IT Law in Relation to Cloud Computing PDF

IT Law in relation to Cloud Computing Polo Matteo 905645, Pulido Gaia 905017, Quintanilla Vela Yakjtsiel 906579, Rosada Gianmarco 904489, Rusu Lina 906623, Ruzza Leonardo Victor 905552,...

IT Law in relation to Cloud Computing Polo Matteo 905645, Pulido Gaia 905017, Quintanilla Vela Yakjtsiel 906579, Rosada Gianmarco 904489, Rusu Lina 906623, Ruzza Leonardo Victor 905552, Sabani Ema 904506, Sajjad Junaid 906620, Saltarelli Francesco 904275. H-Farm, November 2024 Abstract The development of cloud computing has significantly changed the storage and processing of data, creating new opportunities as well as challenges. This paper evaluates the issues of law and ethics of cloud computing addressing different aspects like the regulatory gap between GDPR in the EU and the US laws, protection of intellectual property, and liability under contractual service agreements. Other ethical issues are also discussed including privacy, access of data by the government, and visibility of practices. The analysis emphasizes the need for stable legal structures and comprehensible contracts to resolve the issues of user rights, trust to cloud services and innovation. 1 Contents 1 Introduction 3 1.1 What is Cloud Computing?................... 3 1.2 Benefits and possibilities of Cloud Computing......... 4 2 Cloud Computing Regulatory Framework 4 2.1 Difference between European Union and United States.... 5 2.1.1 Europe........................... 5 2.1.2 United States....................... 5 2.1.3 Legal challenges...................... 5 3 The problem of intellectual property 6 3.1 Security concern and best practices............... 6 3.1.1 ISO/IEC 27001...................... 6 3.1.2 International IP law................... 6 3.1.3 Termination clauses.................... 7 4 Legal and contractual responsibility 7 4.1 Liability in Cloud Contracts................... 7 4.2 Key Legal Risks in Cloud Agreements.............. 7 4.3 Addressing Dispute Resolution and Non-performance Matters 7 4.4 Adapting to New Regulations.................. 8 5 Ethic concerns 8 5.1 Government access to data.................... 8 6 Conclusion 9 2 1 Introduction The entirety of our lives is governed by laws and legislative frameworks. The global landscape is undergoing a profound transition towards an increasingly digitalized dimension. This evolution is giving rise to novel challenges, ne- cessitating the development of robust legislative measures to address them effectively. The creation of a law is a response to a conflict. One of the emerging issues in this regard is the advent of Cloud Computing and the formulation of a regulatory framework to safeguard the interests of citizens. 1.1 What is Cloud Computing? It is at the base of a lot of tools and applications that we use quotidian in our smartphones and our PCs. Cloud computing is a particular IT model that manages the archiving of data and computing power. The applications of this technology are numerous and diverse, extending from the medical to the educational as well as economic and financial. However, there are numerous services that are utilized on a regular basis by the ma- jority of people, including Google Docs, Instagram, iCloud and, in general, all the websites that are currently available online. From the definition, we can ascertain that these services have the capacity for data archiving and computing power. However, what precisely does this mean? Electronic computers are capable of running programs and storing data, yet their capacity is sometimes constrained from fully supporting the processing of large data sets and the execution of complex computations. This issue is addressed by cloud computing, whereby a client (which may be a smartphone or PC) receives the information that has already been executed, and a ’cloud computing’ system is responsible both for processing and for storing it. To take the example of social media, when we are scrolling through the main page, the content that the social media platform proposes to us is not downloaded to our device, as the device has limited memory and the algorithm is not processed using our CPU. ’cloud computing’ is the one who is taking care of everything. Cloud computing is a general term that encompasses a variety of related concepts. It can be defined as an infrastructure made up of computers, block storage, and networks. It can also be defined as a platform from a remote graphical interface for programmers and applications that end users will physically use. Wikipedia contributors (2024) 3 1.2 Benefits and possibilities of Cloud Computing In addition to the availability of storage and the great computational power, other advantages can be identified which have contributed to the success of this technology, making it the most widely used and advanced compared to its predecessors. These include the possibility of expansion according to the flow of users, the avoidance of initial physical investments, the elimination of global accessibility problems and the provision of a dedicated interface for programmers. Prior to the widespread adoption of cloud computing, websites were already in existence. However, the storage and execution of these websites was not conducted locally, but rather from a single proprietary computer (or server) connected to the network. This approach, while offering convenience, also presented several inherent disadvantages, including high costs, limited scalability, restricted memory and power. These challenges have been effectively addressed by cloud computing. In the current era, the solutions provided to enterprises are straightfor- ward and tailored to their specific requirements. There is the public cloud, which is accessible via the Internet, and the private cloud, which is accessible only within an organization. Alternatively, hybrid systems may be employed, combining elements of both public and private clouds. Google Cloud (2024) Furthermore, a company may select the infrastructure, platform, or soft- ware that aligns with the specific requirements of its operational needs. There are various types of cloud computing, including IaaS (Infrastructure as a Ser- vice), in which a company provides infrastructure such as servers, storage, and networking on demand; and PaaS (Platform as a Service), which offers a platform for developing and managing applications, with the infrastruc- ture managed by the provider. Finally, Software as a Service (SaaS) enables the utilization of ready-to-use applications, accessible via a browser or mo- bile application. While cloud computing has introduced numerous technical advancements, it has also given rise to a number of legal implications, par- ticularly with regard to data storage. Google Cloud (2024) 2 Cloud Computing Regulatory Framework Cloud computing regulations vary according to the jurisdiction of the country where the data is located. 4 2.1 Difference between European Union and United States 2.1.1 Europe The European Union has enacted the General Data Protection Regulation (GDPR) with detailed instructions regarding the processing, storage and protection of personal data. Cloud service organizations must take a series of technical and organizational measures to prevent access, loss or modification of data without the organization’s consent. One of the requirements provided by GDPR is relating to transfer of personal data outside a territory covered by that Regulation, namely European Economic Area (EEA). Regulation allows such transfers only if recipient country ensures as appropriate level of data protection or there are relevant vows taken (typically Standard Contractual Clauses or Binding Corporate Rules) guaranteeing this. Board (2023) 2.1.2 United States In contrast, you will not find a single all-encompassing national data protec- tion regulation like the GDPR in the US. Instead, data privacy regulation is sectoral, so specific laws like the Health Insurance Portability and Account- ability Act (HIPAA) focus on the protection of health information, while the Children’s Online Privacy Protection Act (COPPA) addresses the collection of personal information from children under age 13. Equally significant is the US CLOUD Act (Clarifying Lawful Overseas Use of Data), which enables American authorities to access data, however stored by American companies even abroad but contrary to the spirit of GDPR. of Justice (2020) 2.1.3 Legal challenges This differences creates challenges for companies in both jurisdictions. For example, the transfer of personal data between the EU and the US has been complicated by the invalidation of the Privacy Shield framework in 2020, necessitating alternative mechanisms like the newly proposed EU-US Data Privacy Framework to ensure compliance. Commission (2023) Ultimately, organizations need to investigate the regulatory demand of both regions and set up guardrails like data localization, encryption, and solid access controls. Moreover, businesses are advised to seek legal advice on how best to comply with these complex regulatory frameworks. 5 3 The problem of intellectual property Cloud computing poses major challenges to the management of Intellectual Property (IP). One area where it is particularly important to carefully safe- guard IP rights and avoid a dispute with the cloud provider or other third parties is when companies utilize cloud services. Cloud computing raises several concerns, one of which is the ownership of data and applications in cloud environment. It is essential that contracts specify the ownership of data, software and course works. The customer usually owns its data and providers grant limited rights of access to the service only. If ownership terms are not expressed clearly, disputes can easily arise over enhancements or analytics based on customer data. Bank (2020) 3.1 Security concern and best practices 3.1.1 ISO/IEC 27001 Another well-founded concern consists in security of trade secrets and pro- prietary data. Companies must make sure that it has solid safeguards against unautho- rized access or IP theft (especially associated with an algorithm, design or business process). Compliance with international cybersecurity standards, such as ISO/IEC 27001, can reduce these risks by ensuring the right handling of sensitive information. ISO (2023) 3.1.2 International IP law IP protection is also stymied by jurisdictional problems. While cloud services are by nature global, the IP laws of many nations vary considerably. The United States, for instance, maintains relatively strong IP protections with laws such as the Copyright Act and Defend Trade Secrets Act that create remedies against infringement. For companies that do business in areas with poor enforcement of the law affecting protection of IP, the risk is amplified. Select the Cloud Providers Having Expertise in International IP Laws and Include Clear Dispute Resolution Clauses in Contracts. Patent & Office (2021) 6 3.1.3 Termination clauses Termination clauses should be mentioned in contracts finally. Agreements have to stipulate to the return or safe deletion of customer data and propri- etary materials at the end of a service term, with no retention by the provider. Properly structured contracts safeguard IP while ensuring compliance with applicable laws. 4 Legal and contractual responsibility 4.1 Liability in Cloud Contracts Cloud computing contracts often have to determine the sharing of liability between the provider, CSP, and the client. Cloud service providers try to reduce their risk by capping their liability as much as possible, whereas clients usually wish for more comprehensive guarantees. An important element is the indemnification clause explaining the responsibilities in cases such as data breach or service outage. The clients must carefully review these clauses to avoid any gap in the coverage, especially on international services where legal interpretation may vary. 4.2 Key Legal Risks in Cloud Agreements The most significant legal risks in cloud contracts arise from ambiguous terms or unexpected events. For example, because the Cloud services are still largely in a state of evolution, an incongruity is created between what is promised and what is actually provided. Clients may ask for certain trans- parency in changes in contract and any renegotiation to make sure updates accommodate their business needs. 4.3 Addressing Dispute Resolution and Non-performance Matters Disagreements may arise because of ambiguities in the contract or due to low service expectations from the client. There should, therefore, be clear conflict resolution methods in the contract, such as multi-tiered escalation procedures. The contract enforcement may not be easy, especially when it involves border crossing. It is of essence to ensure that the terms of the 7 contract are consistent with the various legal jurisdictions where the regions involved operate, hence avoiding the risks of rendering the disputes null and void. 4.4 Adapting to New Regulations Cloud contracts shall cover fast-evolving legislation, such as the widely adopted and stricter data protection regulations, and new cybersecurity standards. While it is common that contracts refer to compliance with currently valid laws-like the GDPR-they should also provide room for modification if future legislation changes occur. This would allow contracts to stay relevant and continue to be legally effective when regulations change. 5 Ethic concerns In cloud computing, ethics is an extremely important topic. cloud computing companies hold a huge amount of data, even sensitive data. it is therefore necessary to create laws that balance the users’ right to privacy with national security. 5.1 Government access to data Privacy and security: the possibility of government agencies access- ing data in the cloud raises quite a few ethical issues regarding user privacy. authorities must be able to request data for national security matters or criminal investigations, but this could pose risks and privacy concerns. Transparency: it is essential that cloud operators are transparent with their policies regarding government access to their services. oth- erwise, they may lose the trust that customers have in them. Responsibility: Companies must establish clear internal policies on how to handle government requests for data access, ensuring that such requests are legitimate and proportionate. 8 6 Conclusion In sum, cloud computing offers different benefits but also poses legal chal- lenges, above all in data protection, intellectual property, and also liability. Compliance with the GDPR and other regulations and standards of secu- rity are fundamentals to balance technological progress with user rights and ethical practices. 9 References Bank, W. (2020), ‘Intellectual property and data in cloud computing: Key considerations for enterprises’, Available at: https://worldbank.org. Board, E. D. P. (2023), ‘Guidelines on personal data transfers’, Available at: https://edpb.europa.eu. Commission, E. (2023), ‘Eu-us data privacy framework’, Available at: https://ec.europa.eu. Google Cloud (2024), ‘Types of Cloud Computing’, Available at: https: //cloud.google.com/discover/types-of-cloud-computing. ISO (2023), ‘Iso/iec 27001 information security management’, Available at: https://iso.org. of Justice, D. (2020), ‘The cloud act’, Available at: https://justice.gov. Patent, U. S. & Office, T. (2021), ‘Intellectual property protections in the digital era’, Available at: https://uspto.gov. Wikipedia contributors (2024), ‘Cloud computing’, Wikipedia. Available at: https://it.wikipedia.org/wiki/Cloudc omputing. 10