DRAFT Notes on the Main Issues of Cloud Computing Contracts (prepared by the UNCITRAL secretariat, 2019): Rights to data
Provider rights to customer data for the provision of services
Providers usually reserve the right to access customer data on a “need-to-know” basis. That arrangement would allow access to customer data by the provider’s employees, subcontractors and other third parties (e.g., auditors) where necessary for the provision of the cloud computing services (including maintenance, support and security purposes) and for monitoring compliance with applicable AUP, IP licences, SLA and other contractual documents. The parties may agree on circumstances when the provider’s access to customer data would be allowed and measures that would ensure confidentiality and integrity of customer data.
Certain rights to access customer data can be considered to be implicitly granted by the customer to the provider by requiring a certain service or feature: without those rights, the provider would not be able to perform the services. For example, if the provider is required to regularly back up customer data, the fulfilment of that task necessitates the right to copy the data. Likewise, if subcontractors are to handle customer data, the provider must be able to transfer the data to them.
Provider use of customer data for other purposes
Most jurisdictions do not grant the provider automatic rights to use the customer data for the provider’s own purposes. The provider may request use of customer data for purposes other than those linked to the provision of the cloud computing services under the contract (e.g., for advertising, generating statistics, analytical or predictions reports, engaging in other data mining practice). The questions to consider in that context may include: (a) which information about the customer and its end users will be collected and the reasons for and purposes of its collection and use by the provider; (b) whether that information will be shared with other organizations, companies or individuals and if so, the reasons for doing so and whether this will be done with or without the customer’s consent; and (c) how compliance with confidentiality and security policies will be ensured if the provider shares that information with third parties. Where the provider’s use of customer data will affect personal data, the parties would normally be expected to carefully assess their regulatory compliance obligations under applicable data protection laws.
Provider use of customer name, logo and trademark
The providers’ standard terms may grant the provider the right to use customer names, logos and trademarks for the purposes of the provider’s publicity. The parties may agree on the deletion or modification of such provisions, including limiting the permissible use to the customer’s name and seeking the prior approval of the customer for the use of its name, logo and trademark.
Provider actions as regards customer data upon State orders or for regulatory compliance
The parties may agree, at a minimum, that the customer will be notified without delay of State orders or the provider’s own decisions as regards customer data with a description of the data concerned, unless such notification would violate law. Where the advance notification and involvement of the customer is not possible, the contract may require the provider to serve an immediate ex-post notification to the customer of the same information. The parties may also agree on provisions as regards keeping and providing customer access to and logs of all orders, requests and other activities as regards customer data.
Rights to cloud service-derived data
The parties may agree on customer rights to cloud service-derived data and how such rights can be exercised during the contractual relationship and upon termination of the contract.
Data retrieval for legal purposes
Customers may be required to be able to search and find data placed in the cloud in its original form for legal purposes, for example, in investigations. The electronic records may need to meet auditing and evidentiary standards. Some providers may be in a position to offer customers assistance with the retrieval of data in the format required by law. The contract may define the form and terms of such assistance.
Data deletion
Data deletion considerations may be applicable during the term of the contract, but particularly upon its termination. For example, certain data may need to be deleted according to the customer’s retention plan. Sensitive data may need to be destroyed at a specified time in its lifecycle (e.g., the destruction of hard disks at the end of the life of equipment on which such data was stored). Data may also need to be deleted in order to comply with law enforcement deletion requests or after confirmed IP infringement cases.
Particular standards or techniques for deletion may be specified, depending on the nature and sensitivity of the data. It may be required to delete data from different locations and media, including from subcontractors’ and other third parties’ systems, with different levels of deletion, such as data sanitization ensuring confidentiality of the data until their complete deletion or hardware destruction. More secure deletion involving destruction rather than redeployment of equipment may be more expensive and may not always be possible (if, for example, data of other persons is stored on the same hardware). Those aspects may trigger the inclusion of contractual requirements to use an isolated infrastructure for storing the customer’s particularly sensitive data.