I know this has been a topic of conversation before, however recently it has become an issue for us. We are a web development company using a white label version of CM. Some of our clients have stopped using CM through our white label site as they have been informed by a third party that email processing must be performed on UK based servers.
I have spoken with the UK Information Comissioners Office and they pointed me to the following website http://ec.europa.eu/justice/policies/privacy/modelcontracts/index_en.htm and document http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2002:006:0052:0062:EN:PDF. We are a small company and hiring a lawyer to assess the position for our clients is simply not cost effective based on the commission we receive from CM.
Campaign Monitor, as an organisation providing mailing functionality, I would have though should provide firm guidance with specific reference to EU guidelines on the rules and regulations that surround the Data Protection Act. If we were more confident we would have many more of our clients using CM and from the other posts (http://www.campaignmonitor.com/forums/viewtopic.php?id=2985, http://www.campaignmonitor.com/forums/viewtopic.php?id=12) it seems we would not be alone.
Asking us (resellers, customers etc.) interpret the law individually is very difficult. This isn't our business or area of expertise and while we really want to use your product we are experiencing difficulty in convincing our customers of its legality in regard to EU law.
Can a representative of CM please respond to this post and provide some information and guidance on how we (as your resellers) and you can work together to provide a solution to this problem? I imagine that this would concern all of your customers based in the EU.
Sorry for the delay. As we've posted elsewhere, our understanding is that any company can store data outside the UK as long as the company storing the data meets or exceeds the requirements of the law.
We believe our policies do meet the requirements, but to be clearer we're currently working with our legal advisors on getting a formal notice for you. As with all legal issues it is taking longer than expected!
We'll let you know as soon as possible.
Funnily enough this query has come up for us this week too, so any help or guidance appreciated.
Has there been an update on this?
We do now have an EU Data Transfer Clause/Contract document based on the model contract provided by the EU for people storing data outside of the EU.
It basically covers our privacy policies in the way that is recommended, and we can send a signed copy on request.