Cloud Computing Caveats: Part I: Take Time with the Details

Part I: Take Time with the Details 

Switching to a cloud can save money by lowering IT and data center support costs, improving performance and scalability, and reducing storage costs.  However, stakeholders and counsel should be cognizant that cloud computing presents various legal issues around control and custody of data, data preservation and collection, data review and production, and of course, attorney-client privilege.

Before migrating to the cloud, a company should identify its critical systems and related data, and have such data readily accessible in the event its cloud-based data becomes inaccessible.  In choosing a cloud vendor, pay attention to mechanisms the vendor has in place regarding backup and data retrieval.  How many servers does the host have?  How often will your data be backed up?  What is the cost and time involved in rendering backup data accessible to you?

In preparing for the suspension or termination of cloud service scenarios, the legal component is as important as the business and technology considerations presented above.  Counsel must identify and designate the parties responsible for repairing the cloud and getting the Company’s systems running again. Counsel should pay particular attention to the terms under which such repairs must be made and paid.

Counsel should identify which parties are responsible for covering the costs from the damages arising from the temporary or permanent shut-down of the cloud.  Any agreement around cloud computing should define in detail what happens to the data if the cloud or the Company goes bankrupt. The agreement should state that the data of the Company should be the property of the company alone and not the property of the cloud vendor.  The agreement should expressly provide that the cloud vendor has no rights to hold the data or to refuse the Company access to the data and, upon bankruptcy or any other termination of the business of the cloud vendor, the data should be promptly be returned to the Company.  An agreement lacking these details can result in a company losing access to its data, if, for instance, creditors successfully assert that the data is the property of the bankrupt cloud vendor.  If an argument is made that the data is an asset of the bankrupt debtor, the bankruptcy Court can take jurisdiction over that data and the data can be frozen until the Court can decide who is entitled to the data.

Another temporary suspension or termination of service issue involves the voluntary termination of service.  The cloud vendor might be acquired by a competitor of the Company and consequently the Company might be uncomfortable with the vendor continuing to host its data.  Counsel for both parties should ensure that the agreement address how to get the data from the cloud, who pays, and the appropriate timeline. Moreover, the Company should address what happens if the cloud vendor withholds the Company’s data in a dispute about payment.  It is prudent that Counsel for the Company include language specifying that no dispute concerning payment constitutes grounds for the cloud vendor to withhold data.

* This is the first part in a three-part series which comprise an abridged version of the article on “Cloud Computing,” written by Daniel Garrie and published in the Los Angeles Daily Journal. To request a PDF of the complete article, please contact Law & Forensics.