Cloud computing changes IT service delivery

The Assistant Crown Solicitor of our Intellectual Property, Technology and Communication Team, Dominic Callaghan, joined a number of other experts to discuss cloud computing at the Queensland Law Society’s ‘What’s in the Clouds?’ conference on Thursday 17 November 2011.

Here, Dominic outlines the advantages and legal risks of this new technology.

“Cloud computing is the delivery of information technology services via the Internet to customers by organisations known as cloud service providers. This service delivery model enables users to store files and access software hosted remotely, rather than on a local hard drive or a server at their office,” Dominic said.

“The cloud service provider is responsible for providing the infrastructure, servers, storage and networking infrastructure necessary to ensure the availability and scalability of an organisation’s applications.”

Advantages of cloud computing include:

• increased accessibility and flexibility as users can access systems regardless of location and the device they are using as long as they have an Internet connection
• shared resources, which give users access to software that is not installed on an individual work station
• the ability to scale information technology (IT) services up or down according to demand and only pay for what is used
• reduced IT costs through shared resources and reduced in-house IT workforce.

However, like most new IT in its infancy, cloud computing comes with its own risks and legal issues, including:

• data-security concerns due to business-critical data being managed by an external cloud provider
• loss of control over data location – data will be stored in the cloud on one or more physical servers and may be dynamically load balanced across multiple locations. In a cloud computing environment organisations may be unaware of the location of their data at any given time. This can raise issues in relation to the different laws that may affect that data in different jurisdictions, particularly those relating to privacy and data management
• security and performance issues related to sharing an IT resource with third parties
• significant reliance on an external cloud provider for the functioning of IT systems that support the organisation’s day-to-day operations
• reliance on the availability and performance of both the organisation’s and the cloud provider’s Internet connection.

“The application of cloud computing within the Queensland Government also raises additional issues due to the government’s tight information and privacy regulations,” Dominic said.

Most Queensland Government agencies collect and deal with highly confidential personal information in the course of providing government services. The Information Privacy Act 2009 provides strict rules about collecting, storing, using and disclosing this information, which must be followed by government agencies.

“Government agencies are required to explain what will happen to personal information and are responsible for ensuring it’s stored safely and securely. Under a cloud computing model, data storage and security are in the hands of a third-party cloud service provider and the physical location of the data is often unknown,” he said.

“Procurement of cloud computing services also poses contracting challenges for the government, particularly with software being provided as a service rather than a product. All procurement for ICT products and services by the Queensland Government utilises a mandatory standard set of contractual terms and conditions set out in the Government Information Technology Contracting framework (GITC).”

Some customisation of the GITC contract will be required to reflect the nature of your specific cloud-computing procurement, but in general, the GITC framework is flexible enough to accommodate the various types of cloud computing,” he said.

“Cloud computing can offer organisations distinct advantages, and with all of the leading local and international ICT providers  investing millions of dollars in setting up cloud computing platforms, it is likely that we will continue to see this concept evolve.”

^{The information in this publication is provided for general purposes only. It is not to be relied on as a substitute for legal advice. Crown Law and the Department of Justice and Attorney-General accept no liability for losses caused by reliance on the material in this publication. Formal legal advice should be obtained for particular matters.}