Cloud Services, especially for document management, present interesting legal and regulatory issues, such as national jurisdiction over the stored information.  I’ve posted a few musings about the issues but I am not seeing obvious conclusions yet. Rather than posting minor comments one-per-link, here is my collection to date.

 Other posts here on the topic

• Cloud Server or in thin air – Seized – legitimate users of megaupload.com may identify with this
• The question of Encryption
• Haziness of Ownership when it’s Cloud-Based Content
• SOPA and PIPA – the shut-down aspects

Links, with comments/excerpts

Cloud computing and Canadian federally regulated financial institutions

Interesting as I evaluate cloud providers for this blog and our corporate apps!

1) Data commingling and segregation
The use of shared virtual infrastructure may create data commingling and segregation issues. B-10 requires service providers to be capable of isolating an FRE’s data, records and items in process from those of other customers at all times. As a precondition of entering into a cloud computing arrangement which is subject to B-10, an FRE must therefore determine whether the cloud service provider can offer the service in a manner that permits proper data segregation.
2) Accessibility of confidential information
The nature of cloud computing – including the ability for multiple entities to access shared resources and the use of multiple locations across low cost regions – can create data security and privacy issues. B-10 requires the FRE to ensure that security and confidentiality policies of the cloud computing service provider are commensurate with those of the FRE, which should ensure that all necessary protections are in place to secure the confidentiality of the data provided to the cloud infrastructure. In particular, contractual provisions should clearly define who has responsibility for protection mechanisms, the information that is covered by such protections, the ability of either party to modify security procedures and requirements and notification obligations of the cloud service provider should any confidentiality or security breach occur.
3) Business continuity
The FRE’s business continuity plans must address all reasonably foreseeable situations in which a cloud service provider may be unable to continue to provide services at the required levels. Most importantly, in the context of any business interruption affecting the cloud service provider, the FRE should ensure that it has access to all necessary records to allow it to continue its business operations and meet any statutory obligations or other obligations to OSFI.
4) Data location
A cloud service provider’s infrastructure and software may be dispersed across multiple locations across the globe. This may be problematic for FREs since B-10 requires the contract governing the provision of the cloud services to identify the nature and scope of the services, including specification of the physical location where the services are being provided. While this may be possible at the outset of a cloud computing arrangement, the dynamic nature of cloud computing means that regular updates should be contemplated under the contract in order to address any shift in the location of the information technology infrastructure supporting the services. In addition, contractual provisions to address any deficiencies in legislated privacy protections and issues relating to access rights of foreign governments and their regulatory agencies should be considered.

PIPEDA and Cloud Computing and the US Patriot act? Slaw

Such a contract should include provisions governing the jurisdiction where information will be processed or stored, ownership and use of information, the level of privacy controls used by the service provider, access and correction procedures, audits, and deletion procedures. Lawyers must remember that they remain accountable for information transferred to third-parties for processing.

Stuff you can use – the Ethical Use of Cloud Computing and a Google Tip Sheet — Slaw.

Lengthy exploration of cloud computing topics, plus ? tip sheet?