Are Your Service Agreements GDPR Ready?
The EU’s General Data Protection Regulation (GDPR) will begin to be applied on 25 May 2018. From that date on, outsourcing the processing of personal data will be subject to more stringent regulations than under Finland’s current Personal Data Act. Now is the time for every company that outsources personal data processing to make sure that their service agreements meet the new requirements.
Even if you have outsourced the processing of personal data, you remain liable for that processing. You cannot outsource your statutory obligations, and failing to meet those obligations can carry heavy consequences.
The key issue is how the outsourcing company (in data protection parlance, the data controller) has instructed the service provider, i.e. the personal data processor. The instructions must be documented, and are often incorporated into data processing agreements that define the rights and obligations of both the data controller and the processor with respect to the processing of personal data.
A Data Processing Agreement is a Must
The GDPR requires that the outsourcing of personal data processing must be agreed in writing. The GDPR also sets minimum requirements for what the agreement must contain. The most important requirements are:
- Specification of processing – The parties must agree on the data processing in detail. The matters to be agreed include what data processing is being outsourced (e.g. payroll), who the outsourcing concerns (e.g. employees) and what categories of data are to be processed (e.g. employees’ contact information).
- Commitment to data controller’s instructions – The service provider must undertake to process personal data only in accordance with the client’s instructions and the terms and conditions of the agreement.
- Confidentiality – Persons entitled to process personal data, such as the service provider’s employees, must undertake to comply with a confidentiality obligation.
- Data Security – The service provider must commit to implement sufficient security measure to protect the personal data. These may be technical measures, such as anti-virus software and firewalls or access control of offices, or they can be organisational measures, such as restricting user IDs or ensuring sufficient personnel resources and expertise.
- Subcontractors of the data processor – In the agreement, the parties must agree whether the service provider needs separate consent from the client to use another processor, i.e. a subcontractor, or is a subsequent notice and the client’s right to object sufficient.
- Obligation to assist – The service provider must assist the client in fulfilling certain obligations of the data controller.
- Information obligation – The service provider must furnish the client with sufficient information for the client to prove that it is in compliance with its duties as a data controller.
- Auditing right – The service provider must grant the client or an auditor appointed by the client the right to carry out audits and must participate in them.
- Deletion of data – When the outsourcing ends, the service provider must delete all personal data or return them to the client, unless the service provider has a statutory obligation to keep personal data.
Many Kinds of Data Protection Agreements
In practice, a data protection agreement can be either included as a section on personal data processing in the service agreement itself or by executing a separate personal data processing appendix or agreement. A separate appendix is often a good option, because it is easy to add to existing agreements.
Despite the fact that the GDPR requires a written data processing agreement, neither the EU nor Finland’s data protection authorities have yet published model agreements. As a result, many data controllers and processors have drafted their own models in an effort to fulfil the requirements of the GDPR. As the roles of the companies, the personal data to be processed and the outsourced functions vary, data processing agreements also vary a great deal.
The GDPR sets the minimum requirements for data processing agreements, but it is often justified to agree on other things, as well. For example, the agreement can set out how quickly the data processor has to notify the data controller of data breaches.
In contract negotiations, the issue of the parties’ liability for damages and the possible limitation of liability often arises. It is worth dedicating time to resolving this, particularly when adding a data protection appendix to an existing service agreement. Other common issues that come up in negotiations include the processor’s right to use subcontractors, data transfers out of the EU, maintaining backups after the expiry of the service agreement and the compensation of costs incurred by the processor from assisting the data controller.
Choose Your Service Provider Carefully
Even though data processing agreements are important, data protection is something that needs to be on your mind already when choosing a service provider. Under the GDPR, the data controller must assess the expertise of service providers and only use providers that furnish sufficient guarantees that the data will be properly protected.
The higher the risk posed by processing to the data subjects – for instance, if the processing of healthcare data is being outsourced – the stronger the data controller’s obligation to ensure that the service provider is capable of processing personal data securely.
What is the Next Step?
The requirements of the GDPR are backed up by a significant risk of sanction. As a result, companies that are data controllers must first determine the circumstances in which they transfer personal data to service providers. Without this knowledge, it is difficult to ensure that the terms of any contracts they have meet the GDPR’s requirements. This is true of both existing and future contracting relationships
As the GDPR’s requirements are new, it is quite likely that existing service agreements do not meet all of them. Every company that has outsourced personal data processing needs to be preparing to amend their old agreements. There will only be few months’ transition time before the GDPR becomes effective, so if you haven’t already started updating your agreements, now is the time. Naturally, the GDPR’s requirements will have to be taken into account in new agreements, as well.