More and more businesses are taking advantage of the cost and efficiency benefits of cloud computing. If a move to cloud computing is on your horizon, you should be aware of some of the legal implications of such a move.
The “cloud” refers to an infrastructure owned and maintained by a third party for the purpose of storing and managing the data owned by a business or other organization at a location outside that business or organization. Amazon, Rackspace, Salesforce.com, Citrix, Apple and Google are among the many companies providing cloud computing, with Amazon the number one provider.
All businesses, of whatever size or complexity, must be able to manage and access their data in order to fulfill their core purpose, but also to satisfy legal obligations imposed by taxing and regulatory authorities, or as a consequence of involvement in a legal action, whether as plaintiff or defendant. For purposes of this discussion, we will refer to these legal obligations as “discovery obligations”.
To satisfy its discovery obligations, a company must first be able to identify its sources of information; e.g., correspondence, e-mail or bookkeeping records. If data is entrusted to a cloud provider, an organization may not know how that data is organized, where it is stored, or how many copies there are.
Discovery obligations also require the preservation of data, especially when an organization is involved in an audit or litigation, or when an audit or lawsuit is imminent. Cloud providers may have policies regarding the length of time for which data will be preserved that do not take into account the purpose of retention requirements for different types of data. Conversely, these policies may result in the retention of data after the point at which it might have been properly deleted.
Discovery obligations require the production of data or documents in a form that is recognizably the form in which such data or documents were created and used; e.g. Roman alphabet or Arabic numerals. A cloud provider’s method of storing data might not meet the reasonable expectations of a party seeking that data, even though that method may retain all or most of the primary components of the original.
Another, and singularly important, consideration in a move to the cloud is security. Placing data in the care and custody of a third party may risk the security of that data. While we may be inclined to regard large and sophisticated cloud providers as well equipped to address security issues, the fact is that the sheer size of these providers and their correspondingly high profile makes them attractive targets for all kinds of attackers. Recent attacks on GoDaddy, Rackspace and Amazon disrupted not only the cloud providers, but also many of the businesses they serve.
The time to address the legal implications of a move to cloud computing is before you sign a contract with a cloud provider. Make sure that you read and understand the provisions of the agreement, and their legal implications for your business.
If you are considering a move to cloud computing, and have questions, or would like a review and analysis of the provider’s proposed agreement, please give me a call.