Mitigating cloud computing risks

Mitigating cloud computing risks
Kelly Friedman says there are benefits to cloud computing, but you still get what you pay for.
Cloud computing is not without its risks, but it’s up to corporations to do due diligence before they hand over their data, says one lawyer who specializes in electronic discovery.
Cloud computing services provide data storage over the Internet, commonly referred to as being “in the cloud.” Although it does have its benefits, there are risks associated with this increasingly popular phenomenon, such as potential data breaches.

A recent data breach occurred within cloud computing service provider Dropbox, which allows users to transfer their computer files to the company’s Internet servers. One of the company’s users launched a lawsuit in California alleging it didn’t secure users’ private data or notify all of them about the data breach.

The lawsuit claims Dropbox suffered a glitch where logged-in users were able to access other users’ data. It also claims instead of notifying users of the breach, it simply mentioned it in a blog post. The post allegedly said the glitch was fixed five minutes after it was discovered and that only a small group of users was affected.

That kind of response “wouldn’t fly in Canada,” says Kelly Friedman, a partner at Davis LLP and chairwoman of the steering committee at Sedona Canada. That’s because Canada has more stringent privacy rules under the Personal Information Protection and Electronic Documents Act.

Friedman says there are three major risk areas associated with cloud computing: security, privacy, and e-discovery (or the impact on litigation). “All the risks stem from the lack of control over your own data. The reality is you’re giving your data to a third party to control,” she says.

From an e-discovery perspective, Friedman says using cloud computing doesn’t change any of the corporation’s obligations for preservation and production of its data. “The court won’t say that you have relinquished control. The court cares about whether you have possession, custody, or control over information,” she says.

But with cloud computing, you actually do relinquish control by handing over your data to a third party, she adds. This can present certain risks, particularly if a data breach occurs. “The reality is if you don’t maintain legal control through the contract with the service provider, then you’re negligent in terms of best practices and managing your own data. And the court’s not going to excuse you for that.”

She suggests corporations looking to use cloud computing service providers carefully scrutinize the provider in terms of whether it is financially viable, what kind of insurance it carries, and most importantly, the service provider’s standard form contract and then negotiate specific provisions in terms of the provider’s document management obligations. This way, if the corporation needs its data for any reason, it has the contract to fall back on if the provider is unco-operative, she says.

She also mentions it’s worthwhile looking at the type of encryption the provider uses and its level of security, and where it’s storing data since jurisdictions could have different privacy legislation.

Friedman says there are some real benefits to cloud computing, but you get what you pay for. “People like cloud computing because they don’t have to go buy the IT infrastructure or get the software licences, they can just access it, and they can access it at a cheap cost. The reality is if you’re going to start imposing liability on that service provider for these risks that I’m talking about, the price is going to go up.”

She believes cloud computing data breaches stem from providers trying to keep up with quickly evolving technology. “You’re never going to 100-per-cent secure any data against security breaches . . . you have to make sure your service provider is doing the best they can with the money you’re paying,” she says.

Free newsletter

The Canadian Legal Newswire is a FREE newsletter that keeps you up to date on news and analysis about the Canadian legal scene. A separate InHouse Edition is delivered on a regular basis, providing targeted news and information of interest to in-house counsel.

Please enter your email address below to subscribe.

Recent articles & video

Global pandemic causes supply chain problems in construction industry: lawyer

Determination, dedication and drive keep Dale Orlando at the top of his game

Ruling on Snaw-Naw-As case leaves door open for feds to decide on E&N rail line on Vancouver Island

B.C. law society posts annual report with progress updates on 2018-2020 strategic plan

Lawyers, legal scholars elected as fellows of Royal Society of Canada

Roundup of law firm hires, promotions, departures: Sept. 20, 2021 update

Most Read Articles

Canadian Lawyer's Top 25 Most Influential Lawyers winners for 2021 revealed

Human Rights Tribunal of Alberta rules 'no mask, no entry' policies valid even if they discriminate

First Nations chiefs warn against attempt to deter challenge of Quebec’s future Language Act

Canadian Constitution Foundation criticizes vaccine passports of B.C., Manitoba