Scoping the risk of cloud computing

Data protection

The Information Commissioner’s Office (ICO) gave some advice on putting data into the cloud in its 2010 Personal Information Online Code of Practice. The code reminds those responsible for personal data that the primary responsibility when data is passed into the cloud remains with them and not any cloud provider. It also includes a
useful checklist.

As a general rule from a regulatory point of view it is best for personal data to stay in the European Economic Area (EEA). Moving data from one country to another could result in data protection and data security concerns. It could also be a submission to the laws of that country if the data is not simply in transit. In the UK for example under s.5 of the Data Protection Act 1998 (DPA) if a data controller is not established in the EEA but uses equipment in the United Kingdom for processing the data other than “for the purposes of transit through the United Kingdom” they will be subject to UK data protection legislation. Similar provisions exist in other countries which could be a problem for a law firm, especially in a country where the laws
on legal professional privilege are different.

Any cloud arrangement will also need to take into account the provisions of the proposed new EU regulation, which could be law in a little over three months and bring in heightened penalties for breach of data protection rules.

Silver linings

The SRA’s report in November ‘Silver Linings: cloud computing, law firms and risk’ outlines some of the compliance and legal issues law firms will face when seeking to adopt a cloud computing solution. The report reminds solicitors that they are obliged to keep client information confidential but says that that duty of confidentiality is not an absolute prohibition on using cloud computing services.

One area which could cause practical difficulties however is the SRA reminding lawyers that any cloud provider must agree to the SRA having an independent right to inspect client data in order to comply with the SRA Code of Conduct. In practice many cloud providers will resist any alteration to their standard terms and (needless to say) the right for the SRA to inspect servers and data is not standard for all businesses.

The report also touches on some of the matters in the ICO’s code, including the need for appropriate written guarantees from a provider and the need to conduct due diligence to ensure that the provider “can meet the requirements of legal business before they make a final commitment”.

Additionally the report touches on the recent PRISM scandal saying that solicitors should have particular regard
to the dangers of using US
cloud providers given recent surveillance issues which may compromise client confidentiality. The report also raises the question of client consent.