Latest News

Careful where you tread in the cloud – Print 21 magazine feature

Tuesday, 02 August 2011
By Print21

We hear a lot about living and working ‘in the cloud’ these days, surely one of the most over-used buzzwords of our time (on a par with ‘buzzword’ itself no doubt). But what are the legal implications of putting everything in the ‘cloud’ and is it such a good idea after all? Wal Abramowicz has some thoughts.

When Wal (pictured) was at law school, his fellow students spent many hours rubbing  chins and reflecting on the far-reaching implications of a small slug that, in the early 1930s, accidentally found its way into a bottle of ginger beer (Donoghue v Stevenson). How times change.

These days the way we do business is changing at a rapid clip and the law must keep up. Paperless offices are every­where. Outsourcing has never been so popular. New economies of scale are popping up. Whole new industries are appearing, born fully grown.

One of the more interesting and conceptually challenging of these new industries is ‘cloud computing’. The ‘cloud’ is, in essence, the internet. It is a depository for trillions and trillions of words, images, ideas and status updates that don’t exist anywhere else. Where is all that information? It’s ‘in the cloud’.

There’s a silver lining

Some enterprising organisa­tions have picked up on our desire to put our lives online and are now offering firms the chance to put their business online. Where, in what his nephew would call ‘The Olden Days’, firms would once have stored their data on a bank of servers sitting in their office, or in someone else’s office a few kilometres away, firms are now being offered the chance to have their data hosted in servers ‘in the cloud’.

This frees up office space and reduces a firm’s vulnera­bility to flood and fire. Plus, for firms seeking a presence overseas but who may not have the infrastructure, the entire database of the firm can be available in a hotel room in Berlin just as it is on the screen in your Sydney office.

The economies of scale in this developing industry are considerable. These service providers own thousands and thousands of servers and offer to expand or contract your supply of servers based on your needs. If, for example, the ATO needs 1,500 servers for its regular business, but it needs closer to 15,000 come early November, then this change can be easily and quickly made by the ATO placing an order with its service provider.

Similarly, a start-up company may not know how successful its website will be and may not wish to invest in physical infrastructure. That company can simply start business with one or two servers (at the time of writing Amazon offered the first server free of charge, in the hopes of converting you to cloud computing) and—if everything goes well—instruct their service providers to make more servers available to them.

Whither the cloud?

The servers exist, of course. They themselves are not ‘in the cloud’. But those servers may be in India, or the Ukraine or Australia, America, or any number of other places. Crucially, it is in the service providers’ interest that you don’t know.

They charge a premium to clients who demand that their servers are in a certain country. Flexibility is the key for these service providers. They operate more efficiently when they can decide where to store your data. Putting a leash on them costs money.

Why would you want to put a leash on them anyway? Why not take advantage of the bargains and embrace the new industry? Well, ask your lawyer about that one. Why does it matter where your information is?

Firstly, you must comply with any local laws with respect to your servers. If the business you are conducting via the Ukrainian servers your service provider has provided somehow breaches the laws of Ukraine then you may be liable for that breach, even if you weren’t aware of the relevant law and—crucially—even if you weren’t aware that you were conducting business in the Ukraine.

Secondly, your business may have a number of duties under Australian law that must be complied with. The National Privacy Principles are an example. Those principles dictate that certain businesses can only deal with private information in a certain way. It may be that disclosing this information to a third party (by hosting it on a service provider’s server) is a breach of those obligations.

And just quickly: if you get a chance to review a service provider’s contract, you’ll see the terms are pretty daunting. “We accept no liability for anything even if it was totally our fault” pretty much covers it. (The new Australian Consumer Law may yet have something to say about these contracts.)

What to do? The value for money is undeniable but, as this new day of Web 3.0 dawns, Abramowicz will be advising my clients to think very carefully before deciding to put theirs and their clients’ information ‘in the cloud’.

Wal Abramowicz is a partner with Fox & Staniland Lawyers of Pymble, NSW, practicing in the commercial litigation area with a particular interest in printing. Phone 02 9440 1202. <wal@foxstaniland.com.au>

Comment on this article


To receive notification of comments made to this article, you can also provide your email address below.