Cloud Computing and the Public Sector Risks and Rewards John O’Connor, Partner - Head of Technology & Commercial Contracts

INTRODUCTION  Public Sector Outsourcing  UK (Varney Report), US, Australia and others  Ireland has not undertaken any large outsourcing deals  Reform and transformation of public sector

OPPORTUNITIES IN THE CLOUD

 Cloud Computing Defined?  “A bundle of traditional IT services using the Internet or “Cloud” as the delivery channel”  Services: storage, database capabilities;  Platform: application development in a multi-tenant environment;  Software: turnkey applications delivered online;  Infrastructure: delivery of computer infrastructure and related managed services.

OPPORTUNITIES IN THE CLOUD cont’d..  Public Cloud, Private Cloud (also hybrid models)  US – Federal Cloud Computing Strategy - Feb 2011  UK - ICT Strategy - G cloud – March 2011  Common features include:  Private or hybrid model with trusted public clouds  Data to be hosted on shore in home country  Compliance with laws and regulations  Minimum standards and levels of service  Data control, data security and data access guarantees

RISKS IN THE CLOUD

 Security, integrity and confidentiality of data  Availability of data and systems – readily accessible data  Compliance with laws and regulations  Data Protection Laws (data processing, security and location of data)  Statutory duty and some laws unique to the Public Sector  Ability to audit, monitor compliance  Compliance with contracts with third parties  Service failure  Poorly written and/or very one sided contract with cloud provider

RISKS IN THE CLOUD cont’d …  Principal contractual/legal issues  Limitations and Exclusions of Liability (i.e. disclaimers)  Choice of Law and Jurisdiction  Data Protection other applicable laws and regulations  Strength and specifics of obligations including SLAs / KPIs  Ability to termination for persistent or material breach  Ability to migrate data on termination – avoiding lock-in  Ability to audit/monitor service delivery, security and integrity of data  Scope and detail of force majeure, down-time

RISK MITIGATION

 Risks can be managed, mitigated commercially and legally  But, there is a trade-off  Contract should be carefully reviewed commercially and legally  Conclusion