By Peter Sturges, Associate
Pleasanton Office
The trend toward “cloud computing” is increasingly visible as technology firms and service providers vie with each other to provide users with web-based data and software application services. From Apple’s iCloud to Amazon’s cloud-based user libraries to your local cable provider’s data storage plans, everyone wants to provide users with fee-based cloud services.
Cloud computing offers a number of advantages, such as providing online applications (also known as Software-as-a-Service, or “SaaS”), data storage, messaging, email, and web sites that the users themselves do not have to maintain. Cloud-based service providers claim to save users money in the long run by providing these services, notwithstanding that users are charged for them.
On the other hand, cloud-based computing also has inherent risks. For example, the fact that cloud-based services are provided through remote servers and accessed through often unsecure internet connections increases the likelihood that user data will not be kept sufficiently secure or private. The remote computing aspects of cloud computing also increase the risk that communications will not be kept private and may be accessed by outside parties, and that the integrity of user data is not maintained. These risks can raise legal issues such as potential liability for violation of privacy, corrupted data, and unauthorized system access.
Employers or agencies seeking to move their IT operations to the cloud should ensure the vendor contracts sufficiently address these potential risk factors and liability issues. Vendor agreements should contain provisions for addressing data privacy, security, and back-ups and should include appropriate indemnity language for data loss, among other things. A contract for cloud-computing services also should specify the location of the provider’s data servers, the minimum data access service level, and procedures for data recovery after disasters, and other conditions of service. Vendor contracts often are very one-sided in favor of the vendors, so it is frequently necessary to take a firm stance in contract negotiations to ensure the agreement sufficiently provides for such contingencies. Parties seeking to obtain cloud-based services are encouraged to consult their counsel when negotiating agreements for such services.
