in the final SaaS agreement.

Where a SaaS supplier wants to ensure that all of the provisions from the heads of terms are included in the final SaaS agreement, the final terms of the SaaS agreement should specifically mirror the provisions of the heads of terms.

Additionally, where the commercial terms have substantially changed between the signing of the heads of terms and the signing of the final SaaS agreement, it is essential that the SaaS agreement includes an entire agreement clause to exclude the out of date heads of terms.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

 

SaaS Agreements – Data Protection – Which law applies?

UK SaaS suppliers who provide cloud computing services to SaaS customers located outside of the UK are increasingly being required to comply not just with UK data protection law, but also the data protection laws of the countries in which the SaaS customer and its clients are based. This increasingly creates problems for SaaS suppliers, as data protection laws generally assume that data is stored/processed in one place. However when operating in the cloud data is often moved between jurisdictions and it may be unclear exactly where data is being stored or processed and who is storing and processing it.

Two recent cases involving Facebook and Google show the extent of this developing problem.

Facebook

In February 2014, Facebook, a US owned company, with its European headquarters in Ireland, was ordered to comply with German data protection law. A German court ruled that Facebook must comply with German data protection law before sending emails to German individuals i.e. by obtaining consent even though the processing of the German personal data was carried out by the Irish company.

The German court took the view that Irish data protection law did not apply, as although Facebook had its European headquarters in Ireland, a EU country, the US parent company Google Inc. controlled the processing and was the data controller. Even though the US parent company was located outside of the EU, as it was using ‘equipment’ situated in a EU country to process the personal data i.e. setting cookies on the devices of German users, the national data protection laws of Germany applied.

Google

The European Court of Justice (ECJ) ruled in May 2014 that Google Spain, a Spanish subsidiary of the US parent company Google Inc, must comply with Spanish data protection law when processing Spanish user data, as the Spanish entity was “established” in the EU. Google had argued that because the processing of Spanish user’s personal data was carried out by the US parent company, EU data protection law did not apply.

The ECJ disagreed, arguing that Google Inc had set up a subsidiary in Spain which directed its activities towards Spanish citizens and therefore Spanish data protection law applied, even though Google Inc. was located in the USA.

EU Data Protection Directive

Both of the above cases are based upon the application of EU data protection law (Directive 95/46/EC), to companies who:

  • process personal data;
  • are a data controller; and
  • have an establishment, or use equipment in, a member state of the European Union.

Where a SaaS customer fulfils the above criteria, it will be subject to EU data protection law (and effectively the locally applicable national data protection law of the country in which the user whose personal data is being processed is based).

Summary

SaaS suppliers should be aware that the application of different national data protection laws in the cloud is primarily the problem of a SaaS customer – who is the data controller. However this becomes an issue for the SaaS supplier where the SaaS customer attempts to pass on its cross border data protection obligations to the SaaS supplier within the terms of the SaaS agreement.

Such obligations are usually disguised in the terms of the SaaS agreement by reference to the SaaS supplier complying with „all applicable laws“ or more specifically to the specific data protection laws of named countries. Such terms should not be agreed to, unless the SaaS supplier is:

  • aware of the obligations and penalties imposed by such data protection laws; and
  • sure of its ability to comply with such obligations.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Reseller/Distribution – International SaaS Reseller Agreements

If you decide to use a local partner to resell your SaaS software to customers outside of the countries in which you are based, you will need to have an international distribution/reseller agreement in place between yourself and each distributor/reseller.

What is a Reseller/Distributor?

A reseller is the same as a distributor. A reseller/distributor purchases the supplier’s SaaS software and services under the terms of a reseller/distribution agreement. The reseller/distributor then resells the SaaS software and services to its own local customers in the territory using its own terms and conditions (and SLA).

The SaaS supplier has no legal relationship with the reseller/distributor’s customers. Customers enter into a SaaS agreement with the reseller/distributor directly.

Is an Agent the same as a Distributor?

Agents are often confused with distributors, but there are clear legal differences. An agent is a person or company who acts on behalf of the SaaS supplier to find leads and/or assist with sales of the supplier’s SaaS software to local customers in the agent’s territory.

The agent has no legal relationship with the customer – the agent has no contract with the customer.  The supplier enters into a SaaS agreement, with the customer using the supplier’s terms and conditions and SLA and the supplier is liable to the customers for issues and errors that may arise during use of the SaaS software.

Why use a Reseller/Distributor?                                          

Most SaaS suppliers use distributors to enable them to sell their software and services to customers who would not otherwise purchase the SaaS software, due to the Supplier’s:

  • lack of physical presence in the customer’s country
  • lack of sales channels and contacts in the customer’s country
  • inability to speak the local language
  • inability to provide customer support in the local language
  • inability to provide customer support within the customer’s local business hours
  • terms and conditions not being written in the customer’s language, or subject to local laws and regulations

By using a distributor/reseller the above problems are resolved as the distributor sells the SaaS software directly to customers, in the local language, pursuant to local law, with local support as if the SaaS software was his own software.

Which law and language

The reseller will be selling your SaaS software to its customers using its own local terms and conditions. These will probably be subject to local law i.e. French law if the reseller is located in France and in the local language, French. However, there is no reason why your reseller agreement should be in French and subject to French law, as you the supplier have no relationship with customers. You should resist any attempt by the reseller to use its local law and language in the reseller/distributor agreement. English law and English language are often accepted and used for international reseller agreements.

As a compromise, it is worth allowing the reseller to have the reseller agreement translated into their local language “for convenience”, in parallel to the English version. However if you have two language versions ensure that the English version of the agreement prevails if there are any discrepancies between the two different language versions.

In some countries it is mandatory under local law to have the agreement in the local language.

Application of Local Law

When deciding to use a reseller/distributor located outside of the UK, you will need to consider the application of any local laws applicable to the reseller/distributor agreement. For example:

  • the terms of the agreement itself will be subject to local anti-competitive laws and regulations;
  • in Canada withholding tax and local income taxes could apply;
  • in the UAE the agreement may be registerable granting the reseller/distributor exclusive rights, rights to commission for any sales in the territory and wide reaching rights to avoid termination of the agreement.

 Summary

In light of the above it is advisable to obtain expert legal advice before entering into an international reseller/distributor agreement to ensure that your legal and commercial interests are adequately protected.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Microsoft must disclose data on EU server

Many SaaS customers falsely believe that if their SaaS data is stored in a data centre located in the EU it will be protected against disclosure to the US authorities. This is incorrect. The recent US court ruling against Microsoft has confirmed the position, namely that SaaS suppliers and SaaS customers who use data centres located in the EU, owned by US companies, cannot prevent US authorities from accessing their data.

Microsoft Case

In April this year a New York court ruled that Microsoft must reveal email data stored on its servers at its Irish data centre. Microsoft received a search warrant issued pursuant to the Stored Communications Act (SCA) requiring them to disclose the data. Under the SCA a US company is obliged to produce information in its possession, custody, or control regardless of the location of that information.

Microsoft currently offers SaaS customers the option of storing all data at its data centre in Ireland, in an attempt to address valid EU customer concerns about the ability of the US authorities to access their data and in an attempt to comply with EU data protection laws. However this recent court decision undermines the effectiveness of this option, as following this decision it is clear that US authorities can access data located outside of the US.

Microsoft plans to challenge the court decision but regardless of the final outcome of this case, US authorities will still be able to access data stored in the EU using other US laws.

Prism, FISA and the Patriot Act

Ignoring the issue of “Prism” the US government can secretly access SaaS customer stored in the EU under the Foreign Intelligence Security Act (FISA) and the Patriot Act.

What is FISA?

FISA allows the US government to access and monitor the personal data of non-US citizens (located outside of the USA) held by US public cloud providers. Public cloud providers such as Amazon and Google must secretly provide all assistance, facilities and information requested by the government if they request access to SaaS customer data. The public entity is not allowed to inform the SaaS supplier that it has disclosed or been asked to disclose personal data, nor that the data is being monitored.

The Patriot Act

The Patriot Act gives US law enforcement authorities the right to access personal data held by SaaS suppliers, regardless of where in the world the data is stored. The Act also gives US law enforcers the right to prevent SaaS suppliers from informing customers that they have handed over personal data. The Act applies not just to SaaS suppliers owned by a US company but also to any SaaS suppliers using the services of a US company i.e. a US data centre.

Summary

Under the SCA, Patriot Act, FISA (and “prism” where applicable) the personal data of SaaS customers based in the EU must be shared with US law enforcers without the SaaS customer being informed, even though this conflicts with the provisions of the EU Data Protection Directive and the data protection laws of the 28 EU member states.

Local EU data protection authorities and EU member state governments are currently investigating how to resolve this conflict, for example by adding provisions preventing disclosure in the draft proposed EU data protection regulation. While the position remains unresolved, SaaS suppliers should be considering how to minimise the risk this poses to their business model, whilst assuring SaaS customers that their concerns are being addressed.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – BYOD

Employees are increasingly using their privately owned devices (i.e. Ipads, tablets, mobile phones and laptops) for business purposes and may be accessing SaaS customer data using them. SaaS suppliers who allow staff to use such “bring your own devices” (BYOD) for work purposes should be aware of their duties to protect any SaaS customer personal data being accessed by staff using such BYODs.

ICO Guidelines

In March 2013 the Information Commissioner’s Office (ICO) published guidelines providing advice on how to protect personal data that is accessed using a BYOD. The Commissioner underlined the fact that SaaS suppliers are obliged to look after personal data for which they are responsible  under the Data Protection Act 1998 (Act) regardless of ownership of the device used to carry out the processing.

In order to protect SaaS customer data and to comply with their duties under the Act, SaaS suppliers who permit staff to access data on a BYOD should:

  • ensure that the BYOD is password-protected;
  • ensure that data is encrypted when it is transferred;
  • ensure that data is encrypted when it is stored; and
  • consider having a BYOD policy for staff.

BYOD Policy

SaaS suppliers should either prohibit BYOD and the ability to access SaaS customer data for work purposes on such devices entirely or they should permit access within the scope of a BYOD policy.

A BYOD policy should contain rules on the use of personal devices by staff, setting out:

  • which employees are allowed to use a BYOD, i.e. senior management;
  • what types of devices may be used;
  • which types of data may be accessed via the device;
  • how devices will be protected against loss, theft or hacking i.e. by requiring the use of passwords, pins and/or encryption;
  • how data should be deleted when an employee leaves or disposes of a device;
  • how and when use of the device will be monitored; and
  • sanctions for breach of the BYOD policy.

Ownership and Deletion of Data

A BYOD policy should also state that any work data i.e. contact details or content i.e. business documents will remain the property of the SaaS supplier. Employees should agree to the SaaS supplier being permitted to:

  • delete work data and content from the device; and
  • make copies of work data and content if an employee leaves the company’s employment.

Summary

SaaS customers are more likely to choose SaaS suppliers who demonstrate that they control and monitor the use of SaaS customer data on BYODs. Having a clear BYOD policy in place will often satisfy a SaaS customer’s concerns about the use and storage of personal data in accordance with the SaaS agreement terms.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

Speaker at the Berlin CloudConf 2013.

To register for my newsletter click here

______________________________________________________

Other related articles: