People today utilise the internet for various things. However, one of the principal uses of the internet is maintaining contact with friends and family through social media and keeping abreast with the latest news and information. People access shared files and data anytime from anywhere in the world. Businesses and organisations utilise the internet for an ever-increasing variety of functions, including professional commercial applications and advanced technological platforms. Such services are exceedingly simple to start up and use and very frequently with minimal data entry requirements. Benefits of this nature would also accommodate the use of credit cards and associated information. A limited number of keyboard entries to commence with the service ensures full access to the operations of the internet and other applications. Understandably, the cloud environment stands easily reached, which in turn offers multiple business solutions and facilities.[1] Linked to these activities is a significant misperception as to the rights, responsibilities and legal implications of what appears to be an open, accessible and relaxed environment. These activities carry extensive consequences for the users, resulting in a complete shock and unforeseen implications for businesses and individual consumers.

An example of such misperception of the cloud arrives in the form of the broad public perception that the community possesses everything available on the internet. Therefore can stand liberally and limitlessly utilised. Understandably, this indulgence is flawed as the small detail of IPRs is predominantly copyright-based in this context and most other cases. It is present in almost every aspect of data loaded on the internet or in the cloud, whether shared, posted or transmitted. Immediately when a user uploads data onto the internet, that upload is invariably subject to terms that define other cloud users’ access and use rights and the ownership retained or relinquished by the uploading user of such data. These rights constitute an actual or constructive contract or license, provided it stands granted to the service or platform provider and potentially other internet users. Although sometimes difficult to discern, the terms of this type of contract define rights of use to the data for particular purposes or within certain limitations.

Regardless of the cloud services involved, license rights define the various parties’ rights in and to data in the cloud environment and other essential rights and obligations, whether the cloud service client is a licensor or licensee or, as is frequently the case, both.

The following are typical scenarios reflecting licensing of the cloud services:

1. Client owned data. Primarily where the customer uploads and stores data using cloud storage facilities. Whether that data is a photo, a word document, a soundtrack, logo or other software, they do so with a ‘use features’ of rights, whether express or implied, to the storage service provider. This ‘use features’ extends, at a minimum, to the right to make such copies as may be required to enable the provider to perform the storage, processing, backup and retrieval functions for the servers providing the storage facility. These servers often stand in different locations or jurisdictions, which may vary based on aggregate demand and the provider’s platform and arrangements for data balancing. The ‘use features’ of these rights stand referred to as content licensing. Further, when a client engages a service provider in making available IaaS or PaaS, the client similarly licenses or sub-licenses in the case of third party software uploaded by the customer to the service provider system for integration.[2]

   The parties may communicate and agree on the exact contractual terms of a license ‘use features’. Still, often they are at least partly implied through the actions and conduct concerning services agreed to by the client at service initiation, and the scope of the licenses may be broad. The fact stands that such terms may extend well beyond the immediate requirements of the services offered or provided. For instance, a relatively common right included under these licenses is ‘use features’ to the provider itself, the right to use the client data for the benefit of the service provider itself, including for the further development of the facilities for all customers of that vendor.[3]

2. Service provider owned/licensed software. Whenever a client engages a cloud service, the provider must similarly make a ‘use features’ license available for the customer for at least the necessary rights to use the service provider’s software interface and functionality or other components essential to the delivery and use of the relevant services.

   Cloud clients, especially in the public cloud, may be unaware that they are provided with content licenses to the service provider’s software at all, much less the actual nature, scope and duration of the rights granted. Even though the clients may retain ultimate ownership of their data, there is a real risk of losing control over it.[4] Often equally important other rights or obligations are contained or not included in the contract terms governing the use of the cloud service. These may also be unappreciated by the client.

The Frequent Challenges of Determining Terms

Ideally, the conditions under which any cloud solution stands delivered should stand explicitly and comprehensively stated in a written, static, readily accessible and understandable agreement. Again ideally, these terms and conditions should be known and understood by both the client and the provider, which is often not the case.

The growth of the cloud services delivery model has been rapid. It has challenged consumers’ ability and willingness to adequately assess and manage the legal implications and risks presented in contracting for and utilising cloud solutions. The sheer ease of initiation and use of cloud services belies the legal significance of the undertaking. From the initial set-up, from the contracting to the operational use of the services and through to termination agreements, cloud services present new but familiar variations on the risk and opportunity trade-offs presented in traditional technology service agreements. Specifically, almost all the significant issues long recognised as complex in IT outsourcing appear in cloud services.[5]

By their very nature, Cloud solutions are more susceptible, when compared to prior bespoke technology solutions, to the client proceeding with adoption and use without a clear understanding of the entire contractual dimensions of the agreement undertaken. Additionally, this might result from commando-style keyboard click-through practices. The client effectively ‘clicks acceptance’ to online terms without even making an effort to review and understand the contract undertaken. Of course, there have always been those clients who do not read contracts. Still, with the proliferation of ‘click-through’ contracts over the internet, the practical ease of elective ignorance has never been greater, and this has often contributed to reduced vigilance around contracting.[6] One of the biggest strengths of the cloud is its sheer ease of use and access and has no doubt contributed to this, sometimes reducing the contracting process to seemingly nothing more than navigating the internet.

The cloud service providers often prepare the terms and conditions of service delivery for cloud solutions and frequently only cover limited issues. Determining actual contract terms applicable to the services is more complicated where items are missing. Those missing contractual terms may stand implied in such cases, where required under the agreement to make commercial sense. Terms may also stand implied in law, such as the provider’s rights or a third party under the copyright or patent law or may stand indicated as necessary to efficacy the cloud agreement. Terms may also stand drawn from what appears as the parties’ reasonable expectations, including as reflected in their actions or conduct. The result is that frequently with cloud solutions, especially public cloud solutions, any comprehensive understanding of terms only starts with those expressly required by the service provider in the ‘accept-before-entering’ gateway and therefore must be supplemented with implied terms. Once established, implied terms can stand enforced, but the burden of proving implied terms can be onerous and raises risks for either or both of the parties.[7]

The frequent lack of certainty over precise terms may be acceptable and even appropriate for a cloud solution, subject to purely casual use. Think of a strictly personal email service used for non-critical communications. However, to the extent that a cloud service involves critical functions or sensitive data, it becomes increasingly crucial for the client to clearly understand the terms and rights to assess the appropriateness of use. Again, one of the core strengths of the cloud, the practical ease of initiation of use, has led to the situation where the adoption of cloud services has frequently outpaced careful evaluation and management of risk.

The need for the client to evaluate the suitability of available contract terms against their requirements is unambiguous in the case of cloud solutions, especially the public cloud, where there may be a slight opportunity or even no possibility for the client to have an input on the terms available. Often, the customer’s choice is acceptance of the service provider’s standard terms or preceding the adoption of the cloud solution entirely. Such a stark set of alternatives further complicates both the speed and the ease of acceptance and approval. The result is that clients may unwittingly make wrong trade-offs between cost savings and flexibility versus risk.

A further consideration in cloud contracting is that the party seeking to enforce a right or obligation affirmatively inevitably has some more significant threshold burden than the opposing party. Still, this is especially true if the right or duty to be imposed is not expressly part of their agreement and must stand established as an implied term. Again, cloud solutions present a dilemma: their ease of contracting, while a core strength, also presents significant oversight challenges. Opportunities promising quick-fix cost savings and flexibility may drive hasty decisions that have substantial business and risk consequences. Wanting or needing a special right of assurance in a contract is far from establishing it.[8]

The ‘take-it’ or ‘leave-it’ understanding is a reality of many public cloud solution contracts and is another critical consideration. Service providers are often resistant to any modifications to their contract terms. Some of this resistance may be the traditional opposition of any party in any transaction to changes in their established and most preferred conditions. However, many cloud solutions involve engineering practices or agreements that place convenient limits on the ability of the service provider to accommodate designated consumers’ favoured contracts, much less give contractual assurance of doing so. Additionally, one of the core characteristics of the cloud is the ease of provisioning, including contracting, where service providers are often not set up to spend effort and resources on contracts or accommodating variations in terms of services for individual customers. Even where a vendor may be able and willing to make a client’s costs available, such costs should pass on to the client and adversely impact the cloud solution’s financial benefits. For the customer, achieving absolute value from a cloud solution inevitably demands a careful and responsible balancing between cost savings and functionality benefits with risk and strategy.[9]

Cloud Contract Terms

Beyond the drawbacks and challenges often faced in cloud services contracting, consideration should stand given to the substantive terms of an actual cloud services contract and what it should contain. In doing so, significant leverage may remain resulting from the prior knowledge of technology delivery, namely traditional outsourcing. Outsourcing has been through a critical evolution in contracting over the past decade. The cloud merely represents the latest means of delivery of technology solutions, following on from initial modern outsourcing or offshoring.[10] Each of these delivery models involved stabilisation and growth phases intensely driven by contracting models. The contracting pressures were the same in each, developing a model to support a practice that gave clients sufficient assurances to permit the service’s adoption.

Consequently, contracting difficulties can stand evaluated through contrasting cloud licenses, which challenges traditional outsourcing contracts and conditions. Such an exercise provides a means to critically analyse relevant client protection provisions, which remained developed through outsourcing contracts. The practical challenge is how to combine this contracting experience and learning from outsourcing with the flexibility and standardisation essential to cloud computing solutions.

The business environment in which the cloud operates presents many challenges. Business users face new and changing legislation and regulations (such as data protection) impacting the provision and use of cloud databases and computing services. Further, capability and competition within the cloud and outsourcing market are growing as cloud service contract agreements and terms are evolving.

Further enhancing the discussion on cloud contracting, particular attention should stand applied to the following essential contractual issues: license ‘use features’, services commitments and services quality protections, client control rights, compliance obligations, data and security protections, IP protections, benefits continuity protections and end of term assistance.

Most of the discussion will compare and contrast representative approaches to the issues taken in the traditional outsourcing model as a primary point of reference. This traditional approach to services will be compared with the method frequently found in the pure public or utility cloud model, representing the spectrum extreme in cloud services contracting, more towards the actual cloud services approach. Then, a middle-ground view will stand reflected. A discussion on the issues in the context of private or hybrid cloud solution models follows, where the cloud service provider may stand better positioned to be responsive to particular or individual client requirements.[11]

In the discussion, the terms ‘contract’ and ‘license’ will stand used interchangeably. While acknowledging that all licenses are indeed contracts, but not all agreements are licenses, the interchangeable use of the terms is a method of ease for the discussion and to illustrate the various considerations raised in association with the placement and use of data in the cloud. Nonetheless, because of the significant role that licensing concepts play in many cloud service solutions, the natural tendency is often to refer to the cloud service contract as a license. Hence the reference in the title to two practical aspects of licensing in the cloud.

Cloud License Utilisation Features

The first, and in many respects pivotal, set of contract issues associated with any cloud solution contract is the actual license ‘use features’. This set of problems encompasses the subject of the permissible users and the use of the license. Most cloud service agreements involve at least two groups of license ‘use features’:

A cloud service provider ‘use feature’ is granted to the client, and

A client ‘user feature’ accorded to the cloud service provider.

The discussion will focus primarily on the cloud service provider to client ‘use features’, which is the ‘use feature’ establishing the scope and nature of the cloud services. In most cases, the client to cloud service provider ‘use features’ is mainly ancillary to the services and focus on addressing the use to which the client’s data, including software, must be put by the cloud service provider in performing the cloud services.[12]

1. The subject of the license. The first consideration in any right of use or license ‘use feature’ is the purpose of the ‘use feature’. In cloud services or cloud computing, the topic matter or service may be software, as in the case of SaaS, or it may be a technology platform as in the case of PaaS. It may also be a combination of a software and technology platform as in the occasion of IaaS. In identifying the subject, it is essential to consider how the topic is defined. For instance, whether the use of software includes the usage of its source code, which may be substantial if the client needs to make modifications or enhancements, including for purposes of interfacing or integrating with other software or processes. Similarly, it is crucial whether the software provided includes updates and new versions and whether the client has the discretion to move to such updates or new releases.

   In addition, this is an area where the nature of cloud services or cloud computing often drives limits in the client’s discretion regarding the implementation of software updates or new versions. Often the SaaS model is built as a one-size-fits-all solution, where software updates are uniformly rolled out for all of the services or with limited flexibility for clients to select different releases or version levels for their use. At the same time, this uniformity can be one of the core strengths of the cloud for software services. Enabling clients to keep current with versions and releases without undertaking the upgrade implementation themselves may be a limitation itself of the cloud solution, as clients are taken to updates, whether they are ready or not.

2. Permissible users. The next issue to stand addressed in analysing a cloud solution is determining who has the right to use the solution proposed. The customer’s identity often drives client requirements here. For instance, whether they are an individual or a business enterprise, the purpose or purposes for which the cloud solution stands implemented may be noted in casual personal use or business use. Other significant matters include the number of users permitted (depending on the number of firm staff requiring access) and whether the client may allow third parties (such as their customers or contractors) to access the cloud services.[13]
3. Permissible use. A license ‘use features’ frequently also address the allowable uses for which the cloud solution may stand set by the user(s). User rights can stand expressed as general or specific, and particular ‘use features’ may explicitly provide that only expressly permitted uses are allowed. Such an exclusivity provision makes defining the scope of the permissible ‘use features’ critical. Use limitations may be based on aspects of the solution such as access, use, execution, reproduction, display, performance, distribution, modification and creation of derivative works of the software/platform; or based on the activities of the client, such as use in operations of a defined business or geography. The customer must clearly understand the scope of service for which they require the cloud solution, ensuring that the user rights provided under the contract terms are sufficient to meet those requirements.[14]

   The pricing agreements of a cloud solution may be closely parallel to or adequately define the license ‘use features’ terms. For instance, changes may stand based on the particular use of the solution, such as access to and use of different software modules, or numbers of users (named or concurrent) or size of cloud storage. Through such agreements, the client uses the service on a pay-as-you-go system,[15] where no particular level or volume of the grade of service delivery stands provided. However, the client may increase and decrease the service usage as needed (and available).

4. Terms and termination. Contract provisions relating to the contract period and circumstances of termination vary dramatically among cloud solutions and drive crucial considerations for the client. These requirements broadly define the extent to which the provider is making a threshold commitment to deliver or provision the cloud solution and, correspondingly, the level of assurance the client may have that the cloud solution will continue to be available for their use. The core issues are how long the cloud solution stands committed as accessible and has a dedicated period of provision. Further, under what circumstances may such provision nonetheless stand terminated by the provider. A closely related issue is the right to partial termination, including suspension of the service for a limited time.

   If there is no limited committed term of providing a cloud solution, there is a correspondingly limited reason for termination rights. In many cloud services and computing solutions, the committed contract period is short, with little or no notice of termination required (by either party). If the client has a particular business need, longer committed period contracts and termination periods may be necessary to enable the customer to incorporate the solution into their operations prudently. When cloud service providers seek to offer cloud solutions targeting innovative and energetic business operations, it becomes increasingly important to provide specifically committed contract periods. With a move to fixed service provision determined terms, the issues around early termination become significant.[16]

   One problem with committed conditions in cloud solutions is the active period, which includes renewal rights and are renewal rights automatic or elected? In service agreements, committed periods may range from short notice periods, typically thirty days, to multi-year terms. In evaluating the certainty of a cloud solution’s continued availability, it stands essential for the client to consider the minimum duration that may stand applicable to the contractual agreement.[17]

   Where a cloud contract contains a committed period, the conditions or circumstances under which either party might terminate the arrangement before the expiration of its term become relevant. Classically, service contracts provide that termination rights be available to a party in circumstances of a material breach by the other party, recognising that what constitutes a material breach may vary between the parties. However, some termination rights are parallel to both clients and service providers. The old-style service agreements often provide broader termination rights to the customer for breaches by service providers than to the service provider for violations by the client, in reflecting on the most general scope of (performance) responsibilities of service providers (and thus a more comprehensive range of potential material breaches) in traditional outsourcing agreements. It stands common that the scope of a possible material default by the client giving rise to a termination right by the provider is limited to non-payment. Another traditional default circumstance giving rise to termination rights (typically also a termination right for the client) is multiple non-material breaches that constitute material default to frequency. A terminating party should regard the prevailing circumstances. Its position would stand strengthened if it could lead to a breakdown in relations and the prospect of continuing substandard performance.[18] Additionally, termination rights for convenience and circumstances of force majeure remain frequently included in licenses with fixed terms.[19]

Service Commitments

1. Contract obligations and terms: The issue concerns how the service provider retains the ability to make changes in the services unilaterally and to what extent.

In the traditional outsourcing contracting model, terms of service can only stand modified by agreement. Provisions such as force majeure may provide relief from performance obligation in certain circumstances. Still, the service provider generally has no unilateral rights to alter or modify their performance obligation during the agreement term.

The commitment to contract terms is not always present in the standard public cloud contract. Instead, service providers of pure public or utility cloud solutions, like Facebook (cloud-based online social media) and Dropbox (cloud-based online file storage). Have terms of service that often reserve for the service provider the ability to change those terms at any time at their discretion. Sometimes this right is expressly stated as a unilateral right to make changes. Other times, the right stands more indirectly preserved by incorporating external documents (often linked) such as policies and procedures that the provider can vary from time to time.

In some cases, the provider commits to provide some form of notice of changes, but in most cases, clients have to monitor the service provider’s website for changes to the contract terms. To enforce these changes may stand limited to a degree of reasonableness under applicable law. Still, the existence of such a unilateral service provider right in any cloud solution is a significant and defining consideration for the client, inevitably sowing uncertainty for them. Cloud solutions marketed for business adoption, such as a SaaS model for enterprise applications utilising a private or hybrid deployment model, tend to address this issue in a way closer to traditional outsourcing. It provides the client with the assurance that contract terms can be changed only by agreement between the provider and the client.[20]

1. The obligation to services. This issue involves the extent to which the cloud service contract commits the service provider to deliver specified and expressly defined services or gives the service provider latitude in the services that may stand performed.

The traditional outsourcing contract stands created on the premise of a detailed, customised service definition often contained in all-encompassing, descriptive statements of work. These service descriptions may contain common elements between a service provider’s clients. Still, they are frequently tailored to the customer’s specific operational and practice requirements and therefore, the outsourcing contract and delivery models stand entirely oriented towards this.

Standard public cloud solutions classically provide high-level, general definitions of traditional services common to all clients. Here, the service provider makes no explicit commitment to conforming to high-level public services definitions. The service provider typically takes the middle-ground approach. Frequently seen in SaaS private or hybrid cloud solutions involves contracts that may contain relatively detailed service definitions in definitive statements of functionality or work but not customised service definitions tailored to a client’s specific operational or practice requirements.

This cloud model takes a one-size-fits-all approach to current standard facilities for the representative clients to preserve that efficiency which marks cloud solutions.

1. The minimum term obligation. This issue involves the extent to which the cloud service contract commits the service provider and the client to maintain the contract for a particular period, subject to defined termination rights, such as in the case of an uncured default by one of the parties.

On this issue, the outsourcing model has traditionally remained founded on a commitment period of years applicable for the service provider. Although the standard term in outsourcing agreements has shortened over the past decade, outsourcing contracts routinely provide an initial active period of three to seven years. They usually include elective extension terms of one to two years exercisable by the client to terminate early (for convenience) with a notice period and the payment of pre-established termination charges. The standard utility cloud contract classically provides little or no minimum term, reflecting (as discussed below) the frequent absence of performance commitments generally by the cloud service provider. In such circumstances, the cloud service provider is unobligated to make the services available. The middle-ground private or hybrid cloud contract often carries a relatively short minimum term, but in some cases, may require a notice period before termination by either party.[21]

Quality Protection of Services

1. Testing and acceptance. This issue involves the extent to which the cloud service contract facilitates the client to test and accept the services (or other deliverables) as part of the initial performance or delivery.

   The traditional outsourcing contract model often builds a level of user testing and acceptance into the initial implementation of the services. Trial and approval are also commonly constructed into the project methodology around all deliverables following the initial deployment, including service delivery transformations. These procedures are designed to assure the client that the services meet the client’s pre-defined operational and practice requirements and, to some degree, pledge to the provider that the customer will accept (often a prerequisite to payment) if the conditions stand achieved.

   Classically, the standard utility cloud solution contract does not provide for testing and acceptance, either at service initiation or subsequent delivery level (such as software upgrades). In some cases, a trial period may allow the client to decide whether to proceed with the actual adoption and production use. Still, often this is adequately accommodated by allowing the customer to terminate the services whenever they determine the solution does not meet their operational or practice requirements.[22]

   The middle-ground private or hybrid model contract often provides testing of the significant transition milestones during initial implementation and subsequent deliverables during the term. These tend to be generic and aimed at permitting the client to make a go-no-go decision rather than confronting a delivery commitment on the part of the service provider.

2. The obligation to service levels. Service levels and their related provisions constitute essential contractual devices in establishing, measuring and reporting service performance. This issue involves how the service provider provides contract commitments that the services will conform to specific pre-defined performance requirements.

   Service levels typically play a crucial role in a traditional outsourcing contract model. Outsourcing agreements often provide detailed and client-specific service levels. These serve as both a contractual commitment of service performance (for instance, establishing service availability, response time, transaction rate, processing speed, accuracy and the like) and the basis of credits (penalties) for failed performance.[23] Typically, these afford the ability to the client to modify service levels and credits to address both problem areas and evolving areas of the customer’s concern, together with detailed reporting of the service provider against the service level requirements. In many cases, certain pre-defined levels of service level failures may be the basis of termination rights, which may be exercisable by the client.[24] Recognising that in no event can service levels adequately address the full range of performance, outsourcing contracts classically also provide more general performance requirements, such as the commitment to perform the services with reasonable skill, care and diligence.

   Standard cloud solution contracts classically do not include significant service provider commitments to service levels. More often, where service levels may stand included will form a component of the general service description that either does not provide service level credits or establishes unrealistic hurdles to obtaining such service level credits. Understandably, for the standardised and low-cost solutions, the standard cloud service providers are reluctant to guarantee the quality and reliability of duty (with a penalty for non-compliance). As providers seek to broaden the acceptability of public cloud solutions in business environments, many are reconsidering offering some service level commitments as a way to accommodate their client’s needs and attract new business. Even in such cases, the service level provisions often function defensively by being structured to restrict the service provider’s responsibility to limited credits that operate as exclusive remedies, or their equivalent, for failure to attain the defined service level.[25]

   The middle-ground private or hybrid solution contracts more commonly contain service level provisions. However, these service levels tend to be focused more on supplier technology rather than reflecting the particular client’s needs associated with the solution. Nonetheless, these service levels may carry meaningful service credits for failure to attain the service provider’s defined service levels. In general, only those clients with high subscription and upfront payments of significant fees have the power to negotiate for service level commitment.[26] In larger cloud service projects, service providers and customers may agree on a substantial list of the key performance metrics to express the degree of performance with which both parties are comfortable. Cloud service projects on a smaller scale will typically cover far fewer performance metrics.[27] Therefore, it is essential to select which performance metrics are most crucial in achieving the client’s business needs and objectives and select measurable and auditable metrics, with the metric standards, measurement mechanisms, and reporting requirements documented clearly and concisely.

Control Rights of the Client

1. Rights to determine architecture: This issue involves the extent to which the cloud service contract gives the customers rights on the technical design that the service provider utilises in the performance and delivery of the service.

   The traditional outsourcing model contract classically gives the customer the right to approve the design used by the service provider. This approval may be part of the initial contractual agreement, with assurances provided to the client that changes will not stand made in the technical design via modification control protections. The client typically enjoys the right to dictate enhanced technological innovations, although implementation may involve additional services and carry new changes.

   The standard utility cloud solution contract invariably gives the client no right to approve technical architecture. Similarly, the middle-ground private or hybrid cloud model also provides the customer with no right to support technological innovations. It is one of the core distinctions of the cloud (over traditional bespoke outsourcing) that it primarily offers clients ‘one-size-fits-all’ solutions.[28]

2. Modification or change control rights: This issue involves the extent to which the service contract provides consumer protection from modifications or changes made by the service provider in the services; any of these actions that impact those services or the customer’s use of them.

   The traditional outsourcing contract model requires that any amendment or change in services, which has a direct or indirect impact on the services or the client’s use of the services, must be contested by the customer. This client protection assures that the services will not stand altered by a method that results in additional costs for the client or diminishes required functionality.

   The standard utility cloud contracting model, with solutions driven by a standard one-size-fits-all[29] service, typically allows the provider to modify and make changes in the service area without the client’s notice or consent. The middle-ground private or hybrid cloud contract frequently requires that the service provider inform the customer of changes and allows the client to terminate the agreement if the changes adversely impact the services or the client. The service provider has no obligation to obtain the customer’s consent to the changes.

Obligations Towards Legal Compliance

1. Assistance in complying with laws: This issue involves the extent to which the services contract obligates the service provider to assist or accommodate the client in meeting the client’s legal compliance requirements, particularly in the activities and operations of the customer involving the use of the services.

   Compliance with laws is an essential element in the traditional outsourcing contract model. Typically provisions oblige the service provider to comply with all the laws applicable to the services, their delivery and performance and assist with the client’s compliance related to the services. These provisions stand based on the recognition that a customer cannot transfer their compliance responsibilities to a third party and therefore necessarily needs to build assurances promoting legal compliance.[30]

   The standard public cloud solution offers limited flexibility to adjust the services to a particular client’s legal requirements. Some of this inflexibility arises from the frequent heavy reliance on third-party contractors in public clouds.[31] In reality, it may be almost impossible for the service provider to assist the client in complying with local laws, given the cross-border nature of the cloud offering. Although service providers may endeavour to perform the services in compliance with applicable laws, the contract invariably will not include commitments respecting particular legal acquiescence. They stand coupled with the service provider’s reserved ability to make unilateral changes in the services (often without notice). The result is that a client-facing legal compliance consideration must continually monitor the services and their use to ensure good compliance. In some cases, the customer’s ability to accurately observe the services is not feasible within a cloud solution, rendering some solutions inappropriate for specific uses.

   The middle-ground private cloud or hybrid cloud model often provides a certain level of flexibility to configure the service to meet diverse client compliance requirements. These more tailored solutions are also frequently designed and operated to allow the client more assurances on legal compliance.

2. Audit review rights: The issue involves the rights provided to the customer to inspect and assess the service provider and their provision of the services.

   In the traditional outsourcing model contract, clients are typically provided with well-defined rights to undertake operational and financial audits of the service provider and the services (including third-party contractors).

   The standard utility cloud solution contract commonly provides no audit rights for the client, particularly concerning secondary contractors. The service provider in standard utility cloud solutions frequently does not even disclose whether secondary contractors have stood used.

   In this area, middle-ground and private or hybrid cloud solutions often provide some audit rights. Typically, however, these rights do not include any right of territorial access to the service provider’s facilities for audit or review purposes.[32]
   
   

3. Liability: Contractually, one of the core compliance assurance mechanisms is the potential exposure to liability for failure to perform according to the terms.[33] Thus, one of the threshold issues in any services contract is the extent to which the service provider may stand exposed to liability for non-performance of contractual obligations.

   Industry practice for the traditional outsourcing model is for liability to be limited to direct damages and further restricted to a pre-defined (or calculable) limitation of compensation, subject to specific exclusions for breaches or defaults under the contract.[34] Typically indirect and punitive damages are expressly disclaimed, except in cases of significant misconduct, such as gross negligence, fraud or willful abandonment.

   The standard public cloud solution provides minimal liability for breaches or failures of any type. It is common practice that the service providers’ standard service contracts will exclude liability as much as possible. In some cases, the cloud service provider will assume that the functions will be executed (if at all) with care and equitable ability[35] but will commonly not provide monetary compensation in the event the service provider fails to comply with the given undertaking. In such circumstances, the public cloud contract may state that the service provider will use commercial endeavours to rectify problems of non-performance. Often, this commitment is the client’s sole and exclusive remedy for non-performance.

   The middle-ground private or hybrid cloud model often has a narrowly defined scope of potential damages, such as direct costs only, subject to a limited maximum usually determined by the contract price or changes or a fixed sum and subject to specific exclusions from such limitations. All losses that are special, indirect or consequential are most frequently excluded entirely under the contract. Additionally, the service provider will seek to disclaim liabilities for specific events or incidents to limit their potential liability exposure. These will include service outages and data loss, delays, delivery failures or other damage or loss resulting from the transfer of data over communication networks and facilities. The client needs to understand the details of the protection offered under the service contract. Evaluate whether the risks are acceptable in the context of their intended use of the services before entering the contract.

Security and Data Protection

1. a) Location of data: This issue concerns provisions restricting or identifying where the client’s data, used in conjunction with the cloud service, may be stored or processed. The location of the client’s data can have significant implications for both security and legal compliance.

   In traditional outsourcing contracts, permissible locations for the service provider’s storage and processing of the client’s data stand defined and approved. Changes to these sites (at least involving material changes, including any transfer to a different country) require the client’s approval or, at a minimum, compliance with the change control processes (which itself likely requires the customer’s approval).

   There are typically no restrictions on where the client’s data may be processed or stored in the standard public cloud contracts. In fact, in many cases, the technical infrastructure used by the service providers may itself even limit the service provider’s ability to control, or know, the location of data processing and storage: for instance, where networks of third parties stand utilised to provide storage and processing.

   Private or hybrid cloud solutions are more likely to provide assurances about data location by frequently fixing sites by country. Nonetheless, even with such safeguards, broader consideration must be given to the localities from which the service provider may access the client’s data, resulting in the potential for deemed exports or transfers due to access from a foreign jurisdiction.

2. Information security: Information security is a primary consideration in any service contract. With the focus on the extent of the security assurance that the client’s data is provided or created by the service provider in creation with the services, the data will be protected from access, use or alteration by unauthorised third parties.

   Outsourcing contracts classically contain detailed information security provisions focused on the safety to meet the client’s specific requirements. Additionally, the client under an outsourcing contract usually has the right to require changes in the service provider’s security practices, subject to the possibility of the additional work constituting new services for which there may be other charges.[36]

   In the case of standard public cloud solutions, information security provisions stand typically included in the contract. These solutions, however, tend to be standardised offerings and based on the use of the service provider’s standard controls, with little or no ability to make modifications to any specific requirements of the client.

   Middle-ground private and hybrid cloud solutions tend to treat security as a service and may provide elective or optional arrangements from a pre-established suite of security offerings.

3. Return, disposal or destruction of client data: This issue involves the extent to which the service contract assures that the service provider will return or destroy the client’s data and the timing of that return or destruction.

   With traditional outsourcing, the contract gives the client clear and direct commitments from the service provider that client data will be returned or destroyed at the client’s option. Not only at the termination of the agreement. But also when the data has no further use or requirement for the performance of the services. Similarly, outsourcing contracts classically commit the service provider to return the client’s data at any time upon the client’s request.

   Standard public cloud contracts classically contain little or no assurance that all of the client’s data will stand found, erased, or returned. As with limitations on some service providers’ control of the location of their client’s data, the technical structure of many standard public cloud solutions places boundaries on the service provider’s ability to provide assurances about return or destruction.

   Middle-ground private or hybrid cloud solutions classically provide that data will stand returned or destroyed, although the alternative selected is sometimes at the service provider’s determination.

Intellectual Property Protection

1. IP rights of clients’ data: The data in the cloud can be any data in any form. Each and any data enjoys some level of IP protection (most frequently copyright in this context, but this does not necessarily exclude any other IPRs from the discussion, particularly personal data protection in the cloud as a primary concern).

   It is well established that copyright subsists in original works (including electronic data) unless: (i) it is de minimus and hence fails to meet the minimum threshold for copyright protection; (ii) it is copied from others; or (iii) the copyright has already lapsed. In some cases, data, for instance, a drug formula, may also be protected as a trade secret or a potentially patentable subject matter. The issue involves the ownership of IP in the data that clients may provide or produce through the cloud services and the extent to which the service provider is allowed to use such data.[37]

   The traditional outsourcing model stringently protects the client’s data ownership and specifies the service provider’s right to access, store, process, make necessary copies and use the client’s data (and its associated IP rights) to provide the service. Similarly, the outsourcing contract will detail the ownership of any IP developed by the service provider (including jointly with the client). It will allocate these rights through ownership and license rights. Essentially, it is a content license provided by the client to the service provider. It stands commonly seen that such license covers use by the service provider and their third-party contractors and strictly limits use for such purposes.

   The standard utility cloud model provides that the client retains his ownership of data he provides and ‘use features’ of a use license to the service provider. The prominent players in the market, such as Hitch[38] and Apple (iCloud[39]), make it clear in their terms of service utilising their services. The clients ‘use features’ is a worldwide, perpetual and royalty-free license that allows the service provider to use the client’s data. Some service providers specify that the license ‘use features’ is for the use of data to provide, promote, or improve the services, but some are silent on the scope of such content license. More likely than not, the content license is a permanent one that does not end upon termination or expiration of the service. Such broad licensing raise risks for IP owners putting data on a public cloud. These risks include the possibility that trade secrets may lose the necessary element of confidence. As for patent rights, risks arise as the novelty required to register a patent may be compromised by placing the patentable subject matter on a public cloud under such a broad license. The maintenance of innovation novelty may be lost when the data is accessible to many people within an enterprise without proper access controls. It remains to stand seen how courts will approach such a situation, leaving this a considerable business risk. Another issue is the more precarious position of data loss, loss of control of the client’s IP. Suck loss may result in the absence of a clear commitment by the service provider to safeguard access to the data. Additionally, permanent and complete erasure or prompt return of data when such data stands no longer used or of value or need for the services (as discussed further below in connection with the end of term assistance).

   The middle-ground private or hybrid model typically provides that the client retains ownership of data (and its associated IP) provided or processed through the cloud services and ‘use features’ a content license to the service provider. It is essential for business clients with high-value IP,[40] business data and trade secrets to have an express provision in the contract covering IP ownership, the scope of the content license, termination right of the content license and return and removal of data upon conclusion. Unlike the standard public cloud model, such rights may stand protected in middle-ground private or hybrid model contracts.

   IP considerations also drive some other issues previously seen in cloud agreements. For instance, preservation of confidentiality and novelty critical to IP protection highlights the importance of contracts clearly defining access rights. The use of end-to-end encryption to prevent unauthorised access and preserve the data’s privacy and originality can also stand utilised to mitigate risk. Further, because IP protection is primarily territorial (local law determined), the storage location of cloud data or processing significantly impacts the IP rights. Suppose the service provider’s servers storing client data stand in a country where the customer data remains unprotected under local IP laws or where IP rights are difficult to enforce. In that case, risks will increase if the client’s IP is hacked locally or misappropriated. Hence, the location of data storage by the service provider is a significant risk factor for IP-rich clients, making countries with solid IP regimes preferred and assurances that the client’s data will remain there substantial.

2.  Developed materials and ownership. Ownership and developed material involve the extent to which the service contract provides that the client retains possession and proprietorship of the IPRs of the data (including metadata) and materials that may stand developed through the provision of the services.

   The traditional outsourcing model clearly defines and allocates the client’s and the service provider’s respective rights in the IP developed through the performance of the services. Once ownership is established and set in the developed materials, either restrictive license provisions for such IP or the contact’s general provisions respecting licenses to the parties’ IP may apply.

   Standard public cloud solutions classically allow clients to retain ownership of their data. Still, they frequently do not define ownership of data created (even derivative) or IP developed in the provision of the services. Such arrangements raise risks of unauthorised use and potential loss of ownership and control.[41]

   Typically, the middle-ground private or hybrid cloud contract provides that the client retains possession and proprietorship of any data provided, processed, or created through cloud services. These provisions frequently also offer limited rights to ownership of customisations of the services (such as customised software interface), with license-back (to the service provider) privileges.

3. Non-infringement warranty and indemnity. Such issues involve the extent to which the cloud contract requires the service provider to warrant that the cloud services do not violate the IPRs of a third party and guarantee the client against costs and damages associated with third parties party claims of such infringement. This issue encompasses the implied warranty and indemnity by the client to the service provider against claims by a third party that the data or other material provided by the client, or the use to which the client puts the cloud services, oversteps the third party’s IPRs.

   The traditional outsourcing contract contains a service provider’s warranty of non-infringement and indemnities against third party claim(s) that the cloud services (at least when used as contemplated under the contract) infringe the third party’s IPRs. Less frequently, the agreement may provide for a warranty and indemnities from the client that data they provide (and make available for use by the service provider), or uses to which they put the services, infringe third party IPRs. Some significant ancillary issues associated with any indemnity arise from outsourcing. An example: Is an extent to which the protection is subjected to, or excluded from some, or all of the limitations of liability contained in the contract and the scope of remedies available to the indemnitee in the event of an actual or alleged infringement, as discussed further below. Indemnities are frequently the subject of meaningful negotiation in any outsourcing transaction.[42]

   The public cloud solution regularly entirely omits warranties and indemnities by the service provider and broadly bends such issues within the general ‘as is’ condition under the provided services.[43] Nonetheless, it is more common that standard public cloud solutions include indemnities and even warranties from the client, particularly regarding data or materials provided or used by the client in connection with the cloud services. These aspects come in addition to their appropriate infringement notice and take-down procedures imposed in compliance with the safe harbour provisions of the USA’s DMCA 1998, Electronic Commerce Directive 2000/31/EC[44] or other similar legislations.

   The middle-ground private or hybrid cloud often includes some level of provider infringement indemnification but less frequently includes warranties of non-infringement. Typically this compensation is limited to transgression associated with the deployment of the cloud services, but it is often narrowly scoped and subject to far-reaching exceptions. As with the standard public cloud solutions, middle-ground private or hybrid cloud solutions frequently impose a greater level of client non-infringement warranties and indemnities, including an arrangement to the service provider’s notice and take-down policy.

4.  Remedies for infringement: The issue involves the scope and nature of the solutions provided should there be a claim of infringement against the client (or service provider in the case of a non-infringement warranty or indemnity by the client) arising from the provision or use of the cloud services. The remedies provided under such an indemnity are a critical component of the compensation itself, as they define the scope of potential liability and responsibility of the Indemnitor.

   The traditional outsourcing contract typically provides express protection remedies if the services infringe third party rights. These solutions consist of the obligation to indemnify for costs of defence and any judgement or settlement. In addition, it is to either obtain any necessary rights to continue the provision and use of the services or to replace or modify the services so that they do not infringe a party’s rights without a material decrease in functionality. Frequently, the actual choice of these remedies is the election of the service provider. With its primary focus on services, the outsourcing model typically does not allow the service provider the right to cease performance (withdraw the service). This situation leaves the provider obligated to either obtain the necessary rights or modify or replace the infringing portion of the services, at the risk of breaching the contract for its failure to do one or the other. A related issue of significance is whether such defined remedies are the exclusive remedies of the indemnitee for any infringement or if others are available, such as the ability to terminate the agreement or make a claim for other damages. A warranty of non-infringement maybe it’s self-serve as the basis of the exercise of rights under the contract in the event it is breached, including a claim of material default that may give rise to a termination right.[45]

   The standard utility cloud terms of service typically offer little or no committed remedy in case of infringement, which is consistent with the service provider’s natural right to terminate the provision of the services unilaterally.[46]

   The middle-ground private or hybrid cloud contract, more likely than not, includes some remedies in the case of infringement. These solutions typically include the modification or replacement alternatives found in the traditional outsourcing agreement. However, frequently, the service provider has a right to terminate the services if they determine neither of these options to be commercially viable. Usually with a refund to the client of amounts paid, sometimes reduced based upon use up to the time of termination.

Protection of Service Continuousness

1. Personnel continuity: This issue involves how the service contract assures the client that the service provider will seek to maintain key personnel to provide support for the services. Such continuity can be an essential element in guaranteeing the client that the services will stand appropriately performed.

   The traditional outsourcing model identifies a group of service provider personnel or positions that the service provider is obliged to maintain for service delivery to the client over a defined period and often offers protection on a service provider’s average personnel turnover.[47]

   The middle-ground private or hybrid model may provide some commitment to continuity for a limited number of key personnel for mainly crucial functions or activities.

2. Non-suspension/interruption. This issue involves the extent to which the contract expressly prohibits the service provider from interrupting or suspending the services.

   The traditional outsourcing contract prohibits any suspension of services (subject to defined termination rights by the service provider) and requires detailed business continuity planning. Outsourcing contracts typically also state that under no circumstances can the service provider withhold the client’s data, including specifically to gain an advantage in the event of a dispute.[48]

   Consistent with the lack of overall commitment in respecting service provision, the standard public cloud terms of service frequently expressly acknowledge potential interruptions of services and do not commit to business continuity.

   The middle-ground private or hybrid cloud contract regularly provides special rights to limit users to protect the integrity of the services. It may contain provisions regarding business continuity procedures and practices.

Term-end Protection

1. Termination assistance. Exit or termination agreements represent a critical set of considerations associated with adopting services, especially in business operations. It is essential that, as part of a client’s adoption of a cloud solution, they carefully evaluate and provide for a viable exit strategy, considering the support they can expect from the service provider and the demands they expect to face at that time. The provisions in service contracts concerning the parties’ respective obligations when the service or agreement stands terminated are crucial. The client must evaluate such responsibilities in the light of their anticipated options when the facilities end. It is essential in the cloud context where the client may have transferred, shared or stored data in the cloud or developed a degree of reliance on the cloud services as part of their business operations. This issue involves the extent to which the contract commits the service provider to assist the client at the termination of the services in association with the client’s changeover to the facilities in-house or successor service provider.[49]

   The traditional outsourcing contract contains detailed provisions addressing the service provider’s obligations to support the client in transitioning to successor provision at the termination of all or part of the services (including the extension of services to the extent that additional time stands required for the successor agreements). These provisions aim to ensure the client has access to appropriate support to avoid the disruption of its operations. Such comprehensive requirements address most of the elements of service delivery from the return of the client’s data to the infrastructure (equipment, software and personnel) used in the service delivery.

   The standard public cloud terms of service typically provide a right for the client to access its data in cases of termination, except in some cases where the decision is by the service provider for the customer’s default. Consistent with the overall absence of service assurances in the standard public cloud model, contracts do not provide further assistance to avoid disrupting the client’s operations.

   The middle-ground private or hybrid cloud model may allow the client to extend services and some reasonable assistance in the transition to a successor agreement.

2. Data transmission format for data return: One of the most critical components of an end of service changeover is the service provider’s hand back, retention and deletion of client data. Client data must stand handed back in a format that is reasonably accessible and compatible with the systems they will be using or at least have access to for conversion purposes during the termination of the cloud services.[50]
3. Data security for data return: Data security must stand considered at all stages of engaging cloud services, including the termination step. At the time of conclusion, clients should understand the level of information protection applied in the transmission of such data and stand prepared for appropriate remedial action in the event of data leakage. Addressing these issues at the time of termination is probably already too late for practical The client must assess the whole life-cycle risks associated with any cloud solution from the time of initial adoption.
4. Data retention (by service providers): Even where service providers have committed to deleting client data upon termination, and in reality permanently, this process may involve an extended period, often up to three months before such data stands removed. Additionally, service providers may retain backup copies, logs and other information which may have stood shared with other users (such as a photo on Facebook) for a more extended period. However, it is worth noting that data privacy laws in many jurisdictions prohibit the retention of personal data for long periods.[51]
5. Data deletion and information removal: The removal of information and data in the cloud is a much more complicated process than a mere click of a button. The existing standard terms offered by cloud service providers (particularly public cloud) commonly do not specify in any detail the arrangements for data deletion or information removal upon the termination of the service contract. Even where the provider has offered to delete the client’s data at the client’s request, it’s challenging to achieve complete and permanent erasure.[52] Complete deletion of data is even more challenging in a cloud environment where multiple storages and processing locations are involved.[53] The challenges associated with securely deleting data and information in the cloud are another consideration that clients must carefully evaluate as part of their decision to adopt cloud services.
6. Other termination support issues. On termination, cloud service providers will offer limited dissolution or termination support. Under the existing market practice, enterprise solution clients should develop and maintain a transformation separation plan through the life-cycle of the cloud services. That plan should stand based on the assistance available from the service provider, giving them adequate assurance that they will stand able to successfully transition the services back in-house or to a successor provider.

Conclusion

It is essential to recognise that characterisation of a particular cloud offering such as that of the public cloud versus private cloud or hybrid cloud is undoubtedly a significant over-simplification that does not tell the whole story when it comes to license or other contract rights. There is considerable variability among cloud offerings within each category. The result is that the client’s due diligence is essential. The client must read the service descriptions for such vital aspects as processing locations, data backups, redundancy, encryption, security, transition process and options for client control. Even beyond explicit contractual assurances, the service provider’s form of contract often provides significant insight into how the service is structured. In cloud solutions, this structure often defines the ability of the service provider to meet clients’ requirements.

Any service agreement carries certain risks for the parties that may be influenced or driven by practical realities in the solution’s technological structure and operations. These risks can be significantly exacerbated for the client by the lack of certainty (or understanding) of the contract or license terms, leading to poor decision-making in the adoption of cloud solutions. One of the most significant risks associated with accepting any cloud solution by a client is a failure to understand the full range of their rights, responsibilities and requirements related to the solution and its operations. In this sense, cloud computing and cloud services present specific differences from traditional services and licensing driven by technological structure and function. Previous experience, based on prior service and licensing arrangements, offers valuable signposts for charting responsible approaches to the adoption of any cloud solution.

[1] KNAPP, K. Top considerations for choosing a cloud provider. Search Cloud Computing. http://searchcloudcomputing.techtarget.com/

[2] SILALASHI, J.M. Drafting a cloud computing contract. Academia. http://www.academia.edu/

[3] Ibid.

 [5] MARSH. The cloud risk framework, informing decisions about moving to the cloud. Marsh and McLennan. http://f.datasrvr.com/

[6] BRADSHAW, S. et al. The terms they are a –changin’. Watching cloud contracts take shape. The Center for Technology Innovation. The Brookings Institution. https://www.brookings.edu/.

[7] Ibid.

[8] FOLEY. Cloud computing: A practical framework for managing cloud computing risk. Foley. https://www.foley.com/

[9] SILALASHI, J.M. Drafting a cloud computing contract. Academia. http://www.academia.edu/

[10] CRANE, J. The death of outsourcing and other IT management trends. Forbes. http://www.forbes.com/

[11] Note: For the purpose of the discussion and as a point of reference, a representative private or hybrid cloud solution could be cloud provision of an enterprise application, as seen in business-focused SaaS offerings.

[12] The client-to-cloud service provider grant is especially important and is filled with critical issues such as potential loss of data or control and regulatory compliance.

[13] JAEGER, P., LIN, J. and GRIMES, M. Cloud computing and information policy: Computing in a policy cloud? Journal of Information Technology and Politics. http://www.tandfonline.com/

[14] Ibid.

[15] HON, W.K. et al. Negotiating cloud contracts, looking at clouds from both sides now. Stanford Technology Law Review. https://journals.law.stanford.edu/

[16] FOLEY. Cloud computing: A practical framework for managing cloud computing risk. Foley. https://www.foley.com/

[17] Ibid.

[18] WALKER, S. and GREENE C. ‘What constitutes a material breach’. The Lawyer. [https://www.thelawyer.com/

[19] FOLEY. Cloud computing: A practical framework for managing cloud computing risk. Foley. https://www.foley.com/

[20] SILALASHI, J.M. (2011) Drafting a cloud computing contract. Academia. http://www.academia.edu/ [Accessed 12 March 2016].

[21] FOLEY. (n.d.) Cloud computing: A practical framework for managing cloud computing risk. Foley. https://www.foley.com/

[22] Ibid.

[23] JAEGER, P., LIN, J. and GRIMES, M. Cloud computing and information policy: Computing in a policy cloud? Journal of Information Technology and Politics. http://www.tandfonline.com/.

[24] Such provisions are based on service levels entitling the client to terminate the service contract which may include such a right when: (i) the service performance level drops below a defined point in any measurement period; or (ii) a certain value of service credit becomes payable within a prescribed period (for example, in one year); or (iii) a service level is not met for a certain number of consecutive measurement periods.

[25] BRADSHAW, S., MILLARD, C. and WALDEN, I. The terms they are a -changin’. Watching cloud contracts take shape. The Center for Technology Innovation. The Brookings Institution. https://www.brookings.edu/.

[26] For example: City of Los Angeles. Professional Services Contract between the City of Los Angeles and Computer Science Corp. for the SaaS E-mail and Collaboration Solution. SECS. https://sites.google.com/.

[27] An example of some of the key service quality metrics such as: (i) availability metrics; (ii) outage duration metric; (iii) mean-time between failures metric; (iv) reliability rate metric; (v) network capacity metric; (vi) storage device capacity metric; (vii) server capacity metric; (viii) web application capacity metric. See also Mc KENDRICK, J. 16 key service quality metrics to boost cloud engagements. ZDNET. http://www.zdnet.com/.

[28] SILALASHI, J.M. Drafting a cloud computing contract. Academia. http://www.academia.edu/.

[29] STONEBRAKER, M. “One Size Fits All”: An idea whose time has come and gone. Computer Science and Artificial Intelligence Laboratory. MIT. https://cs.brown.edu/~ugur/fits_all.pdf.

[30] FOLEY. Cloud computing: A practical framework for managing cloud computing risk. https://www.foley.com/

[31] CLARKE, G. ‘Apple’s iCloud runs on Microsoft and Amazon services: Who says Azure isn’t cool and trendy now’. The Register. http://www.theregister.co.uk/.

[32] FOLEY. Cloud computing: A practical framework for managing cloud computing risk. https://www.foley.com/

[33] CATTEDDU, D. and HOGBEN, G. Cloud computing, benefits, risks and recommendations for information security. The European Network and Information Security Agency. (ENISA). https://resilience.enisa.europa.eu/. See also Basic guidelines for contracts and contract risk management, Harvard University. http://rmas.fad.harvard.edu/.

[34] DE SILVA, S. 5th Meeting of European Commission Expert Group on Cloud Computing Contracts Liability Discussion Paper. EC Europa. http://ec.europa.eu/.

[35] For example: We undertake that the Services will be performed with reasonable skill and care. This undertaking shall not apply to the extent of any non-conformance which is caused by your use of the Services contrary to our instructions or these Terms of Service, or any alternation or modification made to the Services or the software used in the provision of the Services by a third party who is not authorised by us. We do not warrant that use of the Services will be error-free, and you agree that it is not our obligation to maintain, support or update the Services (except where necessary to carry out our other obligations under these Terms of Service), HITCH Software Platform. Provider terms of service. Hitch HQ. https://www.hitchhq.com/.

[36] FOLEY. Cloud computing: A practical framework for managing cloud computing risk. Foley. https://www.foley.com/.

[37] HON, W.K. et al. Negotiating cloud contracts, looking at clouds from both sides now. Stanford Technology Law Review. https://journals.law.stanford.edu/.

[38] For example: Your Material and Proprietary Rights You Give Us. You shall own all right, title and interest in and to your API, API documentation and any material, information or data you provide or otherwise transmit to us or to others using the Platform or the Services (“Your Material”). We claim no intellectual property rights in and to Your Material; however, we require, and you hereby grant us, a worldwide, non-exclusive, royalty-free license to store, use, reproduce, display and transmit Your Material to the extent necessary to enable your use of the Platform and the Services. This license shall remain in effect until and unless these Terms of Service are terminated by you or us. You shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of Your Material. Hitch Software Platform. Provider terms of service. Hitch HQ. https://www.hitchhq.com/.

[39] For example: License from You. Except for material we may license to you, Apple does not claim ownership of the materials and/or content you submit or make available on the Service. However, by submitting or posting such Content on areas of the Service that are accessible by the public or other users with whom you consent to share such Content, you grant Apple a worldwide, royalty-free, non-exclusive license to use, distribute, reproduce, modify, adapt, publish, translate, publicly perform and publicly display such Content on the Service solely for the purpose for which such Content was submitted or made available, without any compensation or obligation to you. You agree that any Content submitted or posted by you shall be your sole responsibility, shall not infringe or violate the rights of any other party or violate any laws, contribute to or encourage infringing or otherwise unlawful conduct, or otherwise be obscene, objectionable, or in poor taste. By submitting or posting such Content on areas of the Service that are accessible by the public or other users, you are representing that you are the owner of such material and/or have all necessary rights, licenses, and authorization to distribute it. Apple Inc. iCloud terms and conditions. Apple Legal. http://www.apple.com/.

[40] HILLELSON, L. (Making the business case for the media industry transition to IP. Broadcasting and Cable. https://www.cisco.com/.

[41] FOLEY. Cloud computing: A practical framework for managing cloud computing risk. https://www.foley.com/.

[42] BRADSHAW, S., MILLARD, C. and WALDEN, I. The terms they are a –changin’. Watching cloud contracts take shape. The Center for Technology Innovation. The Brookings Institution. https://www.brookings.edu/.

[43] Anonymous. Terms of service, Dropbox. https://www.dropbox.com/. Section ‘Services “AS IS”.

[44] The Digital Millennium Copyright Act of 1998. U.S. Copyright Office Summary. Copyright Government. https://www.copyright.gov/.

Also see Directive 2000/31/EC 2000 Art. 3 Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’). Eur-Lex. http://eur-lex.europa.eu/.

[45] BRADSHAW, S., MILLARD, C. and WALDEN, I. The terms they are a –changin’. Watching cloud contracts take shape. The Center for Technology Innovation. The Brookings Institution. https://www.brookings.edu/.

[46] SILALASHI, J.M. Drafting a cloud computing contract. Academia. http://www.academia.edu/.

[47] FOLEY. (n.d.) Cloud computing: A practical framework for managing cloud computing risk. Foley. https://www.foley.com/ [Accessed 10 March 2016].

[48] Ibid. See also CLOUD STANDARDS CUSTOMER COUNCIL. (2016). Public cloud service agreements: What to expect and what to negotiate, Version 2.0.1. CSCC. http://www.cloud-council.org/deliverables/CSCC-Public-Cloud-Service-Agreements-What-to-Expect-and-What-to-Negotiate.pdf [Accessed 22 September 2016].

[49] FOLEY. Cloud computing: A practical framework for managing cloud computing risk. Foley. https://www.foley.com/

See also CLOUD STANDARDS CUSTOMER COUNCIL. Public cloud service agreements: What to expect and what to negotiate, Version 2.0.1. CSCC. http://www.cloud-council.org/deliverables/CSCC-Public-Cloud-Service-Agreements-What-to-Expect-and-What-to-Negotiate.pdf.

[50] Ibid.

[51] EURO CLOUD. Major mistakes in data privacy – data protection in the cloud. Euro Cloud. https://www.eurocloud.org/. Notes from paper. Right to deletion of data and obligation to notify of data breaches. The right to deletion of data is problematic as a result of organisational deficits and the supply chain. 63% of cloud providers maintain data indefinitely or have no provisions for data retention in their terms and conditions. Another 23% of cloud providers maintain the right in their terms and conditions to share data with another third party, making it even more difficult to ensure all copies are deleted, because of the numerous parties with whom a cloud provider shares data.

[52] Anonymous. Terms of service, security. Dropbox. https://www.dropbox.com/. Section ‘File recovery and version history’. Dropbox saves a history of all deleted and previous versions of files, and allows you to restore them for up to 30 days. Extended version history is available as a Dropbox Plus subscription add-on. Dropbox Business users have 120 days to recover deleted files.

[53] Ibid.

1. Personal data must be processed lawfully, fairly and transparently.
2. Personal data can only stand collected for specified, explicit and legitimate purposes.
3. Personal data must be adequate, relevant and limited to what is necessary for processing.
4. Personal data must be accurate and kept up to date.
5. Personal data must be kept in a form such that the data subject can stand identified only as long as necessary for processing.
6. Personal data must stand processed in a manner that ensures its security.

Eight Rights

1. The right to be Informed
2. The right of Access
3. The right to Rectification
4. The right to Restrict processing
5. The right to Data Portability
6. The right to Object
7. Rights concerning automated decision making and Profiling

It is worth noting that the data controller is responsible for demonstrating that the principles and data subject rights stand implemented, and they must ensure the same for any third-party data processors with whom they contract. Guide to GDPR penalties tier 1 and tier 2 infringement Some of the GDPR Articles’ if found to have stood violated, carry the maximum administrative penalty as noted, being up to four percentage points of annual global turnover or €20 million, whichever is the higher. NOTE: Infringements of the requirements concerning international transfers are also subject to this higher penalty. The higher penalties apply to the following Articles;

• 5 – Principles relating to the processing of personal data
• 6 – Lawfulness of processing
• 7 – Conditions for consent
• 9 – Processing of special categories of personal data
• 12 – Transparent information, communication and modalities for the exercise of the rights of the data subject
• 13 – Information to stand provided where personal data stand collected from the data subject
• 14 – Information to stand provided where personal data have not stood obtained from the data subject
• 15 – Right of access by the data subject
• 16 – Right to rectification
• 17 – Right to erasure (‘right to stand forgotten’)
• 18 – Right to restriction of processing
• 19 – Notification obligation regarding rectification or erasure of personal data or restriction of processing
• 20 – Right to personal data
• 21 – Right to object
• 22 – Automated individual decision-making, including profiling

The lower tier of penalty for infringing other Articles of the Regulation, which stands calculated at up to two percentage points of global annual turnover or €10 million – again, whichever is the higher. The penalty will apply to the following Articles;

• 8 – Conditions applicable to child’s consent concerning information society services
• 11 – Processing which does not require identification
• 25 – Data protection by design and by default
• 26 – Joint controllers
• 27 – Representatives of controllers or processors not established in the Union
• 28 – Processor
• 29 – Processing under the authority of the controller or processor
• 30 – Records of processing activities
• 31 – Cooperation with the supervisory authority
• 32 – Security of processing
• 33 – Notification of personal data breach to the supervisory authority
• 34 – Communication of a personal data breach to the data subject
• 35 – Data protection impact assessment
• 36 – Prior consultation
• 37 – Designation of data protection officer
• 38 – Position of the data protection officer
• 39 – Tasks of the data protection officer
• 42 – Certification
• 43 – Certification bodies

POPIA In contrast to the GDPR, the POPIA only has eight conditions (or so-called principles) to be adhered to when processing data subjects information. The eight conditions for the lawful processing of Personal Information by or for a responsible party are the following:

1. ‘‘Accountability’’, as referred to in section 8;
2. ‘‘Processing limitation’’, as referred to in sections 9 to 12;
3. ‘‘Purpose specification’’, as referred to in sections 13 and 14;
4. ‘‘Further processing limitation’’, as referred to in section 15;
5. ‘‘Information quality’’, as referred to in section 16;
6. ‘‘Openness’’, as referred to in sections 17 and 18;
7. ‘‘Security safeguards’’, as referred to in sections 19 to 22; and
8. ‘‘Data subject participation’’, as referred to in sections 23 to 25.

The conditions stand further expanded in the various sections of the Act. The table below is a quick guide to the related sections found in POPIA concerning the eight conditions for lawfully processing personal information.

1. Personal data must be processed lawfully, fairly and transparently.
   1. POPI Act: Condition 2 – Lawfulness of processing section 9 to 12
   2. POPI Act: Condition 6 – Openness section 17 and 18
2. Personal data can only stand collected for specified, explicit and legitimate purposes.
   1. POPI Act: Condition 3 – Purpose specific sections 13 and 14
   2. POPI Act: Condition 4 – Further processing limitation section 15

• Personal data must be adequate, relevant and limited to what is necessary for processing.
  12. POPI Act: Condition 2 – Purpose specific section 9 to 12.
  13. POPI Act: Condition 3 – Purpose particular sections 13 and 14
  14. POPI Act: Condition 5 – Information quality section 16

1. Personal data must be accurate and kept up to date.
   1. POPI Act: Condition 8 – Data subject participation section 23 to 25
2. Personal data must be kept in a form such that the data subject can stand identified only as long as necessary for processing.
   1. POPI Act:
3. Personal data must stand processed in a manner that ensures its security.
   1. POPI Act: Condition 7 – Security Safeguards section 19 to 22

Guide to POPIA Penalties As with the GDPR, the POPI Act also provides for any infringement of personal data. Such offences or failure of a ‘Duty of Care’ to provide data protection can result in various penalties or fines. Below is an extract of the sections within the POPI Act of offences, penalties, and administrative fines, which may apply if a responsible person processing personal data breaches the regulation.

100. Obstruction of Regulator
101. Breach of confidentiality
102. Impediment or obstruction of execution of a warrant
103. Failure to comply with enforcement or information notices
104. Offences by witnesses
105. Unlawful acts by the responsible party in connection with an account number
106. Unlawful acts by third parties in connection with an account number
107. Penalties
108. Magistrate’s Court jurisdiction to impose penalties
109. Administrative fines

Expanding on section 109 Administrative fines to highlight what possible penalties may stand applied for data breaches.

• If a responsible party stands alleged to have committed an offence in terms of this Act, the Regulator may cause to be delivered by hand to that person (from now on referred to as the infringer) an infringement notice which must contain the particulars contemplated in subsection (2).
• A notice referred to in subsection (1) must
  • specify the name and address of the infringer;
  • specify the particulars of the alleged offence;
  • specify the amount of the administrative fine payable, which amount may, subject to subsection (10), not exceed R10 million;
  • inform the infringer that, not later than 30 days after the date of service of the infringement notice, the infringer may
    • pay the administrative fine;
    • make arrangements with the Regulator to pay the administrative fine in instalments; or
    • elect to be tried in court on a charge of having committed the alleged offence referred to in terms of this Act; and
  • state that a failure to comply with the requirements of the notice within the time permitted will result in the administrative fine becoming recoverable as contemplated in subsection (5).
• When determining an appropriate fine, the Regulator must consider the following factors:
  • The nature of the personal information involved;
  • the duration and extent of the contravention;
  • the number of data subjects affected or potentially affected by the contravention;
  • whether or not the contravention raises an issue of public importance;
  • the likelihood of substantial damage or distress, including injury to feelings or anxiety suffered by data subjects;
  • whether the responsible party or a third party could have prevented the contravention from occurring;
  • any failure to carry out a risk assessment or a failure to operate good policies, procedures and practices to protect personal information; and
  • whether the responsible party has previously committed an offence in terms of this
• If an infringer elects to be tried in court on a charge of having committed the alleged offence in terms of this Act, the Regulator must hand the matter over to the South African Police Service and inform the infringer accordingly.
• If an infringer fails to comply with the requirements of a notice, the Regulator may file with the clerk or registrar of any competent court a statement certified by it as correct, setting forth the amount of the administrative fine payable by the infringer, and such statement thereupon has all the effects of a civil judgment lawfully given in that court in favour of the Regulator for a liquid debt in the amount specified in the statement.
• The Regulator may not impose an administrative fine contemplated in this section if the responsible party concerned has been charged with an offence in terms of this Act in respect of the same set of
• No prosecution may be instituted against a responsible party if the responsible party concerned has paid an administrative fine in terms of this section in respect of the same set of facts.
• An administrative fine imposed in terms of this section does not constitute a previous conviction as contemplated in Chapter 27 of the Criminal Procedure Act, 1977 (Act No. 51 of 1977).
• A fine payable in terms of this section must be paid into the National Revenue Fund referred to in section 213 of the Constitution.
• The Minister may, from time to time and after consultation with the Regulator, by notice in the Gazette, adjust the amount referred to in subsection (2)(c) in accordance with the average of the consumer price index, as published from time to time in the Gazette, for the immediately preceding period of 12 months multiplied by the number of years that the amount referred to in subsection (2)(c) has remained the same.

Numerous organisations and people responsible for handling personal data remain unclear of the impact of the regulation if they suffer a breach. Many of these organisations are still working through the – How, What, When and Why’s of the Act. In closing, we trust that this brief introduction was helpful. The main point is to provide an essential awareness of local and international data privacy regulations. In our next article, we will explore the various sections of the regulation how they impact your organisation or personal information. Later we will discuss how to manage and control the data process and flow within your organisation to be compliant with local and international regulations, whichever may apply. “For more about this subject, please see my next article coming soon.”