For readers of this review who are not particularly technologically inclined, cloud computing is, in the editor's words, where “computing resources are delivered as an online utility service” (p. v). Readers of this review for whom that definition is not helpful are probably not going to enjoy, or benefit from, reading this book.
The book presents the main findings and publications of the Cloud Legal Project at the Centre for Commercial Law Studies (CCLS) at Queen Mary, University of London, and that project has the distinction of involving a team of experts with both academic and practical legal experience. Essentially a collection of articles previously published in various forums, this publication makes an important contribution to the legal enquiry of cloud computing. Cloud computing is not a discrete area of law any more than “computing” or “social networks” are, but the emergence of cloud computing as an important and widespread technology which imposes new circumstances on existing laws requires research and analysis in order to bring some clarity and resolution to an array of legal lacunae, conundrums, and anachronisms.
The central reason that the need for such a publication has arisen is that the law in almost all jurisdictions is lagging behind technology, and not just technological innovation, but actual mass use of new technologies. Perhaps the most interesting parts of the book are those areas in which the authors contend with extant legal provisions and, throughout the book, the authors show that the law in its current form is a mismatch for cloud computing. In each of the 14 chapters, the authors contend with the relevant regulation and case law, presenting in detail the current state of the law, the ways and extent to which it adequately addresses cloud computing, and drawing their conclusions and even recommendations.
The book is divided into four parts. Part I is coined “Cloud Computing Essentials” and is mostly a detailed technical description of cloud computing and an examination of how cloud computing outsourcing differs from traditional IT outsourcing. Part II is “Cloud Computing Transactions”, including Standard Contracts, Negotiated Contracts, Public Sector Contracts, and Ownership of Information. The major contribution of these chapters, especially for practitioners, arises from a survey conducted by the CCLS of the Terms of Service of over 30 cloud computing service providers, in 2010 and again in 2013. This very pragmatic approach informs the subsequent analysis, ultimately giving the reader not only the pros and cons of various terms, but also some data-driven sense of which terms are the industry norm and which are outliers.
Part III includes what was, for this reviewer, the most interesting and valuable part of the book. A determination that data is “personal data” within the meaning of the Data Protection Directive 95/46/EC (the “DPD”) has far-reaching implications, and Chapter 6, entitled “What is Regulated as Personal Data in Clouds?”, provides an excellent examination of how anonymisation, pseudonymisation, data fragmentation, and more may change the “personal data” status of information. Of particular interest, the chapter highlights the DPD's failure to give any credence to these technologies, and the DPD Article 29 Working Party's opinion (WP136) likewise fails to address them. For example, Internet as an Infrastructure (or “IaaS”) providers may have absolutely no knowledge of the nature of the data they store, and yet may be “processors” within the meaning in the DPD. The authors propose a two-stage approach. The first is that the definition of “personal data” should be based on the “realistic likelihood of identification” (p. 185) which gives credence to encryption, anonymisation, fragmentation, blocking, etc., and introduces flexibility which will allow the law to adapt as technology evolves. The second stage involves a more nuanced application of the legal requirements that currently attach to “personal data”. The legal ramifications of a “personal data” determination need not be “all or nothing”; the various requirements flowing from a finding that data are “personal data” may be applied based on the likelihood and potential severity of harm. This is a refreshing proposal, and one can only hope that it has some impact on EU legislators.
These recommendations must be read in conjunction with the following chapter (and the conclusions of the two chapters could have been woven together, but have been left in their original distinct form), “Who Is Responsible for Personal Data in Clouds?”. There the authors make several proposals, the first of which is that the “binary distinction between controllers and processors” be abolished (p. 215); they also propose that an intermediary role be recognised (p. 217) and further suggest criteria for granting immunity from DPD liability to certain providers. Chapter 9, “Which Law(s) Apply to Personal Data in Clouds?”, is interesting though mostly inconclusive. The final chapter of this section, “How Do Restrictions on International Data Transfers Work in Clouds?”, rightly concludes that the “DPD's data export restriction rules are neither sufficiently clear not harmonized effectively across Member States” (p. 275). Ultimately, the authors “suggest the DPD's legal restriction on data export be abolished” (p. 276), and even argue that the draft regulation may actually exacerbate “security, accountability, and transparency” which are necessary for the “efficient use of cloud computing” (p. 279).
Part IV of the book is “Cloud Regulation and Governance”. Chapter 11 on “Law Enforcement Access to Data in Clouds” is highly informative and, to most practitioners of IT law, will be off their beaten track. Following the Snowden revelations, this chapter acquires particular interest and significance. The last three chapters of the book are very informative and erudite, though they are not particularly cloudy. Chapter 12 contends with competition law and cloud computing. The chapter presents a clear analysis of EU competition and ways that cloud computing may become entangled in competition law, but there are few conclusions to be drawn. That is not the authors’ fault, but is rather the result of the infancy of the market and the speed at which it is evolving. The cloud computing market has hardly existed long enough for antitrust regulations or case law in the field to emerge. Chapter 12 considers several differences between EU and US competition (or antitrust) law, including: the minimum market share that is presumed dominant in a market – 40% in the EU, 50% in the US; the definition of the relevant market – generally narrower in the EU than in the US; and a prohibition on attempting to monopolise – extant in the US, absent in the EU (p. 317). The gradual commoditisation of various cloud computing services will greatly affect the competition authorities’ views of the market, dominance, and resulting violations. This and other analyses in the chapter are speculative, if thought-provoking.
In Chapter 13, on consumer protection law, the authors highlight some challenges that cloud computing presents to traditional consumer protection law. For example, they note that the “way in which many people increasingly use the Internet, including cloud computing services, makes drawing a distinction between what is a private use, and is a professional or business use, increasingly difficult” (p. 334). Obviously this has significant ramifications for an area of law designed to protect private consumers. Another important point (p. 347) is that many of the most popular cloud-based services are ostensibly free, and that presumably affects consumer expectations of “reasonable care and skill” – a term implied under s. 13 of the Supply of Goods and Services Act 1982. The authors make a valiant attempt to find specific applications to cloud computing, though both regulation and precedent in this area are all but absent. Nonetheless, both Chapters 12 and 13 are informative and will be helpful in guiding practitioners who encounter these areas of law. At the very least, they demonstrate that competition law and consumer protection law will be engaged by cloud computing in numerous ways – some anticipated in these chapters, others still to emerge.
Chapter 14, “Cloud Governance: The Way Forward”, attempts to present a system of governance of cloud computing that will solve the many problems with cloud computing law and, without expressly stating so, makes a partial effort at proposing the criteria for a governance structure that will address the failures of cloud computing law identified in the preceding chapters. The author states that he has deliberately avoided proposing a specific governance structure and likewise has not drafted governance rules – though, in this reviewer's opinion, both would have been a valuable and interesting addition to the book and the field.
The book is particularly UK- and EU-centric. In particular, Chapter 5 on “Public Sector Cloud Contracts” opens by stating that, with “much initial cloud market growth occurring in the US, it is unsurprising that the US government led the way … announcing a shift to a ‘Cloud First’ policy for US federal government” (p. 108). As noted by the authors, in this the US pre-empted the UK by almost three years. Nonetheless, the chapter is entirely devoted to the “2011–12 pilot cloud computing framework of the UK government” (p. 108), and the chapter goes into very great detail of the same. The US experience may have made for richer conclusions, and a comparison would at least have been informative.
Turning from the substance of the book to its form and style: the work is comprehensive and clear. Occasional flashes of obviousness jump off the page, such as when the authors note that, in assessing the capability of users to dictate security policies and practices, “deal value seems relevant” (p. 93). On the whole, there is little overlap and good consistency between the chapters. Occasional sentences that appear in the middle of the book may have been in place in a given chapter taken in isolation, but are awkward given the preceding chapters. For example, well into the book and in the thick of discussion about the finer points of call-off provisions and legal documentation for UK government cloud procurement, the authors write: “In many ways, cloud computing is simply one way to outsource IT resources. Therefore, many outsourcing issues are also relevant to cloud, but not all of them are, and cloud has its own unique features” (p. 140).
The language is clear and readable. At one point, the authors write of Article 6 of the Consumer Rights Directive, pursuant to which a “trader must provide the consumer with a long list of information in a clear and comprehensible manner. Those that have some particular relevancy for cloud computing might be” (p. 343), though of course “list” and “information” are both single. There appears to be a word missing at one point: “… it would not agree [to] a request” (p. 130). The writing is fairly technical and can be a little dry, though on p. 200, for example, the authors “liken processing personal data to cooking food” extending the metaphor to chefs, pre-equipped kitchens, and health and safety standards, all to explain that the requirement that data processors followed data controllers’ instructions is a misfit in the cloud computing context. In addition, the book contains some curious facts. For example, Rackspace prohibits use of its cloud storage services in connection with design of weapons of mass destruction (p. 50) and Facebook's privacy policy is longer than the US Constitution (p. 54, n. 88).
In summary, this book makes an important contribution to cloud computing law. Academics and practitioners in this area will certainly gain from the relevant chapters, if not from the entire book, and anyone active in competition law, consumer protection law and some additional areas will learn about the application of those areas of law to cloud computing by reading the relevant sections. We can only hope that regulators, particularly at the EU, will pay close attention to the book in its entirety and will act to meet the insightful criticism and constructive suggestions that the authors present.
