Appendix 2 – Example Data Sharing Agreement

Appendix 2 – Example Data Sharing Agreement

DATA SHARING AGREEMENT

between

Harland UK LTD – Trading as :Premier Property Management, 12 Langlands Street, Dundee DD4 6SZ (“[Party 1]“);

and

[Insert organisation name, a [e.g. Company] registered in terms of the Companies Acts with registered number [registered number] and having its registered office/main office at [address]] (“[Party 2]“) ]”);

(each a “Party” and together the “Parties“).

WHEREAS

  • [insert name of party] (“[Party1]”) and [Insert name of party] (“[Party 2]”)intend that this data sharing agreement will form the basis of the data sharing arrangements between the parties (the “Agreement”); and
  • The intention of the Parties is that they shall each be independent Data Controllers in respect of the Data that they process under this Agreement.
  • Nothing in this Agreement shall alter, supersede, or in any other way affect the terms of [insert details of relationship/contract with Party 2]

NOW THEREFORE IT IS AGREED AS FOLLOWS:

  • DEFINITIONS
    • In construing this Agreement, capitalised words and expressions shall have the meaning set out opposite:

“Agreement” means this Data Sharing Agreement, as amended from time to time in accordance with its terms, including the Schedule;

“Business Day” means any day which is not a Saturday, a Sunday or a bank or public holiday throughout Scotland;

“Data” means the information which contains Personal Data and Sensitive Personal Data (both of which have the definition ascribed to them in Data Protection Law) described in Part 1;

“Data Controller” has the meaning set out in Data Protection Law;

“Disclosing Party” means the Party (being either [Party1] or [Party 2], as appropriate) disclosing Data (or on behalf of whom Data is disclosed to the Data Recipient);

“Data Protection Law” means Law relating to data protection, the processing of personal data and privacy from time to time, including:

  • the Data Protection Act 1998;
  • (with effect from 25 May 2018) the General Data Protection Regulation (EU) 2016/679;
  • the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as may be amended by the proposed Regulation on Privacy and Electronic Communications); and
  • any legislation that, in respect of the United Kingdom, replaces, or enacts into United Kingdom domestic law, the General Data Protection Regulation (EU) 2016/679, the proposed Regulation on Privacy and Electronic Communications or any other law relating to data protection, the processing of personal data and privacy as a consequence of the United Kingdom leaving the European Union;

“Data Recipient” means the party (being either [Party1] or [Party 2], as appropriate) to whom Data is disclosed;

“Data Subject” means any identifiable individual to whom any Data relates: and the categories of data subjects within the scope of this Agreement are listed in Part 1;

“Data Subject Request” means a written request of either party as Data Controller by or on behalf of a Data Subject to exercise any rights conferred by Data Protection Law in relation to the data or the activities of the parties contemplated by this Agreement;

“Disclosing Party” means the party (being either [Party1] or [Party 2], as appropriate) disclosing Data to the Data Recipient;

“Information Commissioner” means the UK Information Commissioner and any successor;

“Law” means any statute, directive, other legislation, law or regulation in whatever form, delegated act (under any of the foregoing), rule, order of any court having valid jurisdiction or other binding restriction, decision or guidance in force from time to time;

“Legal Basis” means in relation to either Party, the legal basis for sharing the Data as described in Clause 2.3 and as set out in Part 2;

“Purpose” means the purpose referred to in Part 2;

“Representatives” means, as the context requires, the representative of [Party1] and/or the representative of [Party 2] as detailed in Part 4 of the Schedule. The same may be changed from time to time on notice in writing by the relevant Party to the other Party;

“Schedule” means the Schedule in 6 Parts annexed to this Agreement and a reference to a “Part” is to a Part of the Schedule; and

“Security Measures” has the meaning given to that term in Clause 2.4.6

  • In this Agreement unless the context otherwise requires:
    • words and expressions defined in Data Protection Law shall have the same meanings in this Agreement so that, in the case of Data Protection Law, words and expressions shall be interpreted in accordance with:
  • the Data Protection Act 1998, in respect of processing undertaken on or before 24 May 2018;
  • the General Data Protection Regulation (EU) 2016/679, in respect of processing undertaken on or after 25 May 2018; and
  • in respect of processing undertaken on or after the date on which legislation comes into force that replaces, or enacts into United Kingdom domestic law, the General Data Protection Regulation (EU) 2016/679, that legislation;
    • more generally, references to statutory provisions include those statutory provisions as amended, replaced, re-enacted for the time being in force and shall include any bye-laws, statutory instruments, rules, regulations, orders, notices, codes of practice, directions, consents or permissions and guidelines (together with any conditions attached to the foregoing) made thereunder;
  • data sharing

Purpose and Legal Basis

  • The Parties agree to share the Data for the Purpose set out in accordance with the provisions of Part 2 of the Schedule.
  • Save as provided for in this Agreement, the Parties agree not to use any Data disclosed in terms of this Agreement in a way that is incompatible with the Purpose.
  • Each Party shall ensure that it processes the Data fairly and lawfully in accordance with Data Protection Law and each Party as Disclosing Party warrants to the other Party in relation to any Data disclosed, that such disclosure is justified by a Legal Basis.

Parties Relationship

  • The Parties agree that the relationship between them is such that any processing of the Data shall be on a Data Controller to Data Controller basis. The Data Recipient agrees that:
    • it is a separate and independent Data Controller in respect of the Data that it processes under this Agreement, and that the Parties are not joint Data Controllers or Data Controllers in common;
    • it is responsible for complying with the obligations incumbent on it as a Data Controller under Data Protection Law (including responding to any Data Subject Request);
    • it shall comply with its obligations under Part 6 of the Schedule;
    • it shall not transfer any of the Data outside the United Kingdom except to the extent agreed by the Disclosing Party;
    • Provided that where the Data has been transferred outside the United Kingdom, the Disclosing Party may require that the Data is transferred back to within the United Kingdom:
  • on giving not less than 3 months’ notice in writing to that effect; or
  • at any time in the event of a change in Law which makes it unlawful for the Data to be processed in the jurisdiction outside the United Kingdom where it is being processed; and
    • it shall implement appropriate technical and organisational measures including the security measures set out in Part 5 of the Schedule (the “Security Measures“), so as to ensure an appropriate level of security is adopted to mitigate the risks associated with its processing of the Data, including against unauthorised or unlawful processing, accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or damage or access to such Data.
  • The Disclosing Party undertakes to notify in writing the other as soon as practicable if an error is discovered in Data which has been provided to the Data Recipient, to ensure that the Data Recipient is then able to correct its records. This will happen whether the error is discovered through existing Data quality initiatives or is flagged up through some other route (such as the existence of errors being directly notified to the Disclosing Party by the Data Subjects themselves).

Transferring Data

  • Subject to the Data Recipient’s compliance with the terms of this Agreement, the Disclosing Party undertakes to endeavour to provide the Data to the Data Recipient on a non-exclusive basis in accordance with the transfer arrangements detailed in Part 3 of the Schedule. 
  • BREACH NOTIFICATION
    • Each Party shall, promptly (and, in any event, no later than 12 hours after becoming aware of the breach or suspected breach) notify the other party in writing of any breach or suspected breach of any of that Party’s obligations in terms of Clauses 1 and/or 2 and of any other unauthorised or unlawful processing of any of the Data and any other loss or destruction of or damage to any of the Data. Such notification shall specify (at a minimum):
      • the nature of the personal data breach or suspected breach;
      • the date and time of occurrence;
      • the extent of the Data and Data Subjects affected or potentially affected, the likely consequences of any breach (in the case of a suspected breach, should it have occurred) for Data Subjects affected by it and any measures taken or proposed to be taken by that party to contain the breach or suspected breach; and
      • any other information that the other Party shall require in order to discharge its responsibilities under Data Protection Law in relation to such breach or suspected breach.
    • The Party who has suffered the breach or suspected breach shall thereafter promptly, at the other Party’s expense (i) provide the other Party with all such information as the other Party reasonably requests in connection with such breach or suspected breach; (ii) take such steps as the other Party reasonably requires it to take to mitigate the detrimental effects of any such breach or suspected breach on any of the Data Subjects and/or on the other Party; and (iii) otherwise cooperate with the other Party in investigating and dealing with such breach or suspected breach and its consequences.
    • The rights conferred under this Clause 3 are without prejudice to any other rights and remedies for breach of this Agreement whether in contract or otherwise in law.
  • Duration, Review and amendment
    • This Agreement shall come into force immediately on being executed by all the Parties and continue for [insert termination: this will be when Parties cease sharing data in terms of a contractual relationship with each other], unless terminated earlier by the Disclosing Party in accordance with Clause 4.5.
    • This Agreement will be reviewed one year after it comes into force and every two years thereafter until termination or expiry in accordance with its terms.
    • In addition to these scheduled reviews and without prejudice to Clause 4.5, the Parties will also review this Agreement and the operational arrangements which give effect to it, if any of the following events takes place:
      • the terms of this Agreement have been breached in any material aspect, including any security breach or data loss in respect of Data which is subject to this Agreement; or
      • the Information Commissioner or any of his or her authorised staff recommends that the Agreement be reviewed.
    • Any amendments to this Agreement will only be effective when contained within a formal amendment document which is formally executed in writing by both Parties.
    • In the event that the Disclosing Party has any reason to believe that the Data Recipient is in breach of any of its obligations under this Agreement, the Disclosing Party may at its sole discretion:
      • suspend the sharing of Data until such time as the Disclosing Party is reasonably satisfied that the breach will not re-occur; and/or
      • terminate this Agreement immediately by written notice to the Data Recipient if the Data Recipient commits a material breach of this Agreement which (in the case of a breach capable of a remedy) it does not remedy within five (5) Business Days of receiving written notice of the breach.
    • Where the Disclosing Party exercises its rights under Clause 4.5, it may request the return of the Data (in which case the Data Recipient shall, no later than fourteen (14) days after receipt of such a written request from the Disclosing Party, at the Disclosing Party’s option, return or permanently erase/destroy all materials held by or under the control of the Data Recipient which contain or reflect the Data and shall not retain any copies, extracts or other reproductions of the Data either in whole or in part and shall confirm having done so to the other Party in writing), save that the Data Recipient will be permitted to retain one copy for the purpose of complying with, and for so long as required by, any law or judicial or administrative process or for its legitimate internal compliance and/or record keeping requirements. 
  • Liability
    • Nothing in this Agreement limits or excludes the liability of either Party for:
      • death or personal injury resulting from its negligence; or
      • any damage or liability incurred as a result of fraud by its personnel; or
      • any other matter to the extent that the exclusion or limitation of liability for that matter is not permitted by law.
    • The Data Recipient indemnifies the Disclosing Party against any losses, costs, damages, awards of compensation, any monetary penalty notices or administrative fines for breach of Data Protection Law and/or expenses (including legal fees and expenses) suffered, incurred by the Disclosing Party, or awarded, levied or imposed against the other party, as a result of any breach by the Data Recipient of its obligations under this Agreement. Any such liability arising from the terms of this Clause 5.2 is limited to £ (STERLING) in the aggregate for the duration of this Agreement.
    • Subject to Clauses 5.1 and 5.2 above:
      • each Party excludes all liability for breach of any conditions implied by law (including any conditions of accuracy, security, completeness, satisfactory quality, fitness for purpose, freedom from viruses, worms, trojans or other hostile computer programs, non-infringement of proprietary rights and the use of reasonable care and skill) which but for this Agreement might have effect in relation to the Data;
      • neither Party shall in any circumstances be liable to the other party for any actions, claims, demands, liabilities, damages, losses, costs, charges and expenses that the other party may suffer or incur in connection with, or arising (directly or indirectly) from, any use of or reliance on the Data provided to them by the other Party; and
      • use of the Data by both Parties is entirely at their own risk and each party shall make its own decisions based on the Data, notwithstanding that this Clause shall not prevent one party from offering clarification and guidance to the other party as to appropriate interpretation of the Data. 
  • Dispute Resolution
    • The Parties hereby agree to act in good faith at all times to attempt to resolve any dispute or difference relating to the subject matter of, and arising under, this Agreement.
    • If the Representatives dealing with a dispute or difference are unable to resolve this themselves within twenty (20) Business Days of the issue arising, the matter shall be escalated to the following individuals in Part 4 of the Schedule identified as escalation points who will endeavour in good faith to resolve the issue.
    • In the event that the Parties are unable to resolve the dispute amicably within a period of twenty (20) Business Days from date on which the dispute or difference was escalated in terms of Clause 6.2, the matter may be referred to a mutually agreed mediator. If the identity of the mediator cannot be agreed, a mediator shall be chosen by the Dean of the Royal Faculty of Procurators in Glasgow.
    • If mediation fails to resolve the dispute or if the chosen mediator indicates that the dispute is not suitable for mediation, and the Parties remain unable to resolve any dispute or difference in accordance with Clauses 6.1 to 6.3, then either Party may, by notice in writing to the other Party, refer the dispute for determination by the courts in accordance with Clause 9.
    • The provisions of Clauses 6.1 to 6.4 do not prevent either Party from applying for an interim court order whilst the Parties attempt to resolve a dispute. 
  • Notices
    • Any Notices to be provided in terms of this Agreement must be provided in writing and addressed to the relevant Party in accordance with the contact details noted in Part 4 of the Schedule, and will be deemed to have been received (i) if delivered personally, on the day of delivery; (ii) if sent by first class post or other next working day delivery, the second day after posting; (iii) if by courier, the date and time the courier’s delivery receipt if signed; or (iv) if by fax, the date and time of the fax receipt. 
  • Governing law
    • This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) (a “Dispute”) shall, in all respects, be governed by and construed in accordance with the law of Scotland. Subject to Clause 6, the Parties agree that the Scottish Courts shall have exclusive jurisdiction in relation to any Dispute.

IN WITNESS WHEREOF these presents consisting of this and the preceding [enter number or pages] pages together with the Schedule in 6 parts hereto are executed by the Parties hereto as follows:

On behalf of [Party1]

at

on
by
Print Full Name

before this witness

 Director/Secretary/Authorised Signatory
Print Full Name Witness
Address
On behalf of [Party 2]

at

on
by
Print Full Name

before this witness

 Director/Secretary/Authorised Signatory
Print Full Name Witness
Address

 

This is the Schedule referred to in the foregoing Data Sharing Agreement between [Party1] and [Party 2]

Schedule Part 1 – Data

DATA SUBJECTS

For the purposes of this Agreement, Data Subjects are all living persons about whom information is transferred between the Parties. 

Schedule Part 2: Purpose and Legal Basis for Processing

Purpose

The Parties are exchanging Data to allow [insert details].

Legal Basis

[insert details – this will require specific requirements to be drafted in to the model agreement depending on the relationship between [Party1] and Party 2] 

Schedule Part 3 – Data Transfer Rules

Information exchange can only work properly in practice if it is provided in a format which the Data Recipient it can utilise. It is also important that the Data is disclosed in a manner which ensures that no unauthorised reading, copying, altering or deleting of personal data occurs during electronic transmission or transportation of the Data. The Parties therefore agree that to the extent that data is physically transported, the following media are used:

  • Face to face
  • Secure email
  • Courier
  • Encrypted removable media
  • Telephone
  • [insert further methods of transport of data (and delete above if desired)]

The data is encrypted, with the following procedure(s):

  • [insert details] 

Schedule Part 4 – REPRESENTATIVES

Contact Details 

[Party1]

Name:

Job Title:

Address:

email:

Telephone Number:    

[Party 2]

Name:

Job Title:

Address:

email:

Telephone Number:

Schedule part 5 – Security measures 

  • The Parties shall each implement an organisational information security policy.
  • Physical Security
    • Any use of data processing systems by unauthorised persons must be prevented by means of appropriate technical (keyword / password protection) and organisational (user master record) access controls regarding user identification and authentication. Any hacking into the systems by unauthorised persons must be prevented. Specifically, the following technical and organisational measures are in place:

The unauthorised use of IT systems is prevented by:

  • User ID
  • Password assignment
  • Lock screen with password activation
  • Each authorised user has a private password known only to themselves

The following additional measures are taken to ensure the security of any Data:

  • Network Username
  • Network Password
  • Application Username
  • Application Password
  • Disposal of Assets
    • Where information supplied by a Party no longer requires to be retained, any devices containing Personal Data should be physically destroyed or the information should be destroyed, deleted or overwritten using techniques to make the original information non-retrievable rather than using the standard delete or format function.
  • Malicious software and viruses

Each Party must ensure that:

  • PCs used in supporting the service are supplied with anti-virus software and anti-virus and security updates are promptly applied.
  • All files received by one Party from the other are scanned to ensure that no viruses are passed.
  • The Parties must notify each other of any virus infections that could affect their systems on Data transfer.