QMUL Cloud Legal Project

Cloud Legal Project: Began in Oct 2009 as 3 year project - funded by Microsoft. Focus? To address legal and regulatory issues concerning cloud computing with a view to reducing uncertainty. Based at the Centre for Commercial Legal Studies at Queen Mary, University of London. Expertise in law and technology issues and intellectual property law.

To date, papers have been published on: - Standard Cloud T&Cs - Negotiated Cloud Contracts - UK G-Cloud - Data Protection & Cloud - Information Ownership & Cloud - Competition Law & Cloud - Law enforcement access & Cloud

In 2012, papers forthcoming on: - Consumer Protection & Cloud - Cloud Governance All research available at:

Negotiated Cloud Contracts? Our research was based upon: Informal discussions with cloud actors Detailed confidential interviews with over 20 organisations of at least an hour each between Dec 2010 & early 2012, including: - Cloud providers (SaaS IaaS PaaS / UK & Global) - Cloud users (businesses & public sector) - Law firms and insurance companies.

Negotiated Cloud Contracts - Main Conclusions? Standard contract terms reflect importance of the consumer distribution model in cloud provision Certain factors are forcing providers to become more flexible: - Trad. IT service vendors/companies willing to accept risk are entering market and offering enterprise grade services with matching contracts - Niche providers and integrators are emerging, more willing to tailor contract terms and service features - To remain competitive, flexibility and customer awareness are required

Negotiated Cloud Contracts - Main Conclusions? Even large providers are realising they must adapt, thus offering a range of services with different pricing and terms Large users able to require contracts be drawn on their terms are considering producing standard SaaS and IaaS terms e.g. financial institutions May be scope for co-ordinated collective efforts in this regard

Negotiated Cloud Contracts - Main Conclusions? Mid to low value markets? - Choice and information are still limited; many contract terms are still inadequate or inappropriate for users needs. - Limited bargaining power Hopefully there will be a filtering down of know-how to the mid market at least

Negotiated Cloud Contracts - Main Conclusions? Low value market? Regulatory/Legislative action perhaps needed e.g. consumer protection law, data protection law Such actions need to reflect technological/logistical reality of cloud, so that action does not stifle benefits

Negotiated Cloud Contracts - Main Conclusions? Encouragement of range of of available cloud services, with appropriate terms, may be the way to go. Unfair of users to expect a tailored service on cheap, commoditised public cloud delivered on shared infrastructure Awareness and education re: cloud expectations helpful here Also, industry self regulation certification helpful Plus, more transparency/openness about nature of cloud e.g. reality of layering of service and data location.

Cloud Computing & Consumer Contracts? Consumer protection law has a role to play in ensuring this culture of openness and transparency about the reality of use of the cloud and also regulating question of subsequent liability in consumer market. Consumer protection being both ex ante and ex post Also, again, industry self regulation has a role here e.g. Cloud Industry Forum in UK / Code of Practice.

Cloud computing & Consumer Contracts? Ex ante? Unfair Commercial Practices Advertising Standards e.g. UK ASA Distance Selling - as now subsumed with Consumer Rights Directive E-commerce Directive Consumer Rights Directive Self Regulation. Design?

Cloud computing & Consumer Contracts? Ex post? Laws regulating the sale of goods and service to consumers e.g. - UK Sale of Goods and Services Act, 1982 which requires exercise of reasonable care and skill in delivery of services - Sale of Goods Act and implied terms - Unfair contract terms e.g. UCTA

Cloud computing & Consumer Contracts? Ex post? An important question in the context of ex post liability and implied terms is whether cloud computing is a good, service or sui generis? Important question regarding responsibilities for providers and rights for users Consumer Rights Directive - Recital 19. UK Implementation?

Cloud computing & Consumers? Other issues? Mixed use in the context of the Cloud - consumer or business? - look to initial purpose? (Consumer Rights Directive Recital 17 - UK Implementation?) Free services - same expectation as if a paying consumer? Using the cloud for the purpose of starting a business - consumer or business? - look to initial purpose?