How not to lose your head in the Cloud: AGIMO guidelines released

Transcription

1 How not to lose your head in the Cloud: AGIMO guidelines released 07 December 2011 In brief The Australian Government Information Management Office has released a helpful guide on navigating cloud computing agreements. The guide highlights some of the key areas of concern and suggests considerations for addressing those key issues. Summary The Australian Government Information Management Office (AGIMO), part of the Department of Finance and Deregulation, has released the Negotiating the cloud legal issues in cloud computing agreements Better Practice Guide (the Guide). The Guide s purpose is to assist government agencies with negotiating and preparing computing agreements that deal with the Cloud. The Guide highlights some of the key issues that need careful consideration when entering into or negotiating a cloud computing agreement. While the Guide is aimed at government agencies, its principles and recommendations are universal and act as a helpful checklist of items to consider before entering into a cloud computing agreement. The key issues identified in the Guide are as follows: Privacy While moving information into the cloud may not be privacy invasive, the act of moving information may relinquish control of the information and privacy safeguards. The personal and sensitive information should be: contractually protected from the supplier using the information for any of the provider s own purposes, such as advertising, and protected (in an enforceable manner) regardless of whether or not the provider is based in Australia or overseas. The Guide suggests that if privacy issues cannot be adequately addressed, it may not be appropriate to transfer personal information, especially sensitive information, into a cloud. Security A paramount concern for any user of the Cloud is the security of its data. The risk is heightened when the information is held offshore where it may not be afforded same protections as it would be in Australia. The Guide recommends conducting a comprehensive risk assessment of the Cloud services being offered, taking into consideration the following points: where the service is to be provided from a location within Australia, a prohibition on the provider transmitting data outside of Australia without prior approval may be appropriate, the level of security and encryption to be applied to data held and transmitted by the provider, the level of access security protocols to be implemented by the provider to defeat unauthorised attempts to access the data by third parties, provider personnel and other customers of the provider,

2 where physical media is damaged and replaced, requirements for the sanitisation or deletion of data in the damaged media, the way in which separate packages of data are to be stored for example, it may be important to prohibit the provider from aggregating separate packages on the same hardware (as such aggregation may increase the sensitivity of data or risks to security of the information), a requirement for the provider to notify immediately in the event of security incidents or intrusions, or requests from foreign government agencies for access to the data, to enable be able to manage these events proactively, requiring data to be stored on specified hardware that is unique so that there can be security precautions set up between the hardware storing information and other hardware held by the provider, a requirement for the provider to destroy or sanitise (or de-identify in the case of personal information) sensitive information held by the provider at the end of the agreement (where such data is not or cannot be returned). This may extend to destruction of physical hardware on which such data is held to avoid risk that the data may be recovered, and specific security requirements depending on the nature of the service and the sensitivity of the data. Confidentiality Where the information to be stored in the cloud is particularly sensitive, the level of protection will need to be stronger. The Guide recommends considering including the following in a cloud computing agreement: for non-sensitive data, requirements to ensure the provider is aware of the level of confidentiality required and commits to protecting that data appropriately, for sensitive data, more detailed confidentiality obligations. In some cases where an extra layer of protection is necessary, it may be appropriate to: require the provider to obtain individual confidentiality deeds from their personnel, restrict access to the data to a limited set of the provider s personnel only. Audit The only practical way to ensure the above protections are in place and meet the required levels is to audit the supplier for compliance with its cloud computing obligations. The inherent nature of the Cloud makes auditing itself not an easy task the data may be stored across a number of geographical sites and spread across a number of devices. In order to minimise the complexities of auditing, the Guide recommends considering including any of the following rights: restricting the locations/countries in which the data may be held, rights to audit the provider s compliance with the agreement including rights of access to the provider s premises where relevant records and data is being held, audit rights for nominees, a right to appoint a commercial auditor as its nominee (for example, in a geographical location where the user does not have a presence / convenient means of access), and where technically available, the right to remotely monitor access to its data. Compensation for data loss/misuse It is possible that data may be permanently lost or misused by a service provider. Offsite data back-up, proper training and maintenance may reduce the risk of this. However, loss or misuse must be contemplated and addressed in any cloud computing agreement. The Guide recommends considering including any of the following: no exclusion for indirect and consequential losses (which will typically be the type of losses that flow from data loss and misuse), an indemnity from the provider in respect of data loss or misuse as a result of the negligent, illegal or wilfully wrong act or omission of the provider or its personnel, and a separate liability cap for data loss or misuse that is sufficiently high to cover potential liability arising from such loss or misuse.

3 Subcontractors As a general rule, any subcontractors of the service provider should also be obliged to meet the same requirements as the service provider. Limitations on liability The Guide accepts a default position where a liability cap is appropriate, provided that the service provider accepts the following exceptions to the cap: personal injury (including sickness and death), loss or damage to tangible property, breach of privacy, security or confidentiality obligations, intellectual property infringement, unlawful, or illegal, acts or omissions, loss caused by service interruption, data loss, and misuse of data. Decisions made about the amount of any liability cap should be informed by a risk assessment that examines all identifiable potential liabilities and determines the likelihood and effect of such risks being realised the last three of the list viewed as potential key risks. Indemnities Agreeing to give an indemnity may expose the user to the risk of liability or costs that it would not otherwise be liable for, however the Guide identifies the indemnities that may be typically required by the service provider of a user: infringement of a third party s rights (including privacy and intellectual property rights), any loss or damage arising from the use of the service, and breach of the agreement. Service levels Service levels are an important part of a cloud computing agreement that set the level of service expected from the service provider. When setting the service levels, the Guide recommends the following: the service levels have to measure something that is of importance, performance against service levels should be easily measurable and auditable, and there should be sufficient incentive (whether reward or punishment based) for the service provider to meet the required service levels. Response times The cloud agreement should provide for acceptable response times to investigate and resolve interruptions. Flexibility of the service The cloud agreement should provide the ability to scale the provision of service depending on need. The Guide recommends considering whether: the pricing model is suitable, and an easily implementable change process is in place.

4 Business continuity and disaster recovery (BCDR) BCDR is important to any business to ensure it is able to function and provide its services in times of disaster. The Guide recommends including any of the following in the cloud agreement: ensuring the provider is able to operate during a power outage, ensuring that business continuity is a strict requirement and not subject to qualifiers such as 'reasonable efforts', requiring a BCDR plan be submitted for comment and approval, limiting the right for the provider to suspend their service for force majeure reasons to circumstances where the BCDR plan has been properly followed and implemented, and ensuring that scheduled maintenance outages of provider systems do not occur during hours that require access and use of the system. Service provider s right to terminate The Guide recommends including a sufficiently long notice period before the termination becomes effective, to allow finding a suitable alternative provider. Transitioning-out In the event there is a need to change cloud computing service providers, the process should be easy and smooth, as this will allow for a fast and cost-effective transition. The Guide recommends that the agreement impose the following obligations on the provider: give all reasonable assistance in helping with the disengagement and transition including retrieval of all data in requested formats, supply a detailed disengagement and transition plan to give confidence in the nature and scope of the provider s disengagement services, and not delete any data at the end of the agreement without express approval. Dispute resolution The Guide suggests that the cloud agreement should clearly state the relevant jurisdiction and laws that apply to that agreement. It should also be clear, in the event of a dispute, which courts can hear matters relating to the agreement and whether an alternative dispute resolution mechanism can be utilised. Change of control and assignment/novation It is always important for any organisation to know who they are dealing with. Change of control or assignment/novation can affect who ends up providing cloud services to the user. Accordingly, to ensure there are no unexpected surprises, some ways of dealing with this issue include: requiring the provider to inform in advance (subject to any listing rules of a relevant stock exchange) of any proposed change in control of the provider such as changes in key management positions or changes in significant shareholders, providing the user with a right to terminate in the event that a change of control has occurred, requiring that any transfer of the provider s rights and obligations under the agreement to another entity be subject to the user s prior approval, requiring that any subcontract requires the user s prior approval. Introduction of harmful code The user should consider whether the provider is obliged to protect the data against the introduction of viruses or other malicious code. Trans-border data transfer The Guide recommends seeking additional legal advice in relation to any potential trans-border data transfer issues that

5 may arise, especially if the data is transferred to an overseas location. IP ownership The Guide recommends inserting terms that ensure that the agreement does not transfer any intellectual property ownership or rights to the service provider in any data stored. This article was written by Irene Zeitler, Partner, and Alex Zolotarsky, Solicitor, Melbourne. More information For information regarding possible implications for your business, contact Irene Zeitler Partner, Melbourne Direct irene.zeitler@freehills.com Julian Lincoln Partner, Melbourne Direct julian.lincoln@freehills.com This article provides a summary only of the subject matter covered, without the assumption of a duty of care by Freehills or Freehills Patent & Trade Mark Attorneys. The summary is not intended to be nor should it be relied upon as a substitute for legal or other professional advice. Copyright in this article is owned by Freehills or Freehills Patent & Trade Mark Attorneys. For permission to reproduce articles, please contact Freehills' Public Affairs Consultant, Megan Williams at media@freehills.com on