Contracts for clouds: Comparison and analysis of the terms and conditions of cloud computing services

International Journal of Law and Information Technology

Volumn 19, Issue 3, 2011, Pages 187-223

  Bradshaw, Simon ^a   Millard, Christopher ^a   Walden, Ian ^a  

^a QUEEN MARY UNIVERSITY OF LONDON   (United Kingdom)

Author keywords

Cloud computing; Contracts; Data protection; Information technology; Outsourcing; Service level agreements; Terms and conditions; Terms of service

Indexed keywords

EID: 80051775861     PISSN: 09670769     EISSN: 14643693     Source Type: Journal    
DOI: 10.1093/ijlit/ear005     Document Type: Article

References (163)

1. At the 2009 Cloud Computing World Europe conference Kerny Ustrup of Moller-Maersk noted that Microsoft had agreed to tailored T&C for a contract to supply Cloud-based email services
2. As will be seen, particularly in areas such as the extent to which a provider disclaims responsibility for failure of a Cloud service, the approach of a provider may reflect the extent to which it has a corporate culture of building long-term trust relationships with its customers
3. E.g., Lewis, 'Information Technology Outsourcing and Services Arrangements', in Reed and Angel (eds.) Computer Law (OUP: Oxford 2007).
4. Also Angel (ed), Technology Outsourcing (Law Society: London 2003)
5. Treacy, 'Learning to Trust Cloud Computing' (2009) 20(2) Computers and Law
6. 'The Future of Cloud Computing: Opportunities for European Cloud Computing beyond 2010', http://cordis.europa.eu/fp7/ict/ssai/docs/cloud-report-final.pdf.
7. 'Experts Define Cloud Computing: Can we get a Little Definition in our definitions?' http://blogs.gartner.com/daryl_plummer/2009/01/27/experts-define-cloud-computing-can-we-get-a-little-definition-in-our-definitions/.
8. We make a distinction between processing and storage here in terms of the customer's perception of the form of computing service that is being purchases. However, it should be noted that for legal purposes, in particular in respect of data protection, all action upon data, be it storage and retrieval or transformation and analysis, is 'processing' within the meaning of the Data Protection Directive and associated national legislation.
9. See, for example, Carr, The Big Switch: Rewiring the World, from Edison to Google (Norton: New York 2008)
10. The term 'utility' raises potential regulatory issues that are beyond the scope of this paper
11. At 2009 Cloud Computing World Europe, Hakeeret Singh, Head of Data Centre Optimisation for Thomson Reuters, identified four approaches to improving data centre efficiency via Cloud computing. As well as avoiding traditional cooling by building data centres in areas with natural cooling available, and by moving processor load to zones where cooling is cheap ('following the moon') the flexible architecture of Cloud computing allows for hardware redundancy to be reduced. This allows for the resource footprint of data centres both to be reduced and to be scaled alongside the processing demands placed on them.
12. One practical implication of legal concerns over hosting of data in foreign jurisdictions is that it may encourage providers and customers into agreements by which data is hosted locally; this 'Balkanization of the Cloud' could undermine some of the perceived economic and environmental benefits of Cloud computing by reducing the extent to which data storage and processing could be flexed internationally
13. The Cloud Computing Use Case Discussion Group of the Open Cloud Manifesto has proposed a detailed taxonomy of Cloud computing services as part of an ongoing study of scenarios for analysing Cloud computing services: "Cloud Computing Use Cases White Paper, Version 4.0", http://opencloudmanifesto.org/Cloud_Computing_Use_Cases_Whitepaper-4_0.pdf.
14. As will be discussed later in this paper, this may be an onerous task, especially if the provider does not flag up changes to the T&C documents or indicate the date of last change or review
15. Service description at http://basecamphq.com/index2.
16. T&C at http://basecamphq.com/terms. Date last accessed: July 2010.
17. Service description at http://www.3tera.com/AppLogic/.
18. T&C at http://www.3tera.com/Terms/index.php. Date last accessed: July 2010.
19. Service description at http://www.adrive.com/.
20. T&C at http://www.adrive.com/terms. Date last accessed: July 2010.
21. Service description at http://www.akamai.com/html/solutions/index.html.
22. T&C at http://www.akamai.com/dl/akamai/Akamai_Terms_Conditions_2009.pdf and http://www.akamai.com/html/policies/index.html. Date last accessed: July 2010.
23. Service description at http://aws.amazon.com/.
24. T&C at http://aws.amazon.com/terms/. Date last accessed: July 2010.
25. Service description at http://www.apple.com/uk/iwork/iwork-dot-com/.
26. T&C at http://www.apple.com/legal/iworkcom/en/terms.html and http://www.apple.com/legal/privacy/. Date last accessed: July 2010.
27. Service description at http://www.apple.com/uk/mobileme/.
28. T&C at http://www.apple.com/legal/mobileme/en/terms.html and http://www.apple.com/legal/privacy/. Date last accessed: July 2010.
29. Service description at http://mozy.com/products.
30. T&C at http://mozy.com/terms. Date last accessed: July 2010.
31. Service description at https://www.dropbox.com/features.
32. T&C at https://www.dropbox.com/terms. Date last accessed: July 2010.
33. Service description at http://www.elastichosts.com/.
34. T&C at http://www.elastichosts.com/cloud-hosting/terms-of-service. Date last accessed: July 2010.
35. Service description at http://www.facebook.com/help/.
36. T&C at http://www.facebook.com/terms.php and http://www.facebook.com/policy.php. Date last accessed: July 2010.
37. Service description at http://www.flexiant.com/.
38. T&C at http://www.flexiant.com/products/flexiscale/terms/. Date last accessed: July 2010.
39. Service description (archived) at http://web.archive.org/web/20080616200715/http://www.g.ho.st/.
40. T&C (archived) at http://web.archive.org/web/20080511011825/www.g.ho.st/TermsOfService.html. Date last accessed: July 2010.
41. Service description at http://www.gogrid.com/cloud-hosting/.
42. T&C at http://www.gogrid.com/legal/terms-service.php. Date last accessed: July 2010.
43. Service description at http://www.google.com/apps/intl/en-GB/business/index.html.
44. T&C at http://www.google.com/apps/intl/en-GB/terms/premier_terms_ie.html. Date last accessed: July 2010.
45. Service description at http://www.google.com/google-d-s/intl/en/tour1.html.
46. T&C at http://www.google.com/accounts/TOS. Date last accessed: July 2010.
47. Service description at http://www.ibm.com/ibm/cloud/smart_business/.
48. T&C at https://www-180.ibm.com/cloud/enterprise/beta/static/Z125-8338-01-30Sept09CloudServicesAgreementInternational.pdf. Date last accessed: July 2010.
49. Service description at http://www.ironmountain.com/digital/server/.
50. T&C at http://ironmountain.com/legal/livevaultc.asp. Date last accessed: July 2010.
51. Service description at http://www.joyent.com/services/.
52. T&C at http://www.joyent.com/about/policies/terms-of-service/. Date last accessed: July 2010.
53. Service description at http://www.microsoft.com/net/overview.aspx.
54. T&C not available online. Date last accessed: July 2010.
55. Service description at https://www.mesh.com/Welcome/overview/overview.aspx.
56. T&C at http://explore.live.com/microsoft-service-agreement?mkt=en-GB. Date last accessed: July 2010.
57. Service description at http://www.microsoft.com/windowsazure/sqlazure/.
58. T&C not available online. Date last accessed: July 2010.
59. Service description at http://www.nirvanix.com/products-services/storage-delivery-network/index.aspx.
60. T&C at http://www.nirvanix.com/how-to-buy/terms.aspx. Date last accessed: July 2010.
61. Service description at https://www.paypal-business.co.uk/.
62. T&C at https://cms.paypal.com/cms_content/GB/en_GB/files/ua/ua.pdf. Date last accessed: July 2010.
63. Service description at http://www.rackspace.co.uk/cloud-hosting/.
64. T&C at http://www.rackspace.co.uk/rackspace-home/legal/general-terms/. Date last accessed: July 2010.
65. Service description at https://www.salesforce.com/crm/products.jsp.
66. T&C at https://www.salesforce.com/company/msa.jsp. Date last accessed: July 2010.
67. Service description at http://www.symantec.com/en/uk/norton/online-backup.
68. T&C at http://www.symantec.com/content/en/us/about/media/NOBU_TOS_21_USE.pdf. Date last accessed: July 2010.
69. Service description at https://www.theplanet.com/servers/beta.aspx.
70. T&C at http://contenttheplanet.com/Documents/legal/Planet-TOS.pdf. Date last accessed: July 2010.
71. Service description at http://www.ukfast.co.uk/cloudhosts.html.
72. T&C at http://www.ukfast.co.uk/terms.html. Date last accessed: July 2010.
73. Service description at http://www.zumodrive.com/tour.
74. T&C at http://www.zumodrive.com/tos. Date last accessed: July 2010.
75. Service description at http://www.zoho.com/index.html.
76. T&C at http://www.zoho.com/terms.html. Date last accessed: July 2010.
77. For example, the ToS for ThePlanet states the following: "These Terms of Service hereby incorporate by reference the SLA, The Planet's Acceptable Usage Policy (as in effect from time to time as set forth on The Planet's website, the "AUP") and the Order Form each of which is made a part of these Terms of Service and collectively referred to herein as the "Agreement." Customer's use of The Planet's website, The Planet Network, and the Products and Services is also subject to Customer's acceptance and compliance with these Terms of Service, the AUP, the SLA and the Order Form. Capitalized terms used herein without being defined herein shall have the meaning ascribed to such capitalized term in the SLA or AUP, as applicable." (See note 44.) Date last accessed: July 2010.
78. See sections 4.2 (Choice of Law) and 4.17 (Limit of Liability) for examples.
79. See further section 4.12.
80. As explained in the introduction, this paper concentrates on standard-form contracts for Cloud computing services
81. See note 21
82. Indeed, under some models of contract formation it may be questionable whether an enforceable contract exists between the provider and customer. Under English law, for example, the customer may be held not to have provided any consideration, although it could be held that the customer has acted to his or her detriment in some other manner (for example, permitting commercial use to be made of personal data, or agreeing to abide by terms such as exclusion clauses) that forms valid consideration. However, even if the agreement between the provider and customer does not form a valid contract, it may well comprise a conditional licence by which the provider offers a free service in return for the customer abiding by the provider's terms. As such, for the purposes of this analysis it will be assumed that the T&C for the service are valid and enforceable to the extent local law permits, be it under contract or (for the provider) as the terms of a conditional licence.
83. Dropbox Terms of Service, 'Termination' (See note 25.).
84. It should not be assumed that Small and Medium Enterprises (SMEs) are devoid of protection from unfair terms. In Kingsway Hall Hotel v Red Sky IT (Houslow) [2010] EWHC 965 (TCC) HHJ Toulmin held that elements of an IT services contract between a non-specialist business customer and a specialist provider contracting on its standard terms could, despite it being a business-to-business agreement, be held to be unfair and unenforceable. Although this case did not involve a Cloud service contract the terms in question were typical of those found when surveying the T&C of Cloud providers.
85. In such cases a European court would apply the 'Rome I' Regulations to determine the applicable law (Regulation (EC) 593/2008 on the law applicable to contractual obligations, OJ L177/6, 4.7.2008). For a consumer customer, Art. 6 of these Regulations would generally apply the law of the consumer's domicile.
86. Similar considerations as to enforceability, especially against individual consumer customers, apply as for choice of law, including the points made at note 55
87. ADrive Terms of Service, B.24 (See note 19.).
88. See sub-paragraph (q) of the Annex to Council Directive 93/13/EEC of 5 April 1993 on Unfair Terms in Consumer Contracts
89. For example, terms seeking to impose compulsory arbitration against consumer customers within the UK are highlighted as being potentially unfair under the UTCC Directive (see note 59 above). While in the US, such clauses have been held to be valid, see Hill v. Gateway 2000, Inc., 105 F.3d 1147 (7th Cir. 1997).
90. The English courts have recently held the extent to which hosts have sought to control the illicit behaviour of users to be very relevant in determining their liability for such misconduct. In L'Oréal SA v eBay International AG [2009] R.P.C. 21 eBay escaped joint liability for trade mark infringements because of its proactive efforts to restrain such behaviour by users; by contrast, in Twentieth Century Fox Film Corp v Newzbin Ltd [2010] E.C.C. 13 Newzbin was held liable for copyright infringement owing to its failure to prevent (and indeed its tacit encouragement of) illicit file-sharing by its users. (Massey, 'Case Comment: Twentieth Century Fox Film Corporation v Newzbin Ltd' 2010 C.T.L.R. 16(6), 164-166.).
91. Zoho Terms of Service, 'Spamming and Illegal Activities' (See note 47.).
92. It should be noted though that this survey is of providers in the US and European markets, where there is likely to be a more or less common 'western' set of cultural and legal assumptions about what constitutes 'acceptable' behaviour
93. I.e. countries subject to embargoes and economic sanctions imposed by US law and enforced by the US Office of Foreign Assets Control.
94. P Thibodeau, 'With WikiLeaks, Amazon shows its power over customers', Computerworld 2 December 2010
95. J Vijayan, 'Amazon.com appears to repel Anonymous DDoS attack', TechWorld, 10 December 2010, available via http://news.techworld.com/security/3252813/amazoncom-appears-to-repel-anonymous-ddos-attack/.
96. AWS Customer Agreement, 7.2 (See note 21.).
97. An alternative, and perhaps more charitable interpretation, is that such terms encourage customers not to rely on what may prove to be a single point of failure
98. Mobile Me Terms of Service, 10 'Effects of Termination' (See note 23.).
99. See note 94 for a reference to a discussion of bailment in the context of data stored by a Cloud provider
100. E.g., UK Computer Misuse Act 1990, s. 3.
101. Zoho Terms of Service, 'Inactive User Accounts Policy' (see note 47.).
102. 3Tera Applogic Terms of Service, 7 'Cancellation' (see note 18)
103. See, for example, 'Have you resold your data to crooks?', Computerworld 16 February 2007, http://www.computerworld.com/s/article/9011459/Have_you_resold_your_data_to_crooks_.
104. Not all those surveyed do: one provider, Zecter, is silent on the issue of third-party disclosure
105. "The Receiving Party may disclose Confidential Information of the Disclosing Party if it is compelled by law to do so, provided the Receiving Party gives the Disclosing Party prior notice of such compelled disclosure (to the extent legally permitted) and reasonable assistance, at the Disclosing Party's cost, if the Disclosing Party wishes to contest the disclosure." (See note 42.).
106. Facebook Privacy Policy, 6 'How We Share Information' (see note 27.).
107. ADrive Privacy Policy, (q) 'No Warranties' (see note 19.).
108. IBM Public Cloud Agreement, 5.2 'Content Responsibilities' (see note 33.) For further discussion of issues surrounding the duty of confidence a Cloud computing provider may have in respect of data it hosts, see the reference at note 94.
109. Edwards and Brown, 'Data Control and Social Networking: Irreconcilable Ideas?' in Matwyshyn (ed) Harboring Data: Information Security, Law, and the Corporation (Stanford: Palo Alto 2009); available online at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1148732.
110. http://www.flickr.com/help/contacts/; http://www.flickr.com/help/groups/; http://www.flickr.com/help/blogging/.
111. Hicks, 'Through the Privacy Wall' (2010) 98 European Lawyer 51
112. Before being revised in May 2010, Facebook's Privacy Policy was, at 5,830 words, noted as being longer than the US Constitution (" Facebook mulls U-turn on Privacy", http://www.bbc.co.uk/news/10125260).
113. Mowbray, 'The Fog over the Grimpen Mire: Cloud Computing and the Law' (2009) 6:1 SCRIPTed 129, http://www.law.ed.ac.uk/ahrc/script-ed/vol6-1/mowbray.asp.
114. Nauwelaerts and Le Bousse, 'Cloud Bursting' (2009) 20(4) Computing & Law
115. Directive 95/46/EC (OJ L 281/31, 23.11.1995), at art. 25 and 26.
116. Sachevda, 'International jurisdiction in cyberspace: a comparative perspective' (2007) 13(8) C.T.L.R. 245.
117. Maier, 'How has the law attempted to tackle the borderless nature of the internet?' (2010) 18(2) I.J.L.&I.T. 142.
118. Raul, McNicholas and Jillson, Reconciling European data privacy concerns with US discovery rules: conflict and comity' (2009) 2(3) Global Competition Litigation Review 119
119. Kuner, 'Data protection law and international jurisdiction on the internet, (2010) 18(2) I.J.L.&I.T. 176 (Part 1), 18(3) I.J.L.&I.T. 227 (Part 2).
120. During the sign-up phase for Amazon AWS S3 a customer is offered (as of Sep 2010) one of four 'storage domains': US (Standard), US (Northern California), EU (Ireland) or Asia Pacific (Singapore). Statements, such as the comment in the Amazon S3 service description "You can choose a Region to optimize for latency, minimize costs, or address regulatory requirements. . Objects stored in a Region never leave the Region unless you transfer them out." would likely be taken under English law as representations inducing the customer to enter into a contract.
121. Further details of Amazon's storage domain policy are available at http://aws.amazon.com/s3/faqs/#Where_is_my_data_stored.
122. The 'Safe Harbour' procedure was established by the US Department of Commerce, in consultation with the European Commission, to facilitate the transfer of personal data between the EU and the US
123. See further http://www.export.gov/safeharbor/.
124. See, for example, section 12.2 of Norton's Privacy Policy (note 43).
125. Chen et al, 'Side-Channel Leaks in Web Applications: a Reality Today, a Challenge Tomorrow' (2010), Proc. IEEE Symposium on Security and Privacy (Oakland), IEEE Computer Society, May 2010. Available at http://research.microsoft.com/apps/pubs/default.aspx?id=119060.
126. The degree to which Cloud providers were under a duty to actively monitor data uploaded by customers in respect of copyright infringement was the subject of a substantial claim brought by Viacom against Google regarding material uploaded to YouTube. This claim was dismissed in June 2010 but illustrates the potential for major disputes in this area.
127. Viacom International and ors v YouTube and ors (23 June 2010, unreported) http://www.google.com/press/pdf/msj_decision.pdf.
128. Google Apps Premier Terms of Service, 9.2 (see note 31.).
129. iWorks Terms of Service, 5 'Licence from You' (see note 22.).
130. 'Facebook's New Terms Of Service: "We Can Do Anything We Want With Your Content. Forever." ' http://consumerist.com/2009/02/facebooks-new-terms-of-service-we-can-do-anything-we-want-with-your-content-forever.html.
131. Graham and Anderson, 'Are individuals waking up to the privacy implications of social networking sites?' (2010) 32(3) E.I.P.R. 99.
132. Although Facebook subsequently withdrew some of the most contentious terms (such as the perpetual nature of the asserted licence) it still claims a very wide range of permissible uses. From Section 2 of the Statement of Rights and Responsibilities (see Note 27): "For content that is covered by intellectual property rights, like photos and videos (" IP content"), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (" IP License"). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it." .
133. For a discussion of the legal position regarding the ownership of data stored or processed via Cloud computing services, see Chris Reed's "Information 'Ownership' in the Cloud", http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1562461.
134. See note 30
135. 'Apple agrees to improve terms and conditions', Office of Fair Trading 27 November 2009 http://www.oft.gov.uk/news/press/2009/136-09.
136. GoGrid Terms of Service, 8(c) (see note 30.).
137. In English law, Hadley v Baxendale 'Limb 2' losses
138. UK Fast Terms of Service, 9.3 (see note 45.).
139. The decision was upheld in the Court of Appeal, [2010] EWCA Civ 912
140. Mozy Terms of Service, 'Limitation of Liability' (see note 24.).
141. See notes 19, 25, 27, 45 and 33 respectively
142. For example, the recently-emerging (as of the drafting of this paper) legal dispute between Microsoft and SalesForce.com over patents for Cloud Computing Technology.
143. 'Salesforce countersues Microsoft in patent spat', ZDNet, 28 June 2010, available at http://www.zdnet.co.uk/news/intellectual-property/2010/06/28/salesforce-countersues-microsoft-in-patent-spat-40089365/.
144. See notes 26 and 30
145. See note 44
146. "We will be the sole arbiter regarding the award of credit and our decision will be final and binding. The award of credit by us to you as described in this Service Level Agreement will be the sole and exclusive remedy for unavailability of stored data or virtual servers or loss of stored data. Credits will only be provided against future service and for the avoidance of doubt may not be exchanged for cash or other forms of payment" (See note 26.).
147. In the case of some T&C documents we resorted to document version comparison software to identify if changes had been made
148. Although if the AUP was amended to reflect legislative changes (e.g. to restrict behaviour newly made illegal) the provider could argue that the customers had not been disadvantaged in that such behaviour was now proscribed by law. Nonetheless it would seem prudent to ensure that customers were advised of such changes.
149. Directive 93/13/EEC of 5 April 1993 on unfair terms in consumer contracts (OJ L 95, 21.4.1993, p. 29).
150. Directive 97/7/EC of 20 May 1997 on the protection of consumers in respect of distance contracts (OJ L 144, 4.6.1999, p. 19).
151. 37Signals, 3Tera, Akamai, Google, IBM, Nirvanix, PayPal, Salesforce, Zecter and Zoho make no mention of monitoring. UKFast states that it will not proactively monitor customer compliance with the AUP.
152. Apple, Decho, Dropbox, Facebook, Flexiant and Microsoft
153. Adrive, Amazon, Elastichosts, Ghost (now defunct), GoGrid, Joyent, Rackspace, Symantec and The Planet
154. It is of course possible that providers that make no mention of a monitoring policy in their T&C nonetheless do so for either of the reasons quoted
155. See note 17
156. See note 41
157. The AUP for Decho Mozy is extremely brief and general; it simply requires the customer to use the service "in compliance with all applicable laws, rules and regulations." (See note 24.).
158. They are emphatically not legal advice and do not and should not provide a substitute for careful examination of the T&C of a Cloud service, and professional legal advice if appropriate
159. As noted, for example, by Hal Roberts from the Berkman Centre for Internet and Society in 'Amazon's Wikileaks Takedown', at http://blogs.law.harvard.edu/hroberts/2010/12/03/amazons-wikileaks-takedown/.
160. See section 4.9.
161. Although a provider might assert that it was acting in the best interests of customers by imposing arbitration on the basis that a recognised arbitration procedure and forum is more likely to be accessible to a customer than the legal system and courts of a foreign Cloud provider. Nonetheless, consumer protection law may view such imposed arbitration as unfair, as per note 60.
162. See Section 4.17.
163. Indeed, as noted at Section 4.2, Flexiant specifically asserts Scottish law as governing its T&C.