The issues around data portability will be very familiar to many of our readers, irrespective of their area of specialization.
Whether attempting to migrate from one social media ecosystem to another, change device ecosystems, or simply move detailed health data, users are often faced with a myriad of obstacles including a lack of interoperability, incomplete data, incompatible data formats, etc. Issues facing users are often even more pronounced in the context of connected devices.
This friction discourages switching between devices and ecosystems and means that significant advantage often accrues to dominant market players, purportedly stifling both innovation and competition.
To address this issue the Act has been drafted very broadly covering both software- and platform-as-a-service as well as infrastructure-as-a-service providers. It includes some key changes:
- being able to terminate a contract early to switch to another provider;
- the obligation to support switching; and
- the elimination of switching charges.
Contracts must also be amended to reflect the requirements under the Act including the provision of additional information to users prior to the execution of the contract.
If you are doing business in the EU or have EU-based customers and are holding or handling data it is essential to consider whether the Act applies to your services and operating model.
But when making this assessment in the SaaS context specifically it is well worth noting that the applicability of the Act hinges on the specific legal definition of a ‘data processing service’. This is defined as:
“… a digital service that is provided to a customer and that enables ubiquitous and on-demand network access to a shared pool of configurable, scalable and elastic computing resources of a centralised, distributed or highly distributed nature that can be rapidly provisioned and released with minimal management effort or service provider interaction.”
The key is the focus on the ability to rapidly provision and deploy with “minimal management effort or service provider interaction.”
What this definition is describing is effectively a self-service model most closely associated with apps and similar digital services available for download.
In other words, services that cannot be provisioned in a self-service or near self-service manner, are less likely to fall within the definition of a “data processing service” under the Act.
The use of the word “ubiquitous” is also important and worth noting. This is defined as “found or existing everywhere” and this meaning is reinforced by the use of “distributed or highly distributed” a little later on in the definition. The language here implies broad public availability, geographic dispersion as well as significant scale in the software context.
It is very likely that a business whose services do not display these characteristics will not be caught in the Act’s net.
And this very deliberate word choice is also coupled with the requirement for scalability and elasticity of resources to respond to user demand or the lack thereof.
What this all means is that a digital or cloud service may be out of scope of the Act if it displays the following characteristics:
- is not generally publicly available;
- cannot be provisioned in a self-service or near self-service manner;
- is not operating a system that enables the number of users to scale up or down rapidly;
- inherently requires provisioning or vendor supported implementation; and
- requires specific configuration or customization.
This is an important and fundamental carve out and one that is worth examining closely when considering the nature of the service potentially in scope of the Act and the various requirements and obligations stemming from it.
As always this article does not constitute or replace good legal advice. Because there is a lot at stake here such advice is very strongly recommended to any business who may potentially fall within the scope of the Act.