Docstoc

DLA_Cloudcomputing legal considerations

Document Sample
DLA_Cloudcomputing legal considerations Powered By Docstoc
					Legal considerations

Cloud computing contracts




                                                       Kristof De Vulder
               Partner and Head of Belgian Technology and Sourcing Group
                                                          DLA Piper LLP


                                                       ADM, 2 June 2010
OVERVIEW


        Cloud computing contracts different from other IT-contracts?
        Typical contractual issues in the cloud




 My aim: turn the legal "issues" into (normal) legal considerations




Legal considerations cloud computing                              2 June 2010   2
Definition cloud computing
Old wine, new bottles?




                                       “The interesting thing about Cloud
                                       computing is that we’ve redefined Cloud
                                       computing to include everything that we
                                       already do… Maybe I’m an idiot, but I
                                       have no idea what anyone is talking
                                       about. What is it?”

                                       Larry Ellison, Oracle CEO




Legal considerations cloud computing                                       2 June 2010   3
Difference with other IT-contracts


        Cloud computing contracts different from SaaS, ASP,
         outsourcing, hosting contracts? (not really)
             similar issues depending on type of cloud computing services
             additional contractual issues following "cloud aspects"
             "packaging" of cloud computing contracts
        Structure of the contracts
             cloud computing contracts resemble typical software licenses, although
              taking into account the subject matter of such contracts, cloud
              computing contracts should be more closely related to hosting or
              (strategic) outsourcing contracts
        Low barrier to entry
              “click-wrap agreements” are legally enforceable!
        Often presented as less or no "legalese" contracts - but
         appearences may be deceiving
Legal considerations cloud computing                                     2 June 2010   4
Example clauses




             ""BY CLICKING THE "ACCEPT" BUTTON FOR THIS AGREEMENT OR
             ACCEPTING ANY MODIFICATION TO THIS AGREEMENT IN ACCORDANCE
             WITH SECTION 2 BELOW, YOU AGREE TO BE BOUND BY THE TERMS AND
             CONDITIONS OF THIS AGREEMENT. IF YOU ARE ENTERING INTO THIS
             AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU
             REPRESENT THAT YOU HAVE THE LEGAL AUTHORITY TO BIND THE LEGAL
             ENTITY TO THIS AGREEMENT, IN WHICH CASE "YOU" SHALL MEAN SUCH
             ENTITY. IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT AGREE
             WITH THE TERMS AND CONDITIONS OF THIS AGREEMENT, YOU MUST SELECT
             THE "DECLINE" BUTTON AND YOU MAY NOT USE THE SERVICES."




Legal considerations cloud computing                                    2 June 2010   5
Difference with other IT-contracts


  Standard commoditized offering, therefore limited flexibility or ability
   to change
        shift in mentality
        contract evaluation should be a key part of provider selection
  Test
        will a standard offering with its standard terms meet my needs?
        selection between different contracts as opposed to contract negotiations
        critical data or strategic services may not be suited for the cloud unless
         appropriate contract terms can be agreed upon




Legal considerations cloud computing                                      2 June 2010   6
Contractual issues in the cloud


        Security and compliance risks should be effectively addressed
        Limited supplier obligations
        Extent of liability?
        Where is my data?
        Suspension and termination clauses
        Vendor lock-in and transitioning
        SLA
        Applicable law and competent court




Legal considerations cloud computing                             2 June 2010   7
Limited supplier obligations


  Typical obligations, warranties or other safeguards of sourcing or
   hosting contracts are not included in cloud computing contracts
  Due to their commoditized approach, cloud computing contracts
   typically contain less onerous obligations on the supplier




Legal considerations cloud computing                           2 June 2010   8
Example clauses


             "11. EXCLUSION OF WARRANTIES

             11.1. NOTHING IN THESE TERMS, INCLUDING SECTIONS 11 AND 12, SHALL
             EXCLUDE OR LIMIT GOOGLE'S WARRANTY OR LIABILITY FOR LOSSES WHICH
             MAY NOT BE LAWFULLY EXCLUDED OR LIMITED BY APPLICABLE LAW.
             11.2. YOU EXPRESSLY UNDERSTAND AND AGREE THAT YOUR USE OF THE
             SERVICE IS AT YOUR SOLE RISK AND THAT THE SERVICE IS PROVIDED
             "AS IS" AND "AS AVAILABLE."
             11.3. GOOGLE, ITS SUBSIDIARIES AND AFFILIATES, AND ITS LICENSORS
             MAKE NO EXPRESS WARRANTIES AND DISCLAIM ALL IMPLIED WARRANTIES
             REGARDING THE SERVICE INCLUDING IMPLIED WARRANTIES OF
             MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
             NON-INFRINGEMENT. WITHOUT LIMITING THE GENERALITY OF THE
             FOREGOING, GOOGLE, ITS SUBSIDIARIES AND AFFILIATES, AND ITS
             LICENSORS DO NOT REPRESENT OR WARRANT TO YOU THAT: (A) YOUR
             USE OF THE SERVICE WILL MEET YOUR REQUIREMENTS, (B) YOUR USE OF
             THE SERVICE WILL BE UNINTERRUPTED, TIMELY, SECURE OR FREE FROM
             ERROR, AND (C) USAGE DATA PROVIDED THROUGH THE SERVICE WILL
             BE ACCURATE."
             (Google App Engine Terms of Service)*

             * The clauses set forth in this presentation are merely extracts of existing cloud computing
               contracts available online and do not constitute recommended clauses or sample clauses

Legal considerations cloud computing                                                                        2 June 2010   9
Extent of liability


  Many publicly available cloud computing contracts limit liability of
   hosting provider to a level that is not in line with the potential risk
  While the amount paid by a customer might be modest, a clause
   limiting the liability of the service provider to this amount will often be
   disproportionate to the significant risks involved for a customer in
   case its data would become temporarily unavailable or permanently
   lost
  Issues include:
            almost total exclusion of liability
            limited financial cap
            exclusion of certain types of loss (e.g. indirect loss and/or data loss)
            force majeure definition
            often unilateral


Legal considerations cloud computing                                         2 June 2010   10
Example clauses




                       "17. Limitation of Liability
                       IN NO EVENT SHALL EITHER PARTY'S AGGREGATE LIABILITY EXCEED
                       THE AMOUNTS ACTUALLY PAID BY AND/OR DUE FROM YOU IN THE TWELVE (12)
                       MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO SUCH
                       CLAIM. IN NO EVENT SHALL EITHER PARTY AND/OR ITS LICENSORS BE LIABLE
                       TO ANYONE FOR ANY INDIRECT, PUNITIVE, SPECIAL, EXEMPLARY, INCIDENTAL,
                       CONSEQUENTIAL OR OTHER DAMAGES OF ANY TYPE OR KIND (INCLUDING LOSS
                       OF DATA, REVENUE, PROFITS, USE OR OTHER ECONOMIC ADVANTAGE) ARISING
                       OUT OF, OR IN ANY WAY CONNECTED WITH THIS SERVICE, INCLUDING BUT NOT
                       LIMITED TO THE USE OR INABILITY TO USE THE SERVICE, OR FOR ANY CONTENT
                       OBTAINED FROM OR THROUGH THE SERVICE, ANY INTERRUPTION, INACCURACY,
                       ERROR OR OMISSION, REGARDLESS OF CAUSE IN THE CONTENT, EVEN IF THE
                       PARTY FROM WHICH DAMAGES ARE BEING SOUGHT OR SUCH PARTY'S
                       LICENSORS HAVE BEEN PREVIOUSLY ADVISED OF THE POSSIBILITY OF SUCH
                       DAMAGES"
                       (Terms of Use, Salesforce.com)




Legal considerations cloud computing                                                    2 June 2010   11
Data protection


 - Where is my data? (do I actually care?)
 - Two examples of problems:
          Who is controller?
                 Legislation makes fundamental distinction between data controller
                  (party that defines the purpose and the means of data processing)
                  and the data processor ("dumb performer")
                 distinction is crucial to know who is responsible
                 data controller is liable towards data subjects
                 data controler must choose appropriate data processors and must
                  seek adequate contractual protection from them
          Transfer outside of EU?
                 Principle: no transfer of data to countries outside the EEA that do not
                  offer "adequate level of protection"
                 Exceptions


Legal considerations cloud computing                                          2 June 2010   12
Example clauses


  Where is my data? (1)

              "19. DATA PROTECTION

              Each of us agrees to comply with our respective obligations under the Data Protection
              Act 1998 (the “Act”) as applicable to personal data that it controls or processes as part
              of, or in connection with, its use or provision of the Services. Specifically, but without
              limitation, you must comply with the Act as it relates to personal data that you store
              or transfer using your Hosted System. You agree that, subject to the requirements
              of this paragraph and Rackspace’s obligations stated in Section 26 (Assignment,
              Subcontractors), Rackspace may give its affiliates and subcontractors outside of the
              European Economic Area (EEA) access to personal data you store on your Hosted
              System. For example, we may provide our US affiliates with access to your Hosted
              System so that the US affiliate may provide Support to you during our of office hours
              in the UK."

              (Rackspace, General Terms)




Legal considerations cloud computing                                                            2 June 2010   13
Example clauses


  Where is my data? (2)

                 "We agree that we will not provide access to personal data that you store on your
                 Hosted System to any subcontractor or affiliate outside of the EEA unless that person
                 meets the requirements stated below during the entire time that it has access to the
                 personal data:
                 19.1.1 for personal data for which we are a “controller” under the Act, the affiliate or
                 subcontractor to whom we transfer the personal data is either (i) located in a country
                 for which the European Commission has made a positive finding of adequacy, or (ii)
                 the affiliate or subcontractor is located in the United States and has certified to the
                 United States Department of Commerce that it adheres to the Safe Harbour
                 framework developed by the United States Department of Commerce in
                 coordination with the European Union, and
                 19.1.2 for personal data for which we are a “processor” under the Act, the affiliate or
                 subcontractor that has access to the Hosted System has signed a data processing
                 agreement with us. We have such an agreement in place with Rackspace US, Inc.,
                 and have posted a signed copy of that agreement at
                 www.rackspace.co.uk/legal/subprocessing/."

                 (Rackspace, General Terms)




Legal considerations cloud computing                                                            2 June 2010   14
Suspension or termination


  Pitfalls of suspension clauses
          impact on continuity
          low barrier for suspension of services/unplanned interruptions
          minor non-compliance may lead to significant remedy for the supplier
  Termination for convenience by the supplier
          notice period
          exit obligations

  Termination for convenience by the customer
          typically cloud computing contracts allow for easy exit for the customer
          check contracts for termination for convenience because not always the
           case or such exit does not come cheap
  Risk of cloud provider going out of business or restructuring its
   service portfolio
Legal considerations cloud computing                                        2 June 2010   15
Example clauses

  Suspension or termination by the customer
             "3.2. Termination by You for Convenience. You may terminate this Agreement for any
             reason or no reason at all, at your convenience, by (i) providing us written notice of
             termination in accordance with Section 15 and (ii) closing your account for any Service
             for which we provide an account closing mechanism."
             (Amazon Web Services Customer Agreement)

             "In addition to any other rights granted to salesforce.com herein, salesforce.com reserves
             the right to suspend or terminate this Agreement and your access to the Service if your
             account becomes delinquent (falls into arrears). Delinquent invoices (accounts in arrears)
             are subject to interest of 1.0% per month on any outstanding balance, or the maximum
             permitted by law, whichever is less, plus all expenses of collection. You will continue to be
             charged for User licenses during any period of suspension. If you or salesforce.com initiates
             termination of this Agreement, you will be obligated to pay the balance due on your account
             computed in accordance with the Charges and Payment of Fees section above. You agree
             that salesforce.com may charge such unpaid fees to your credit card or otherwise bill you f
             or such unpaid fees.
             Salesforce.com reserves the right to impose a reconnection fee in the event you are suspended
             and thereafter request access to the Service. You agree and acknowledge that salesforce.com
             has no obligation to retain Customer Data and that such Customer Data may be irretrievably
             deleted if your account is 30 days or more delinquent."
             (Salesforce Master subscription agreement)


Legal considerations cloud computing                                                         2 June 2010   16
Example clauses


  Suspension or termination by the cloud provider
                   "3.3. Termination or Suspension by Us Other Than for Cause.

                   3.3.1. Free Services. We may suspend your right and license to use any or all Free
                   Services and any associated Amazon Properties (as defined in Section 6.1 below), or,
                   if you are only using Free Services, terminate this Agreement in its entirety (and,
                   accordingly, cease providing all Services to you), for any reason or for no reason, at
                   our discretion at any time, immediately upon notice to you in accordance with the
                   notice provisions set forth in Section 15 below.

                   3.3.2. Paid Services (other than Amazon FPS and Amazon DevPay). We may
                   suspend your right and license to use any or all Paid Services (and any associated
                   Amazon Properties) other than Amazon FPS and Amazon DevPay, or terminate this
                   Agreement in its entirety (and, accordingly, cease providing all Services to you), for
                   any reason or for no reason, at our discretion at any time by providing you sixty (60)
                   days' advance notice in accordance with the notice provisions set forth in Section 15
                   below."

                   (Amazon Web Services Customer Agreement)




Legal considerations cloud computing                                                          2 June 2010   17
Vendor lock-in and transitioning


  Possibility to terminate for convenience may not be an option in
   practice due to lack of appropriate termination assistance
   arrangements
          There is no general legal requirement for a vendor to provide you with
           data export facilities, continued licensing of applications or assist you
           with the migration to another cloud provider
          Everything depends on your contractual agreement




Legal considerations cloud computing                                       2 June 2010   18
Example clauses


  Vendor lock-in and transitioning




                   "11. (..) In the event this Agreement is terminated (other than by reason of your breach),
                   salesforce.com will make available to you a file of the Customer Data within 30 days
                   of termination if you so request at the time of termination. You agree and
                   acknowledge that salesforce.com has no obligation to retain the Customer Data, and
                   may delete such Customer Data, more than 30 days after termination."

                   (Terms of use, Salesforce.com)




Legal considerations cloud computing                                                            2 June 2010   19
Service level agreements


  Often not part of standard offering
  SLA without "teeth"
  Level of service offered (typically a choice - gold, silver, bronze)
  Points of attention:
          how is the availability calculated by the provider?
                 e.g. 10 outages of 6 minutes versus 1 outage of 1 hour
          focus on correction?
          reporting and access to measurement data?
          right to audit?
          are service credits the “sole remedy”?




Legal considerations cloud computing                                       2 June 2010   20
Example clauses


  Microsoft SQL Azure Service Level Agreement
                            "1. (…)

                            d. Service Credits
                                  (…)
                                  ii. Service Credits are Customer’s sole and exclusive remedy for
                                  any violation of this SLA.

                                       2. Service Levels
                                       a. Monthly Availability Service Level
                                       i. Definitions
                                              1. "Total time intervals” is …
                                              2. A 5-minute interval is marked as unavailable if …
                                              3. “Scheduled Downtime” means …
                                              4. “Monthly Uptime Percentage” for a specific Customer is
                                                 calculated by …"

                                       (Microsoft SQL Azure Service Level Agreement)




Legal considerations cloud computing                                                                  2 June 2010   21
Applicable law and competent court


  Laws applying to the contract vs. the court that will decide in the
   event of disputes
  Applicable laws
          Law based on which the agreement will be construed
          Often (but not always) laws of the UK or US
  Competent court
          Court that you will need to go to in the event of disputes
          Often (but not always) courts in the UK or US




Legal considerations cloud computing                                    2 June 2010   22
Example clauses


  Applicable law and competent court


               "30. GOVERNING LAW, LAWSUITS
               The Agreement is governed by the English law and each of us expressly and
               unconditionally submits to the exclusive jurisdiction of the courts of England and
               Wales except that Rackspace may seek to enforce any judgment anywhere in the
               world where you may have assets. Each of us agrees that it will not bring a claim
               under the Agreement more than two (2) years after the event giving rise to the claim
               occurred."

               (Rackspace, General Terms)




Legal considerations cloud computing                                                         2 June 2010   23
Any questions or comments?




  Kristof.DeVulder@dlapiper.com
  Partner
  DLA Piper LLP




Legal considerations cloud computing   2 June 2010   24

				
DOCUMENT INFO
Shared By:
Categories:
Tags:
Stats:
views:9
posted:7/27/2012
language:English
pages:24