Cloud Computing & Jurisdiction: Part 2: A Primer

Part 2: A Primer

Cloud computing, which is relatively new, could lead to some novel problems concerning jurisdiction.  Generally, in civil lawsuits, a company is charged with producing relevant documents that are under its “custody and control.”  This typically means that a company is responsible for producing its documents without regard to where the documents are physically stored, provided they are the company’s documents or the company has control over the documents.  However, because a company using cloud storage will place its documents in a different physical location from the office of that company, several new questions may arise and there is little precedent for these types of issues.

It is important to note that state laws can come into play.  States have laws governing privacy and confidentiality that can provide severe sanctions for violating those laws.  With cloud computing, are the documents governed by the law of the state in which they are physically located or by the location of the company possessing them or by the laws of the state where a person resides?

This problem becomes more complicated when one considers the role of law enforcement or government regulators.  As the use of technological records increases, including email, instant messaging and cell phone records, so does law enforcement’s use of technology to conduct investigations and establish evidence of its cases.  If the government wishes to review, or even seize, the records located in the cloud, does it have the power to do so?  If there is a dispute over that issue, who decides?  Which court would have jurisdiction?  It is important to remember that law enforcement and government agencies may have difficulty using their authorized powers if they are outside of the jurisdictional limits of those powers.

These problems can become significantly more complicated if the documents are stored in another country, as confidentiality and privacy laws can vary greatly from those in the United States.  For example, some countries have strict laws relating to secrecy of bank documents and the penalties for violating those laws can include criminal sanctions.  Another potential area for disputes involves intellectual property rights, which can vary significantly.

An additional area of complication can be the use of affiliated companies for data storage and maintenance.  What happens if a large company forms a subsidiary to manage its data and the data is stored under the name of that subsidiary?  Could this mean that such data may not be responsive to document requests of the other affiliated companies?  Could it impact the jurisdiction of courts to address disputes concerning the data?

Some of these issues can be addressed in the cloud computing contract.  Agreements can be made concerning the jurisdiction over disputes concerning the data.  However, disputes involving other entities which are not parties to that agreement may not be subject to the agreement.  Accordingly, cloud computing presents significant uncertainty and has the potential for future disputes concerning jurisdiction.

* This is the second part in a three-part series which comprise an abridged version of the article on “Cloud Computing,” written by Daniel Garrie and published in the Los Angeles Daily Journal.

** To request a PDF of the complete article, please contact Law & Forensics.