GDPR: A Game Changer for Cloud Contracts

• a clause “Representations” containing representations from the controller to the processor regarding all relevant information on the purpose of the processing of personal data carried out using the means made available by the cloud provider;
• a clause “Instructions” describing the instructions given by the client to the cloud provider and how the cloud provider must apply them;
• a clause “Security” presenting the physical and logical security policy deployed by the cloud provider, in addition to the measures applicable in case of unauthorized intrusion (data breach process); this clause should be associated with an appendix dedicated to a security assurance plan;
• a clause under which the processor agrees to cooperate in the event a data subject wants to exercise his or her rights;
• a clause specifying if, when and how a processor can engage another processor. This is where the requirements for a written and transparent document represents a sea change as cascading contracts must be consistent with each other (“back to back”);
• a clause “Confidentiality”, which should guarantee confidentiality not only from the cloud provider’s own employees, but also from any subcontractors or freelancers hired by the cloud provider to assist in the performance of its obligations;
• clauses on the provider’s obligation to inform (in general, and not only in the event of data breach) and the conditions for conducting audits under aforementioned Article28;
• the location of the data in or outside the European Union; if the data are transferred outside the European Union to a country not considered as ensuring an adequate level of protection it will be necessary to rely on standard contractual clauses (5) (if data are transferred to the United States, a specific framework may apply: the EU-U.S. Privacy Shield (6);
• clarifications on the termination of contractual relationships and the destruction of data in the cloud.

This enhanced transparency is intended to strengthen the confidence of the parties, and hence to increase legal certainty. In terms of IT contracts, the requirements introduced by the GDPR go against a strong trend towards pre-formulated standard contracts (7). In contrast, adapting a clause to the specific categories of data and processing operations carried out implies negotiations; a purely cosmetic “standard” clause could be regarded as a violation of the GDPR.

However, the GDPR does not regulate everything and the difficulties existing in any contracting process are still there. The most typical examples are issues relating to the intensity of obligations and the limitation of liability (8). A review of the personal data clause seems like an opportunity to reorganize the relationship between the parties. Despite clear clauses, which have sometimes been obtained after hard-fought negotiations, a service provider (processor) will be tempted to seek to impose full responsibility on the client (controller) and, conversely, the client will try to seek to extend the liability cap of its service provider.

Regarding the intensity of obligations (and in other words the burden of proof) the GDPR provides no answer: this is a question of contractual freedom. (9)

Regarding the allocation of liability, Article 82(2) of the GDPR is clear: “Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.”

However, it is only towards the data subjects and the supervisory authorities that the parties cannot go against the provisions of Article 82(2). Between them, the parties remain free to allocate the risk as they see fit. Consequently, there is no reason to renegotiate the liability cap already agreed upon simply because of the signature of a GDPR amendment.

In conclusion, writing or re-writing a cloud contract does not guarantee full compliance with the GDPR: a global compliance approach is needed.

Article provided by: Eric Le Quellenec, Head of the IT Advisory Department, Alain Bensoussan – Lexing (France), Member of the Paris Council Bar