The Ongoing Question of Data Ownership in the Cloud

Cloud computing is a revolutionary phenomenon in the business world, one that has been going on for several years now. As such, it may come as a surprise to some that the questions surrounding data ownership in the cloud remain an ongoing dilemma -- a complicated issue that’s still far from being resolved. It’s one of the biggest reasons many companies are reluctant to embrace the cloud. After all, why risk sending valuable data into the cloud without a guarantee that it will still be yours in the end? While organizations and cloud providers have been struggling to come up with a workable solution to the dilemma, progress has still been made on the issue. Even so, many questions still remain, and businesses would be wise to take proper precautions when making a major transition to the cloud.

When a business decides to use a cloud provider, they are essentially taking data and handing it over to a third party. The big question is, after this happens, who owns that data? The client obviously believes that since it’s originally their data, it should remain so, but it’s also important to note that a cloud provider retains possession of it. So does the cloud provider have any rights to it? After all, providers are often under some sort of expectation to protect and secure that data. Part of the problem stems from the definition of what data is, in that it is hard to define in the first place. Is data property, not unlike a car or a computer? Should it even be considered property? What is a cloud provider’s role in all this? Some may wish to say once data has been handed over to a provider, that vendor now owns it. However, others say the provider is only acting as a custodian of that data, a virtual caretaker that is obligated to give it right back up the moment the real owner requests it.

Complicating matters is the fact that most countries have outdated laws relating to data ownership. There’s no question that from a legal standpoint, laws are usually playing catch-up to advances in technology. That makes it all the more difficult to come to a definitive conclusion over data ownership disputes. With no universally recognized standard by which all legal matters can be settled, there remains plenty of confusion surrounding the issue. Companies seeking to use a cloud provider also need to pay close attention to where that provider will house the data. A U.S. company, for example, may pick a vendor that stores the data in Canada. A different jurisdiction means different laws and standards for data ownership.

If all of this sounds complex, that’s because it is. The key point to take away from data ownership issues is that it all boils down to the contract. Many contracts stipulate who owns the data, whether it’s the provider or the company. Amazon Web Services (AWS), for instance, states within its Terms and Conditions that “you reserve all right, title and interest (including all intellectual property and proprietary rights) in and to Your Content.” Other providers have similar provisions contained within their contracts. At the same time, some vendors seek to keep ownership of data as a way to lock-in clients, preventing them from moving their data elsewhere. This can all be prevented provided that businesses study their contracts and evaluate the prospective cloud provider. Ask pointed questions and make sure you’ll be able to retain ownership of your data.

This point is especially important when it comes to other critical issues related to data ownership. Contracts need to specify who will be responsible for data that is lost or stolen. They should also lay out what will happen to that data in case the provider goes bankrupt or is acquisitioned by a larger vendor. Any contract that doesn’t take these factors into account must be called out by the client. Signing a contract that’s silent on these issues is simply opening a company up for trouble somewhere down the line.

For companies still struggling with questions over what is cloud computing, clarifying data ownership issues remains a critical step. While legal standards may lag behind, it’s up to each company working with their cloud providers to ensure data ownership is properly defined. As long as both parties are aware of the issue and seek to solve it, problems are less likely to crop up in the future.