Thursday, November 5, 2009

Does cloud computing need malpractice safeguards?

An interesting question raised by James Urquhart's blog on CNET. Urquhart argues there must either be some kind of government regulation of minimum standards for cloud provision, or that customers should be able to bring forward "cloud malpractice" suits.

I respond with a simple question of my own:

"Can we start by enforcing the myriad of regulations we already have before we start thinking of new ones?"

The fact is that many of the existing regulations already apply to clouds. For example, information security on government clouds is still subject to the Federal Information Security Management Act (FISMA), although a few enhancements are being discussed to make the act more amenable (i.e. less bureaucratic) for clouds. Similarly, all of the data privacy (national and transborder) laws still apply to a cloud environment. Thus, IMHO, most of the legal issues surrounding clouds may already be addressed within the context of the existing legal framework reinforced by contractually enforceable SLAs. An evolving body of "case law" may also help address some of the "grey" issues that arise as cloud use becomes more pervasive.

At the same time, I don't think we can completely rule out the possibility of a few new and very cloud-specific regulations, especially if they help alleviate public concern and increase speed of adoption.

2 comments:

  1. As an attorney, I am sympathetic to your argument. Generally, the law adapts well (although late) to changes in technology. However, a great deal of law is still based, to some extent, on regulating within geographical boundaries. The problem with cloud computing is that the server can be anywhere. This raises some pretty difficult issues. In addition, one of the big problems is that the large cloud providers, so far at least, and based on a review of Google and Salesforce.com terms and conditions posted on the web, try to disclaim any real responsibility for protecting data. This raises profound issues for any user thinking of storing data in the cloud. The cloud providers need to get out in front of these issues, because it is a fundamental objection to the technology.

    ReplyDelete
  2. John, thank you. I appreciate your taking the time to read and respond to my post. Your comments are valid and as an attorney you most definitely have an insight that I don't.

    ReplyDelete