Welcome to the United Nations
Language:
  1. Home
  2. Notes on the Main Issues of Cloud Computing Contracts (prepared by the UNCITRAL secretariat, 2019)

Notes on the Main Issues of Cloud Computing Contracts (prepared by the UNCITRAL secretariat, 2019)

Part two. Drafting a contract

O. Choice of law and choice of forum clauses

Freedom of contract usually allows parties to choose the law that will be applicable to their contract and the jurisdiction or forum where disputes will be considered. The mandatory law (e.g., data protection law) may, however, override the choice of law and the choice of forum clauses made by the contracting parties, depending on the subject of the dispute. In addition, regardless of the choice of law and choice of forum, more than one mandatory law (e.g., data protection law, insolvency law), including from different jurisdictions, may be applicable to the contract.

Considerations involved in choosing the applicable law and forum

The choice of law and choice of forum clauses are interconnected. Whether the selected and agreed-upon law will ultimately apply depends on the forum in which the choice-of-law clause is presented to a court or another adjudicating body, e.g., an arbitral tribunal. It is the law of that forum that will determine whether the clause is valid and whether the forum will respect the choice of applicable law made by the parties. Because of the importance of the forum law for the fate of the choice of law clause, a contract with such a clause usually also includes a choice of forum clause.

In choosing the forum, the parties usually consider the impact of the chosen or otherwise applicable law and the extent to which a judicial decision made in that forum would be recognized and enforceable in the countries where enforcement would likely be sought. Preserving flexibility in enforcement options may be an important consideration, especially in the cloud computing settings where many factors that parties usually take into account in formulating choice of law and choice of forum clauses may be uncertain, including the location of assets involved in the provision of services and the location of the provider and the customer.

Mandatory law and forum

The law and the forum of a particular jurisdiction may be mandatory on various grounds, for example:

(a) The accessibility of the cloud computing services in the territory of a particular State may be sufficient for the application of the data protection law of that State;

(b) The nationality or residence of the affected data subject or the contracting parties, in particular the data controller, may trigger the application of the law of that data subject or the party; and

(c) The law of the place in which the activity originated (the location of the equipment) or to which the activity is directed for the purpose of extracting benefits may trigger the application of the law of that place. The use of a given country
top-level domain associated with a particular place, a local language in the website, pricing in local currency and local contact points are among the factors that might be taken into account in making such determination.

Provider or customer home law and forum

Contracts for standardized commoditized multi-subscriber cloud solutions often specify that they are governed by the law of the provider's principal place of business or place of establishment. They typically grant the courts of that country exclusive jurisdiction over any disputes arising out of the contract. The customer may prefer the law and jurisdiction of its own country. Public institutions would face significant restrictions on their ability to consent to the law and jurisdiction of foreign countries. Providers that operate in multiple jurisdictions may be flexible as regards accepting the choice of the law and forum of the country where the customer is located.

Multiple options

The parties may also specify various choice of law and forum options for different aspects of the contract. They may also opt for a defendant's jurisdiction to eliminate the home forum advantage for a plaintiff and thus encourage informal resolution of disputes.

No choice of law or forum

The parties may prefer no choice of law or forum clause in their contract, leaving the question open for later discussion if and when needed. That might be considered the only viable solution in some cases. ODR may also be part of the solution for the questions of jurisdiction and applicable law. Read more.

Relevant Glossary terms

Data controller: A person that determines the purposes and means of the processing of personal data.

Data subject: A natural person who can be identified, directly or indirectly, by data, including by reference to such identifiers as name, an identification number, location and any factors specific to the physical, genetic, mental, economic, cultural or social identity of the person. In a number of jurisdictions, data subjects enjoy under data protection or data privacy regulations certain rights with respect to the data that can identify them. Those regulations may trigger the inclusion in the service level agreement (SLA) of data protection-specific performance parameters, such as that the services provided under the contract are certified at least annually by an independent auditor against the data protection/privacy standard identified in the contract. (See also data subject's rights and personal data)

Data subjects' rights: Rights associated with data subjects' personal data. Data subjects under law may enjoy the right to be informed about all significant facts related to their personal data, including data location, use by third parties and data leaks or other data breaches. They may also have the right to access their personal data at any time, the right to erasure of their personal data (pursuant to the right to be forgotten), the right to restrict processing of their personal data and the right to portability of their personal data.

Personal data: Sensitive and non-sensitive data that can be used to identify the natural person to whom such data relate. The definition of personal data in some jurisdictions may encompass any data or information directly or indirectly linked or relating to an identified or identifiable individual (see the data subject).

Service level agreement (SLA): Part of the cloud computing contract between the provider and the customer that identifies the cloud computing services covered by the contract and the level of service expected or to be achieved under the contract (see the performance parameters).

Standardized commoditized multi-subscriber cloud solutions: Cloud computing services provided to an unlimited number of customers as a mass product or commodity on non-negotiable standard terms of the provider. Broad disclaimers and waivers of the provider's liability are common in this type of solution. The customer may be in a position to compare different providers and their contracts and select among those available on the market the most suitable for its needs, but not to negotiate a contract.