Guardian - Taylor Wessing Media Tech Law Updates

Keeping your legal head above the cloud
Cloud computing can be good for business – so long as you have got the legal issues right, reports Jemima Kiss
Source: http://www.guardian.co.uk/media-tech-law/cloud-computing-legal-issues

---------------------------------------

From Gmail and Flickr to Marks & Spencer and Mothercare, you would be hard-pushed to find a consumer or business in the UK that does not rely on at least one cloud-based service.

An umbrella term for outsourced technology services, such as email and web hosting, cloud computing allows businesses to outsource a crucial but highly specialised part of their operation to a specialist firm. But with cloud services now so ubiquitous and easy to use, could companies be overlooking the legal implications of such a major shift in their business?

"Small businesses in particular have access to all sorts of facilities through computing functionality they have never been able to afford before – data centres, support staff and maintenance – when delivered out of the cloud they are available to anybody" says John Manley, director of Hewlett-Packard's automated infrastructure lab in Bristol.

Manley says the industry is still nascent and that as competition increases, providers will take much more care over service-level agreements. "They will want to differentiate themselves – some will be cheaper, some faster, some more secure. You have to make that choice based on your requirements, but there will be a lot more detail and legal force in these agreements."

Moonfruit, a London-based web design and hosting platform, has always used an "expandable shared infrastructure" to host its service.

Because Moonfruit allows users to upload media, such as images and videos, to their website designs, the primary concern in setting up a deal with content delivery network EdgeCast was copyright infringement. "The first thing we did was speak to EdgeCast about the practicalities and what we should be thinking about," says Joe White, Moonfruit's chief executive. "They have more experience in this and explained how we needed to be legally compliant."

Though Moonfruit's services are hosted in the UK, EdgeCast caches Moonfruit content for speed of access at different points throughout the world, meaning that content needs to be legally compliant with the laws of all the places it appears. Moonfruit sees a couple of copyright infringement claims each month across the 400,000 sites it hosts, says White, adding that it also has a good relationship with UK police in cases of more serious problems such as bullying and fraud.

"The thing we are most afraid of is that there is a complaint about copyright infringement on one site and they pull our whole service with hundreds of thousands of sites," explained White. "EdgeCast is an extension of our service, so we needed them to understand how our business works and how to contact us on priority channels if they get a complaint."

Graham Hann is a partner at Taylor Wessing, a law firm that works with both providers and clients of cloud services, and says data protection is one of the biggest areas of concern. "The primary issues are security, access and location. Data protection laws are very strong in the EU but less evolved in the US, and you can't ship data outside the EU without jumping through regulatory hoops," he explained. "So if a head office in New York accesses the HR records in London, for example, you could be contravening the European Data Protection Act."

Any businesses handling data are also obliged to keep that data safe and to make it accessible in the event that a consumer requests access to their records or if auditors require data. "Public awareness has grown over the years, but also the regulators now have very strong powers of enforcement and can issue large fines. There is also the risk to reputation and brand."

All businesses should perform due diligence on a company they are about to form a critical partnership with, including checks on the brand and its solvency. They should clarify how long their business is required to retain data, and check that their cloud provider can fulfil that. And as the cloud-service-provider market becomes increasingly competitive, businesses should check that data is in a transferable format should they choose to move to another supplier.

Larger firms will be able to afford bespoke service-level agreements with cloud providers. "The cloud has advantages of flexibility and scalability but one of the key drivers is cost and reducing capital spend," says Hann. "Most cloud providers therefore deliver low-cost services in a very commoditised way and with standard terms of supply. But those might not address the concerns of a large enterprise the way they do for a small business. So I'd expect voluminous documentation around speed, performance and uptime for a large business."

If the worst does happen, businesses can expect service providers' terms to cap liability and not to accept liability for loss of profits. Disaster recovery procedures need to be restructured accordingly.

"The worse case scenario would be if a cloud provider disappears, taking your business with it," says Hann. "More realistic, though, is security. For an institution like a bank, it could wipe billions off a company's value if data was destroyed or fell into the wrong hands."

All these issues are the same for startups and small business, says Hann, though without the funds to pay for a bespoke model they have to live with increased risk. "These concerns are easy to address if you work them into your planning, but if you don't know about them you can't do that – and there are thousands of startups and mid-sized businesses not aware of these issues."

Moonfruit's White says businesses need to do their research and take good advice before signing up. But startups might do better to use common sense. "Don't cripple yourself with anxiety," he says. "Getting advice up front is good but it's about risk assessment and risk management. Lawyers will always take the most cautious line as they are paid to do so, but sticking to that most cautious letter of the law can often stop innovation."

Ultimately, knowledge is power. The more you understand the risks and advantages, the better decisions you will make for your business.