Cloud services ‘pose legal risks’

Cloud computing services’ spotty record on service availability and data protection could pose legal problems for UK-based businesses, a City law firm warned on Monday.

The remarks from Reynolds Porter Chamberlain LLP (RPC) came as Google acknowledged that its Gmail service had been hit by an outage on Tuesday morning, disrupting service for “many” users.

The cloud refers to services operated by a third party and accessed over the internet. Companies such as Google, Amazon and Salesforce.com have been in the forefront of promoting the concept, which can allow businesses to cut costs related to buying and maintaining server infrastructure.

But service levels remain unclear with many cloud services, and this may be exposing companies to legal risks, RPC warned.

“A company choosing to outsource their data storage risks claims being made against them by their customers if data held by the host server become unavailable during an interruption or outage,” said RPC partner Alex Hamer in a statement.

He said cloud service providers’ terms of service frequently include exclusions of liability for damages resulting from data loss, and usually provide no warranties against bugs, defects or errors.

Hamer noted that under the Data Protection Act businesses who outsource data storage must ensure there are sufficient security measures in place that will protect it from accidental loss and damage.

“As most cloud computing service providers will not guarantee the security of the data they store this may put cloud computing users in breach of their requirements under the DPA to ensure an appropriate level of security,” Hamer stated.

He said that the Information Commissioner has recently been given stronger powers to enforce the DPA.

These potential legal problems come on top of potential technical issues, which have also been overlooked by many cloud services users, according to Ovum analyst David Mitchell.

“For enterprises, buying cloud services should become more akin to purchasing IT services than to acquiring software products,” said Mitchell in a research note on Tuesday. “At present too many treat the acquisition of cloud services as though they are acquiring disposable commodities.”