业务范围 | Contacts | Home

 

---

What is Cloud Computing?
“Cloud computing” is the new buzz word in the ICT industry.  It is estimated that earnings arising from cloud computing will rise to € 6,005 million Euro in 2013 from the 2008 threshold of 971 million Euro¹. On the other hand, it promises to offer companies the possibility to save up to 70% of their IT costs².  But what is the definition of cloud computing?  Given the potential expansion of the services provided “on the cloud”, only a working definition is possible as it is difficult to imagine the depths of its future development: a cloud computing service is “an on-demand service model for IT provision, often based on virtualization and distributed computing technologies”³.  Cloud computing typically has the following features:

• on-demand services immediately available upon requests of the user and paid depending on its use;
• “multi-tenancy”, because a single software runs on a server that serves multiple clients;
• elasticity and flexibility, because the user has easy access to the services provided using web interfaces, which typically do not require specialized IT skills.

Types of Cloud Computing
Cloud computing has been categorized into three different categories:

• Software as a Service (“SaaS”): a software offered by a third party provider via the Internet, available upon request of the user. The software is often standard, except for certain additional features available to the administrator⁴;
• Platform as a Service (“PaaS”): the users access via the Internet a platform offered by the provider in order to develop new applications, such as workflow, database integration, storage or web-service integration⁵;
• Infrastructure as a Service (“IaaS”): the users access through Internet virtual machines and other abstracted hardware, backup services and operating systems, offered by the provider⁶.

Legal Issues connected to Cloud Computing Services
From an Italian legal standpoint, the contract underlying cloud computing services can be defined as an outsourcing agreement.  The only difference between cloud computing and “off line” outsourcing agreements is the media through which the IT services are delivered.
Large providers of cloud computing services, such as Google and Microsoft, use general terms and conditions for their services, to which companies may adhere on line and which tend to be not negotiable.  The following legal issues may arise:

• Applicable Law and Jurisdiction: in most cases the general terms and conditions of service are subject to the laws of the United Kingdom or of a State of the United States, but in any case to a non-Italian set of laws.  Such choice is enforceable if the Italian company adhering to the agreement is a business, but not if it is a consumer.  Similar arguments apply in case of choice of competent forum: while a “B2B” transaction will enjoy complete freedom in this choice, consumers have the right to litigate in their local forum.
• Limitation of Liability: as it often happens in the ICT industry, service providers do not accept to be subject to unlimited liability in case of breach of the terms and conditions of service.  Many legislations, however, provide that contractual provisions of limitation of liability do not apply whenever the provider is deemed to have acted willfully or with gross negligence, and therefore the service provider is in any case accountable in case its standard of care becomes seriously flawed.
• Data Protection: as servers of the cloud computing service providers are typically located outside the European Union, Italian companies which adhere to the service must specifically consent to such transfer, as well as obtain from any interested parties the relating consent.
• Change to the Services: the service provider generally reserves the right to change the form and the nature of the services, without giving the user a chance to challenge its decisions.  Most changes tend to follow technological improvements and are welcome by the user.  However, the user must maintain a flexible approach and be prepared to new formats or features of the service.
• Law Enforcement: since the data “on the cloud” are generally stored abroad, and most times outside the European Union, it has been argued that it can be difficult for the service recipient to obtain protection in case of privacy or criminal violations.  While the EU countries and the USA are generally available to cooperate with Italian authorities, if servers are located in countries with which Italy has less strong ties the law enforcement process may be delayed or hampered.
• Subcontracting Practices: the cloud computing provider typically reserves the right to subcontract the services, in whole or in part, to a third party.  It is in the interest of the recipient of the service that such subcontracting is in favor of a reliable third party, which gives the same security reassurances as the principal service provider.  Contractual provisions regarding subcontracting should therefore be carefully examined.

The Best Protection: Reliability of Provider
It has been argued that the security and reliability of cloud computing services is essentially in the hands of a third party on which the user has no control and very little visibility⁷.  This, however, holds true for all outsourced services.  Prior to entering into a cloud computing agreement, users should carefully check not only the relevant terms and conditions, but also the specific features of the services they are purchasing, compare them with the services they would be able to obtain by using their own hardware and verify how quickly and easily they can change service provider if the expected level of services is not met (this issue is known as “vendor lock-in”).  Large IT companies may reap the benefits of such uncertainties, as their expertise and reputation on the market may help user to take the leap of faith required to rely on services on the cloud.