SELECTED LEGAL ISSUES

Transcription

1 SELECTED LEGAL ISSUES OF CLOUD COMPUTING Geneva, June 26, 2014 Internet Law Summer School Michel Jaccard Juliette Ancelle id est avocats, Lausanne 1

2 What is «cloud computing»? No statutory, scholarly or case law definition under Swiss law. For the purposes of this presentation : The practice of using a network of remote servers hosted on the Internet or within a private virtual network to store, manage, and process data, rather than a local server. 2

3 Today s goals To identify which elements shall be considered in a risk analysis when assessing whether to migrate to the cloud or not; No business/commercial/financial analysis of a cloud business model No technical/technological analysis 3

4 Outline of the presentation I. The legal and regulatory environment II. Navigating through the clouds III. Specific issues and contract provisions 4

5 I. The legal and regulatory environment 5

6 I. THE LEGAL AND REGULATORY ENVIRONMENT Cloud computing is a way to conduct business. There is no general prohibition under Swiss law to conduct business using cloud computing providers. As cloud computing implies the outsourcing of certain tasks in different locations or jurisdictions, certain limitations may be imposed or additional requirements may need to be satisfied. Such limitations will depend on several factors. 6

7 I. THE LEGAL AND REGULATORY ENVIRONMENT Tendency to focus on the regulatory and privacy risks in connection with cloud computing (compliance) but additional risks should be taken into consideration Main risks relating to cloud computing: Non compliance Loss of control over the data Confusion or mixing of your data with third party data Lock in towards the service provider Access to data by foreign authorities or by competitors (fishing expeditions) 7

8 I. THE LEGAL AND REGULATORY ENVIRONMENT Limitations based on industry specific regulations: Banking services (FINMA Circular 2008/7 Outsourcing) Legal services (professional secrecy; art. 321 Criminal Code; local professional rules) Healthcare (professional secrecy; art. 321 Criminal Code; art. 35 Data Protection Act) 8

9 I. THE LEGAL AND REGULATORY ENVIRONMENT Limitations arising from the type of data being processed in the cloud, and the purpose of the processing: Non personal data vs. personal data (art. 1ss Data Protection Act) Sensitive personal data and profiling (art. 3 and 12 Data Protection Act) Data relating to employees (art. 328bis Code of Obligations) Accounting and evidentiary data (art. 958ff Code of Obligations) 9

10 I. THE LEGAL AND REGULATORY ENVIRONMENT Additional limitations resulting from the location of the provider or of the data themselves: Compliance requirements for the cross-border transfer of personal data (art. 6 Data Protection Act; FINMA Circular 2008/7) Cumulative application of foreign laws and regulations Increased protection measures might be required to reduce the risk of facilitated access to confidential and proprietary data by foreign law enforcement authorities, or competitors 10

11 II. Navigating through the clouds 11

12 II. NAVIGATING THROUGH THE CLOUDS Step one (who sits in the cockpit?) : Who s in charge? Decision to migrate to the cloud involves several stakeholders: Operations, Finance, Management, Board, Legal, Procurement, Consultants, existing outsourcing provider. Who is the business sponsor / owner? Migration projects to the cloud often fail or miss the expectations due to lack of proper governance / clear internal leadership. 12

13 II. NAVIGATING THROUGH THE CLOUDS Step two (who is on the passengers list? What is my cargo?): What data (sets) will be pushed to the cloud? Required step to identify potential limitations or additional legal requirements (prohibition of transfer, conclusion of specific agreements, adoption of special measures) Step is sometimes overlooked / conducted on assumptions rather than detailed analysis (for lack of knowledge?) 13

14 II. NAVIGATING THROUGH THE CLOUDS Step three (Am I in the right plane? What is the flight plan and where am I supposed to land? Let s go through the take off checklist): Internal discussion of the migration needs and expectations, of the specificities of the cloud solution sought and of the requested warranties Is it a strategic project, or part of a financial / cost cutting effort? How important / crucial is my access to the data? Do I need reliability, (confidentiality), performance, flexibility/scalability, low cost cold storage or managed services? 14

15 II. NAVIGATING THROUGH THE CLOUDS Step four (airline flight monitoring and traffic control; any emergency procedures in place?) : Set up an internal follow up process to monitor the performance of the provider and adopt clear internal supervisory and reaction process Will allow a stronger enforcement of contractual rights and warranties Efficient anticipation and solving of compliance or performance issues A good contract is useless if you do not use it (audit rights, maintenance, upgrades, etc.) 15

16 II. NAVIGATING THROUGH THE CLOUDS 16

17 II. NAVIGATING THROUGH THE CLOUDS 17

18 II. NAVIGATING THROUGH THE CLOUDS 18

19 III. Specific issues and contractual provisions 19

20 III. SPECIFIC ISSUES A. Management and protection of data B. Liability C. Subcontracting 20

21 A. Management and protection of data What type of data is concerned? What is the purpose of the processing of the collected data? Who shall collect / process the data? Where will the data be stored? What measures are put in place for the security of data? Has consent been obtained? 21

22 A. Management and protection of data Brief overview of applicable rules: Federal Act on Data Protection (FDP) / Cantonal laws for local administrations; Personal data: All information relating to an identified or identifiable person; (art. 3 FDP) Sensitive data: Data on (1) religious, ideological, political or trade union-related views or activities, (2) health, the intimate sphere or the racial origin, (3) social security measures, (4) administrative or criminal proceedings and sanctions; (art. 3 FDP) 22

23 A. Management and protection of data Transfer of data (art. 10a FDP) not possible unless Consent / authorized by law Limited to the data controller s own authorized use Written agreement and proper guarantee regarding security of the data Not prohibited by contractual or legal confidentiality duty Cross-border transfer (art. 6 FDP): Prohibited in case of risk for the data subject, in particular due to inadequate level of regulatory protection Possible measures to implement allowing such transfer (consent, safe harbor, model agreements, BCR, etc.) 23

24 A. Management and protection of data Example 1: All Customer Data is, or will be, and shall remain the property of Customer and shall be deemed Confidential Information of Customer. Without Customer s approval (in its sole discretion), the Customer Data shall not be (1) used by Vendor or Vendor Agents other than in connection with providing the Services, (2) disclosed, sold, assigned, leased, or otherwise provided to third parties by Vendor or Vendor Agents, or (3) commercially exploited by or on behalf of Vendor or Vendor Agents. Vendor hereby irrevocably assigns, transfers, and conveys, and shall cause Vendor Agents to assign, transfer, and convey, to Customer without further consideration all of its and their right, title, and interest in and to the Customer Data. Upon request by Customer, Vendor shall execute and deliver, and shall cause Vendor Agents to execute and deliver, any financing statements or other documents that may be necessary or desirable under any Law to preserve, or enable Customer to enforce, its rights hereunder with respect to the Customer Data. 24

25 A. Management and protection of data Example 2: Upon request by Customer at any time during the Term and upon expiration or termination of this Agreement, Vendor shall (1) promptly return to Customer, in the format and on the media requested by Customer, all or any part of the Customer Data and (2) erase or destroy all or any part of the Customer Data in Vendor s possession, in each case to the extent so requested by Customer. Any archival tapes containing Customer Data shall be used by Vendor and Vendor Agents solely for backup purposes. 25

26 B. Liability regime What is the liability regime applicable to the service provider? To the client? What warranties are provided in the contract? What means are available in case of breach? Obligation to restore? Obligation to indemnify? Up to a maximum amount? 26

27 B. Liability regime Circulaire FINMA 2008/07: «The Company remains liable towards the FINMA regarding the field of activities that has been outsourced. It further remains liable towards the FINMA for all fields of transferred activities as if it was operating them itself.» Need for IP reps / indemnification? 27

28 B. Liability regime Example 1: «THE SERVICE OFFERINGS ARE PROVIDED AS IS. WE [ ] MAKE NO REPRESENTATIONS OR WARRANTIES OF ANY KIND [ ] REGARDING THE SERVICE OFFERINGS, INCLUDING WARRANTY THAT THE SERVICE OFFERINGS [ ] WILL BE [ ] FREE OF HARMFUL COMPONENTS, OR THAT ANY CONTENT, INCLUDING YOUR CONTENT [ ], WILL BE SECURE OR NOT OTHERWISE LOST OR DAMAGED.» (Amazon) 28

29 B. Liability regime Example 2: For all claims of CLIENT for damages under or in connection with this Agreement, whatever the legal basis (including tort) may be, PROVIDER s maximum potential liability shall, for each damaging event or series of events, be limited to the lesser of (i) one million Swiss Francs (CHF) and (ii) the price paid by CLIENT to PROVIDER for the specific Service (in case of ongoing Services calculated on an annual basis where applicable) from which such claim arises. 29

30 C. Subcontracting Increases the risk of data loss and risk of loss of control over the data (who stores and processes the data? Where are they located?) Risk that the level of services may not be ensured; Possible issues in the enforcement of warranties or other legal obligations as there is no direct relationship with the subcontractor; Risk of multiple locations / vulnerabilities entry points to the network; Risk of foreign surveillance? 30

31 C. Subcontracting Example 1: PROVIDER may not, without the consent of CLIENT, assign this Agreement or any of its rights under this Agreement, in whole or in part, and may not delegate its obligations or subcontract part of the Services under this Agreement. Any such purported assignment, delegation or subcontracting in contravention of this Article shall be null and void. CLIENT may, without the consent of PROVIDER, assign this Agreement or any of its rights under this Agreement, in whole or in part, to any affiliate of its group of companies. OR Neither Party shall, without the consent of the other Party, assign this Agreement or any amounts payable pursuant to this Agreement, nor subcontract any part of the Services hereunder, except that Customer may assign this Agreement to an Affiliate or another entity or business unit of Customer or pursuant to a reorganization or Change in Control of Customer without such consent. 31

32 C. Subcontracting Example 2: «We may disclose Your Content to provide the Service Offerings to you or any End Users or to comply with any request of a governmental or regulatory body (including subpoenas or court orders).» 32

33 Conclusions Sophisticated environment with many possible roadblocks and increased legal risks and enhanced security exposure compared to in-house hosting and management of IT infrastructure and data BUT All such risks are manageable with a detailed analysis of the data being pushed to the cloud and the required legal fine prints, plus technical safeguards (e.g., encryption) AND The status quo often does not provide an adequate solution 33

34 Questions? 34