Chris Reed Professor of Electronic Commerce Law

The perceived problem “If I put my information in the Cloud then I lose all my rights to it” But is this true? Worth examining for different types of consumer cloud service Dropbox Google Docs Facebook

Dropbox terms By using our Services you provide us with information, files, and folders that you submit to Dropbox (together, “your stuff”). You retain full ownership to your stuff. We don’t claim any ownership to any of it. These Terms do not grant us any rights to your stuff or intellectual property except for the limited rights that are needed to run the Services, as explained below. We may need your permission to do things you ask us to do with your stuff, for example, hosting your files, or sharing them at your direction … You give us the permissions we need to do those things solely to provide the Services. This permission also extends to trusted third parties we work with to provide the Services, for example Amazon, which provides our storage space (again, only to provide the Services).

Google Docs terms Some of our Services allow you to submit content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours. When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones. This license continues even if you stop using our Services …

Facebook terms You own all of the content and information you post on Facebook, and you can control how it is shared through your privacy and application settings. In addition:privacyapplication settings For content that is covered by intellectual property rights, like photos and videos (IP content), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub- licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it.privacyapplication settings

Loss of control not ownership Loss of control varies with Funding model for the cloud service Long-term ambitions of service provider Ownership is determined before information enters the cloud Ownership ≠ control (though we lawyers tend to act as if it does Control determined by terms of service Little scope for negotiation outside bespoke B2B cloud deals

Information created outside the cloud

Some minor uncertainties Berne Convention solves most copyright ownership problems Except where non-Berne national acts within a Berne country but cloud server is non-Berne Uncertain geography may impact purely national/regional rights EU Databases Directive Is the qualification nationality/residence, place database is made, or both? UK’s copyright in computer-generated works

A real problem Information generated by the service provider Metadata relating to customer’s activities Derived data, usually aggregated Service provider will clearly be the owner of this information But what about the customer Are the customer’s interests affected? Does the customer have any rights of control?

Metadata and derived data

Does the customer have an interest? No copyright claim Generation is not secondary infringement because of licence Bailment claim? Possible claim as confidential information Generated by using customer’s confidential information “broad principle of equity that he who has received information in confidence shall not take unfair advantage of it” (Seager v Copydex) But is the provider’s use unfair?

Resolving the problem Transparency solves almost everything Clarifies customer’s expectations re control, use and data derivation Helps understand meaning of provider’s licences Clarifies financing model – eg for “free” services Helps avoid disputes Cf Facebook model for changing terms But some risks remain Particularly reidentification from anonymised data May need addressing in some B2B deals