Drawing Lines in the Cloud: Jurisdictional Access to Data. Nancy Libin Mary Ellen Callahan

Transcription

1 Drawing Lines in the Cloud: Jurisdictional Access to Data Nancy Libin Mary Ellen Callahan

2 OVERVIEW Introduction to Cloud Computing Definition Benefits and Risks How does the physical location of data or the cloud provider affect what laws apply? Challenges for cloud providers

3 CLOUD NINE: WHAT IS CLOUD COMPUTING? Cloud computing is the use of computer hardware and software to enable ubiquitous, convenient, ondemand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. (NIST definition) Customers rent space, software and infrastructure Creates efficiencies and economies of scale 3

4 BENEFITS AND RISKS OF CLOUD COMPUTING Benefits of cloud computing Reduces start-up costs; Enables small and medium enterprises to reduce capital expenditures; Convenient to users who can access from anywhere; and Allows enhanced functionality on mobile devices Risks of cloud computing Data security; Privacy; and Other legal restrictions, including jurisdictional impediments to data access and protection 4

5 PHYSICAL LOCATION OF CLOUD PROVIDER AND LOCAL LAWS U.S. cloud companies that store data in U.S. Legal process still required for access to data Subject to challenge by recipient, even if non-u.s. entity Access not restricted to U.S.-based providers, if jurisdiction Informal requests for info should not be honored by cloud companies

6 USA PATRIOT ACT MYTHS Portions of the PATRIOT Act updated existing investigative tools (primarily in terrorism) PATRIOT Act did not eliminate high restrictions on access to data Under frequently cited business records authority Government still must first get a court order Judge will issue only if records sought are relevant to authorized investigation to protect against terrorism or other clandestine activities

7 ELECTRONIC COMMUNICATIONS PRIVACY ACT Access to content in the cloud: Search warrant based on showing of probable cause for content stored less than 180 days If content stored 180 days or more, law enforcement can obtain with court order or subpoena on lesser showing Does the 180-day distinction make sense in a cloud environment? Should cloud providers require warrant regardless (6 th Cir Case, U.S. v. Warshak)?

8 MUTUAL LEGAL ASSISTANCE EU cloud providers are also subject to compliance requests from other countries under Mutual Legal Assistance Treaties ( MLATs ) International law enforcement cooperation is critical

9 2001 CYBERCRIME CONVENTION Sets out legal framework for law enforcement and judicial access to electronic data Extra-territoriality considered in convention Article 19: possession or control Article 32: open source or lawful and voluntary consent of person who has lawful authority to disclose Signatories obliged to cooperate with requests for data

10 PHYSICAL LOCATION OF CLOUD PROVIDER AND LOCAL LAWS Foreign and U.S. cloud companies that store data outside the U.S. EU Data Retention Directive (2006/24/EC) (telecom providers) Many Member States authorize interception of communications if relevant to investigation Extra-territorial jurisdiction in some member states

11 NOTICE In U.S.: Notice to the subscriber and an opportunity to challenge the process in court (e.g., a subpoena) Notice can be withheld in limited circumstances where notice would imperil the investigation or in national security-related investigations In EU: Various legal standards with regard to both access and notice

12 EU GUIDANCE ON CLOUD COMPUTING Article 29 Working Party Opinion on Cloud Computing (Opinion 05/2012 of July 1st, 2012)(WP 196) Recommends guarantees from CSP More complicated for EU companies to choose U.S. providers and for U.S. companies to choose EU providers Highest or lowest common denominator for multinational use of cloud computing? European Commission Communication Unleashing the Potential of Cloud Computing in Europe (COM 2012, 529/2 of September 2012) 12

13 U.S. GUIDANCE ON CLOUD COMPUTING MYTHS Five Myths Regarding Privacy and Law Enforcement Access to Personal Information in the European Union and the United States, available on the Department of State website at 71/PDFs/Five%20Myths%20Regarding%20P rivacy%20and%20law%20enforcement_oct ober%209_2012_pdf.pdf 13

14 CHALLENGES FOR CLOUD PROVIDERS Overcoming the myth that data stored with U.S. cloud providers is more vulnerable to access by law enforcement Determining data protection obligations How do dynamic data storage practices of cloud providers (shifting data among different servers) affect applicable laws and obligations? Does this business practice trigger onward transfer obligations? Implications for asset transfers, mergers, and acquisitions Data controllers vs. data processors (EU) 14

15 CHALLENGES FOR CLOUD PROVIDERS (CONT.) Making changes to Terms of Service and Privacy Policies Limiting access through contractual provisions (choice of law clauses, limitations on subcontractors, prohibition on location of data storage) Performing due diligence on the Cloud Service Provider -- security, privacy, compliance, and jurisdictional requirements 15

16 DUE DILIGENCE ON CLOUD PROVIDERS Cloud Provider due diligence Transparency regarding security, privacy, and compliance protections in place In contract, request notification of law enforcement request Location of Cloud Provider, data transfers, and ownership Jurisdictional restrictions in contracts, if desired (a/k/a availability zones) Subcontractors allowed? Disclosed? Breach liability/reimbursement Review insurance coverage for privacy- and breach-related claims Review/audit rights Cloud Provider long term viability, and costs to switch Business continuity and disaster recovery 16

17 QUESTIONS? Nancy Libin, Wilkinson Barker Knauer, LLP (202) Mary Ellen Callahan, Jenner & Block (202)