PRIVACY, SECURITY, ACCESS, AND OWNERSHIP: LEGAL ISSUES IN CLOUD COMPUTING

SW/WC 2012 Technology Conference

March 8-9, 2012

Attributes of Cloud Computing Allows for outsourcing of IT Delivery of scalable IT resources over the

Internet (as opposed to hosting and operating those resources locally)

Familiarity: it’s something we all use (think Gmail, Yahoo, FaceBook)

Allows schools to purchase IT infrastructure and services on an "as needed" basis, without incurring the capital costs of software or hardware

Why is Cloud Computing Attractive to Schools?

Schools can obtain new services Cloud services offer flexibility and

convenience Cloud services are more affordable Cloud services are updated and

upgraded regularly

How Does Cloud Computing Work? Schools procure IT services from remote

providers and members of the school community access those services over the Internet (users can access the applications and files they need from virtually any Internet connected computer)

Software is hosted by the provider and does not need to be installed or maintained on individual computers around the school

Storage and processing needs are met by the cloud

Advantages

Cloud providers specialize in particular applications and services, and this expertise allows them to efficiently manage upgrades and maintenance, backups, disaster recovery, and failures.

Providers, like Google Apps for Education, tailor services to schools (e.g. no advertising, FERPA compliant).

Schools gain the flexibility of being able to respond quickly to requests for new services by purchasing them from the cloud as add ons (e.g. Google Apps for Education’s “Postini” services).

Disadvantages

Cloud Computing raises significant concerns about privacy, security, data integrity, intellectual property management, audit trails, and other issues (although some argue that cloud services offer more security than on-campus solutions, given the complexity of mounting an effective IT security effort at the school level).

Although the benefits of Cloud Computing are becoming more tangible, significant policy and technology issues must still be sorted out.

CLOUD COMPUTING

Legal and Policy Considerations

Information Privacy and Security Regulation: FERPA; COPPA; FCRA; HIPAA;

Gramm-Leach-Bliley Act of 1999; and Payment Card Industry Data Security Standards

Identity Theft User Privacy (and data mining) Ownership of Data

Google Apps for Education: FERPA

FERPA. The parties acknowledge that (a) Customer Data may include personally identifiable information from education records that are subject to FERPA (“FERPA Records”); and (b) to the extent that Customer Data includes FERPA Records, Google will be considered a “School Official” (as that term is used in FERPA and its implementing regulations) and will comply with FERPA.

Google Apps for Education: COPPACustomer acknowledges and agrees that it

is solely responsible for compliance with the Children's Online Privacy Protection Act of 1998, including, but not limited to, obtaining parental consent concerning collection of students' personal information used in connection with the provisioning and use of the Services by the Customer and End Users.

Google Apps for Education: Confidential Information

Obligations. Each party will: (a) protect the other party’s Confidential Information with the same standard of care, but no less than a reasonable standard of care, it uses to protect its own Confidential Information; and (b) subject to applicable law, not disclose the Confidential Information, except to Affiliates, employees and agents who have a reasonable need to know it and who have agreed in writing to keep it confidential. Each party (and any Affiliates, employees and agents to whom it has disclosed Confidential Information) may use Confidential Information only to exercise rights and fulfill its obligations under this Agreement, while using reasonable care to protect it. Each party is responsible for any actions of its Affiliates, employees and agents in violation of this Section.

Google Apps for Education: Intellectual Property Rights

Intellectual Property Rights. Except as expressly set forth herein, this Agreement does not grant either party any rights, implied or otherwise, to the other’s content or any of the other’s intellectual property. As between the parties, Customer owns all Intellectual Property Rights in Customer Data, and Google owns all Intellectual Property Rights in the Services.

E-Discovery

It is important to understand the framework of the vendor’s system, how and in what format it keeps your data, and what tools are available to you to access your data.

"Free" services typically will have few such tools available, which likely will make e-discovery a time-consuming and cumbersome task.

IP Infringement

Cloud service providers should be willing to warrant that they actually own the technologies and business processes they use and indemnify the school against any potential intellectual property infringement claim that may arise as a result of its technologies or business processes.

Google Apps for Education: Indemnification

By Google. Google will indemnify, defend, and hold harmless Customer from and against all liabilities, damages, and costs (including settlement costs and reasonable attorneys’ fees) arising out of a third party claim that Google’s technology used to provide the Services or any Google Brand Feature infringe or misappropriate any patent, copyright, trade secret or trademark of such third party. Notwithstanding the foregoing, in no event shall Google have any obligations or liability under this Section arising from: (i) use of the Services or Google Brand Features in a modified form or in combination with materials not furnished by Google, and (ii) any content, information or data provided by Customer, End Users or other third parties.

Google Apps for Education: Possible Infringement

Possible Infringement.

(a) Repair, Replace, or Modify. If Google reasonably believes the Services infringe a third party’s Intellectual Property Rights, then Google will: (a) obtain the right for Customer, at Google’s expense, to continue using the Services; (b) provide a non-infringing functionally equivalent replacement; or (c) modify the Services so that they no longer infringe.

(b) Suspension or Termination. If Google does not believe the foregoing options are commercially reasonable, then Google may suspend or terminate Customer’s use of the Services with a minimum of six months written notice to Customer, unless prohibited by a court of competent jurisdiction.

Terms of Use

Schools should attempt to require cloud service providers to provide direct, individual notice sufficiently in advance of the effective date of any amendments to the provider’s terms of use, along with the right to terminate if such amendments are unacceptable to the school.

Suggested language: “Provider may make commercially reasonable modifications to the Service, provided it does not materially diminish the nature, scope, or quality of the Service."

Google Apps for Education: Modifications to the Services

To the Services. Google may make commercially reasonable changes to the Services from time to time. If Google makes a material change to the Services, Google will inform Customer, provided that Customer has subscribed with Google to be informed about such material change.

Google Apps for Education: Modifications to URL Terms

To URL Terms. Google may make commercially reasonable changes to the URL Terms from time to time. If Google makes a material change to the URL Terms, Google will inform Customer by either sending an email to the Notification Email Address or alerting Customer via the Admin Console. If the change has a material adverse impact on Customer and Customer does not agree to the change, Customer must so notify Google via the Help Center within thirty days after receiving notice of the change. If Customer notifies Google as required, then Customer will remain governed by the terms in effect immediately prior to the change until the end of the then current Term. If the Services are renewed, they will be renewed under Google's then current URL Terms.

Export Controls

This is largely an issue for higher education institutions involved in research

Some provider form contracts expressly reserve the right to store customer data in any country in which the provider does business, which can raise export control issues. 

Schools housing research data should be mindful of this and include language in their contracts prohibiting “extraterritorial” storage.

Google Apps for Education: Facilities and Data Transfer

As part of providing the Services, Google may transfer, store and process Customer Data in the United States or any other country in which Google or its agents maintain facilities. By using the Services, Customer consents to this transfer, processing and storage of Customer Data.

Service Level Agreement issues Amount of guaranteed “uptime” Process and timeline for dealing with “downtime” Notice provisions (e.g. amount of notice due before

suspension of service) Provision regarding availability of school data post-

termination and provider’s obligation to destroy copies of data once termination and transition to a new service is complete

Circumstances under which the provider may suspend an individual end user’s account

Consequences for failure to meet these requirements

Google Apps for Education: Contract references separate agreement

“SLA” means the Services Level Agreement located here: http://www.google.com/a/help/intl/en/admins/sla.html, or other such URL as Google may provide.

Google Apps for Education: End User Accounts

End User Accounts. Customer may request End User Accounts by: (i) requesting them online via the Admin Console; or (ii) after the Services Commencement Date, contacting Google support personnel. Customer can suspend or delete End User Accounts at any point in time through the Admin Console.

Google Apps for Education: Suspension of End User Accounts by Google

Of End User Accounts by Google. If Google becomes aware of an End User’s violation of the Agreement, then Google may specifically request that Customer Suspend the applicable End User Account. If Customer fails to comply with Google’s request to Suspend an End User Account, then Google may do so. The duration of any Suspension by Google will be until the applicable End User has cured the breach, which caused the Suspension.

Google Apps for Education: Emergency Security Issues

Emergency Security Issues. Notwithstanding the foregoing, if there is an Emergency Security Issue, then Google may automatically Suspend the offending use. Suspension will be to the minimum extent and of the minimum duration required to prevent or terminate the Emergency Security Issue. If Google Suspends an End User Account for any reason without prior notice to Customer, at Customer’s request, Google will provide Customer the reason for the Suspension as soon as is reasonably possible.

Suspension/Termination of Contract

Be explicit about the reasons either party may suspend or terminate the contract

Specify what happens to the data post-termination

Scrutinize “automatic renewal” clauses (particularly with regard to fee increases)

Google Apps for Education: Term; Auto Renewal

Auto Renewal. At the end of the Initial Term and each renewal term, the Services will automatically renew for an additional term of twelve months. If either party does not want the Services to renew, then it must notify the other party in writing at least 90 days prior to the end of the then current term. This notice of non-renewal will be effective upon the conclusion of the then-current term.

Google Apps for Education: Termination for Breach

Termination for Breach. Either party may suspend performance or terminate this Agreement if: (i) the other party is in material breach of the Agreement and fails to cure that breach within thirty days after receipt of written notice; (ii) the other party ceases its business operations or becomes subject to insolvency proceedings and the proceedings are not dismissed within ninety days; or (iii) the other party is in material breach of this Agreement more than two times notwithstanding any cure of such breaches.

Google Apps for Education: Other Termination

Other Termination. Customer may terminate this Agreement for any reason (or no reason) with thirty days prior written notice to Google.

Google Apps for Education: Effects of Termination

Effects of Termination. If this Agreement terminates, then: (i) the rights granted by one party to the other will cease immediately (except as set forth in this Section); (ii) Google will provide Customer access to and the ability to export the Customer Data for a commercially reasonable period of time at Google's then-current rates for the applicable Services; provided that if Customer needs Google to provide access and the ability to export Customer Data for a minimum period of time (such time period not to exceed 90 days), then prior to termination, Customer must notify Google of that request; (iii) after a commercially reasonable period of time, Google will delete Customer Data by removing pointers to it on Google’s active and replication servers and overwriting it over time; and (iv) upon request each party will promptly use commercially reasonable efforts to return or destroy all other Confidential Information of the other party.

Google Apps for Education: Term; No Fees

No Fees. During the Initial Term, Google will not charge Customer fees for the Services. If Google decides to charge a fee for the Services after the Initial Term it must notify Customer of such fee in writing at least 12 months prior to the end of the then current Term. Upon the parties’ mutual written agreement, (a) Google may charge Customer fees for the Services after the Initial Term and (b) Google may charge Customer fees for a premium version of the Services or for optional functionality or enhancements that may be added to the Services by Google.

Accessing Data – Extraordinary Circumstances

Schools should outline specific circumstances in which they may need to access user information from the provider (e.g. in cases of concern for the health or safety of a student, to check on a student’s use of e-mail services and possibly even the content of his or her e-mail messages.) 

Schools should review its existing practices in this area (death of student, health or safety emergency of the individual, health or safety emergency of the institution or other people) and ensure the contract with the provider provides access.

Google Apps for Education:Customer Administration of the Services

Customer Administration of the Services. Customer may specify one or more Administrators through the Admin Console who will have the rights to access Admin Account(s) and to administer the End User Accounts. Customer is responsible for: (a) maintaining the confidentiality of the password and Admin Account(s); (b) designating those individuals who are authorized to access the Admin Account(s); and (c) ensuring that all activities that occur in connection with the Admin Account(s) comply with the Agreement. Customer agrees that Google’s responsibilities do not extend to the internal management or administration of the Services for Customer and that Google is merely a data-processor.

Warranty and IndemnificationWith regard to warranties, at a minimum,

the contract should: Warrant that the service conforms to and

will perform in accordance with its specifications

Warrant that the service does not infringe any third-party intellectual property rights

Warranty and IndemnificationWith regard to indemnification, the contract should

address: Indemnification by provider for infringement of 3rd

party intellectual property rights AND inappropriate disclosure or data breach (ideally, the provider would indemnify for all acts and omissions)

Indemnification by the school should be limited in the case of misconduct by end users.

(Note, some schools may have state law restrictions on their ability to indemnify providers)

Choice of Law/Venue

Because some schools may have state law restrictions on their ability to consent to these clauses, the following approach is encouraged:

Choose the school’s law and jurisdiction as the governing law;

Provide that actions must be brought in the defendant’s jurisdiction; or

Simply delete the Choice of Law clause entirely.

Additional Issues

Publicity (i.e. use of the school’s name, logo, or trademark)

Responsibility for unauthorized or inappropriate use (it is preferable to state only that the school will not “authorize” or “knowingly allow” inappropriate use of the provider’s service)

Negotiating Contracts

Don’t sign a provider’s form “as is” Retain counsel to assist with contract

review Consider “pooling resources” with other

schools (See, e.g. Wisconsin Department of Public Instruction’s approach, including negotiated contract and consent forms)

Possible Contract Approaches Baseline: Individual schools provide the services best

suited to the edge/leverage culture of their schools. Commercial Sourcing (COMSo): Schools identify and

shift particular services to a commercial service provider via contract (student mail is a leading example of this as is iTunesU).

Institutional Sourcing (INSo): An institution (e.g. state college or university) provides IT services to schools via contract and fee.

Consortium Sourcing (CONSo): Schools aggregate demand, define service levels, and governance for a service then source the provisioning of that service to (a) commercial providers and/or (b) institutional providers.

Thank you!Little Buffalo Law & Consulting

Conclusion