Legal issues darken skies

Patrick Van Eecke, partner at DLA Piper LLP and professor in IT law at UA, says many publicly available cloud contracts are not balanced, for example limiting the liability of the hosting provider to a level that is simply not in line with the potential risk in a business environment: for example, they say that the cloud provider ‘will not be liable for any direct or indirect damages for loss of profit, goodwill, use, data or other losses (…)’.

Further, on the legal side, most tax legislation imposes the possibility of physical inspection of tax related data but a geographically decentralised cloud service might not allow for this. “Very often cloud data is stored wherever is most efficient at that moment, including some fairly exotic locations,” says Prof Eecke. “Some companies are unknowingly infringing their country’s tax legislation simply because they have signed a cloud contract.”

Despite this Gregor Pryor, partner at legal firm Reed Smith, explains that market sophistication is growing in response to these problems. As part of their services, cloud providers are focusing on data security, back up and recovery as well as territoriality. ISO standards are also becoming a selling point.

“You can now buy data backup and retrieval options, and with some services you can determine where and how the data is stored,” he adds. “The real problem is that not all businesses do a proper assessment about the level and type of cloud service they need, how business critical it is, or even ask if they even want to put it all out there on to the cloud. It’s not a one-size-fits-all solution; you need to do a proper risk assessment.”

There are also legal cooperation duties to be wary of, says Prof Eecke. Typically every country has specific legal requirements that companies allow governments to scrutinise data for, say, anti-terrorism purposes. Currently the issue is that most cloud computing is located in the US and under the scope of US Patriot Act, this gives the US government the ability to ask any cloud computing provider to disclose any or all information – even if you are a port operator in Antwerp. “At the moment the focus is in the US but it will certainly come up with reference to other countries in time,” he points out.