Cloud Computing and Law Toolkit

The JISC Legal Information Service have published a toolkit on the legal issues that should be considered by universities and colleges when planning to use external cloud computing providers, including Data Security, Jurisdiction, Confidentiality, Freedom of Information, Intellectual Property Rights, Equality and Accessibility, and Contracts. The organisation's legal duties are unlikely to change significantly as a result of adopting a cloud approach, but the measures it needs to take to ensure compliance with those duties may be very different. The toolkit comprises an Introduction, further papers dealing with specific issues for IT, Senior Management, Users and a paper on Cloud Contracts. The papers provide comprehensive and accessible coverage of the issues, with helpful Key Points for organisations to include in their planning and links to sources of more legal detail.

The toolkit notes that many of the legal issues are similar to those for any other outsourcing activity, while also commenting that clouds' extensive use of standard contracts and international provision of services challenge some of the law's current assumptions about how compliance can be ensured. Data protection principles on security and international transfers (principles 7 and 8 of the Data Protection Act 1998) are highlighted as particular areas where current law and cloud arrangements may not fit comfortably and where adaption of both may be required. Until this occurs, and until there is case law on issues such as jurisdiction, cloud services will inevitably involve some legal uncertainty.

Even in the present state of law and clouds, however, the toolkit considers that "there are no legal issues which constitute an outright bar to the adoption of a cloud computing solution". It expects future developments in both the law and cloud provision, particularly the adoption of standards, to make the requirements clearer for both cloud providers and users and to make it easier to decide which applications are, and which are not, suitable for implementation on particular cloud systems.