Dino Tsibouris (614) Cloudy with a Chance of Lawyers: Legal issues in Cloud Computing Contracts

Cloud Issues are Business Issues… Providing a service Owning the data Owning the IP Availability Refunds Moving somewhere else

Cloud Issues Include More Business Issues… Time of use Number of users Number of transactions Resources used Other criteria

…But Certain Laws Apply Banks, Credit Unions: FFIEC Information Technology Examination handbook /Outsourced Cloud Computing Statement 07/10/12 NIST Special Publication “Guidelines on Security and Privacy in Public Cloud Computing” HIPPA (sealed box/open box/conduit) FTC Section 5 (Data security standards) EU Data Protection Directive

Data Ownership and Privacy Make data confidential – especially personal data Define ownership of data – personal vs. non-personal State the provider does not own the data Limit data use only to perform services Geographical limits – Vancouver, BC

Data Security Reasonable security? Industry standard security? Equal to what they use? (or not) Select the standard (ISO, NIST, PCI-DSS, COBIT) Audits Notice of potential breach

Service Levels Guaranteed minimum uptime Escalation process for downtime Service credits Is free really free?

Disclaimer of Warranties Infringement of third-party IP rights? AS-IS? Will it conform to specifications? Service interruptions? Get warranties in detail

Indemnification by the Vendor Infringement claims by others Breach of confidentiality/data breach Physical injury Reckless/intentional conduct

Indemnification by the Customer End user use Regulatory noncompliance Recklessness/Willful misconduct

Audit Rights Scheduled annually Immediately upon certain events Facility audit IT audit Shared audits SSAE 16 and ISAE 3402 Books and records?

Weblinked Terms “Customer agrees to our Terms of Use and any amendments we make from time to time.”

Weblinked Terms How do you know when they change? What if the change removes key terms you rely on? Technical standards vs. contract changes Get notice of changes before implemented with a chance to terminate if not approved Risk of stale links

Limitation of Liability Direct damages only? Lost profits? Refund of prior ___ months of fees paid Increased caps for breach of confidentiality or IP infringement

Termination Immediate? Notice of breach and right to cure? Do protections survive?