1. WHO: Know your master cloud vending company (“Cloudmaster”), draft your agreements defensively, and protect against both changes in control (theirs and yours) and changes in liquidity as a going concern (again, both theirs and yours).

2. WHERE: Be sure to extract an iron-clad guarantee from the Cloudmaster that your data will be kept “solely and entirely” in the appropriate country (e.g. Canada or the United States), or other jurisdiction, such as the European Union, as appropriate. If the Cloudmaster cannot definitively tell you where your data will be hosted, or if they just do not know, then the end-result of any decision to continue doing business with them, shall be yours, and yours alone.

Anyone who has been paying attention to the news in this area will know that data breaches and the costs of data breaches in reputation, fines, settlements, and regulatory enforcement and sanctions, have been mounting at a fierce pace. In addition to your undoubtedly stringent precautions in the above and otherwise, it is not irrational to try to deal with as few privacy regulators as possible, should a breach occur that forces you to make the appropriate disclosures to clients and the proper authorities. More jurisdictions means more discovery and e-discovery, more compliance costs, and more costs for remediation, credit counseling and monitoring, and court and regulatory proceedings. Some courts are getting very aggressive in striking-down arbitration clause provisions that specified arbitration (and imposing outright litigation), or that specified a particular forum (and imposing their own idea of what is or should be the appropriate forum).

Just as the cloud has expanded access to hitherto unheard of computing capacity and lowered its costs, it may also lead to either (a) greater insularity and decreased “real” cross-border trades because of the almost unlimited potential liabilities; or (b) new laws and/or regulations on a regional bloc or international level, to control for these risks and put the market and the consumers at ease. Privacy Insurance has already taken a firm hold in a number of jurisdictions; albeit not yet uniform as to underwriting standards, coverage options, and policy limits.

3. WHAT: In addition to the above, you would be well-advised to develop an in-depth understanding of the Cloudmaster’s security, data retention, and other policies; as well as those in the links and structures of the cloud, and the who, where, and what of the other cloud participants; in order to prevent your being inadvertently caught in a “chain of rain” that brings far more pain than the originally anticipated gain.

4. WHY: Of course, you also need to know what and how often the Cloudmaster does purge or intends to purge, and what logs, if any, they keep and can provide to you without breaching their obligations to other cloud users and residents, whether permanent, or occasional as needed, or transient and otherwise fleeting (“Residents”).

Over-partitioning the data of different Residents, where and as available, adds costs, of course, but it may well also add serious peace of mind in enabling ease of recovery and discovery, and decreasing the risk of inadvertent disclosures and/or cross-contamination when discovery comes-a-calling. That is a trade-off computation that must be done and presented to a company’s management for their own good business judgement, and then the appropriate sign-off can be a waved as shield, once properly discovered, against that judicial Sword of Damocles. Whether Sarbanes-Oxley requires legal counsel, accountants, or auditors to protest more loudly and publicly in the case of a publicly-listed entity that is unwilling or unable to pay that extra cost and then fails to disclose this in the MDA or otherwise in accordance with law, is significantly beyond the scope of this little missive.

Let the Cloudmaster know what, how, and how much of that “purgeable content” and other data content you want (a) not purged and kept in place; (b) not purged and delivered to you in backup format on a periodic basis; (c) purged but similarly delivered to you on a periodic basis; or (d) otherwise dealt with. A Cloudmaster is not responsible for meeting anyone’s preservation or discovery or e-discovery obligations but its own, except if contractually so bound to comply or assist in the same. In the case of a Paas or an Iaas vendor providing a flow-through solution, appropriate DMCA safeguards may further so endeavor to hold them harmless.

SUMMARY: We should all be mindful that cloud computing touches well over a dozen practice areas and is therefore extremely complex, by nature: (Interstate and interprovincial commerce, International trade, Class actions, A.D.R., I.P.R., Libel and defamation, Insurance, Outsourcing, E-commerce, Securities regulation, Choice and conflicts of laws, Corporate governance, Banking and secured transactions, Constitutional law and national sovereignty, Litigation (including forum selection), privacy, E-discovery, and Law Enforcement and National Security (LENS).

The Cloud is new, as was aviation before it, once upon a time. The aviation industry built-upon the foundations of shipping, which has been in place for a very long time, and the cloud will build upon the lessons, disasters, and opportunities of both of these same – that are themselves, still evolving (in shipping, such as with the Laws of the Sea re: territorial limits, ocean dumping, and piracy; and in aviation such as with GHG emissions, Air Marshalls, Space law and space tourism, and passenger bills of rights when stuck on the ground between the terminal and the flight plan).

Until then, watch the weather forecast, but always take your own precautions, scan the horizon, and keep a good umbrella handy.

Ekundayo George, Esq.
http://www.ogalaws.wordpress.com
*Information only; no attorney advice or advertising; no attorney-client relationship here.

Confession: I was a founding member of LiST.