Great piece this week by our friend Steven Vaughn-Nichols. E-Discovery: Your Data, Their Cloud, and the Law talks about the potential legal challenges of cloud storage.
“Things have changed. Now your data is likely to be on someone else’s server, stored in the cloud. You’re probably aware of all the usual availability, privacy, and security issues surrounding cloud storage, but do you know your legal responsibilities for that data? You had better learn them – starting with the technology you need to put in place for e-discovery.”
As a European, I’m quite familiar with data privacy and legal issues surrounding it. Europeans, in general, play very close attention to where their data is stored because different countries have very different policies is what they can do with data stored in their country – or, as in the case of the US, data stored in a different country by a US corporation.
In U.S. law, discovery is the pre-trial phase in a lawsuit in which each party, through the law of civil procedure, can obtain evidence from the opposing party by means of discovery devices including requests for answers to interrogatories, requests for production of documents, requests for admissions and depositions. Discovery can be obtained from non-parties using subpoenas. When discovery requests are objected to, the requesting party may seek the assistance of the court by filing a motion to compel discovery.
“Oh yes, lawyers and courts can ask—and sometimes demand—that you turn over your data or the data of a customer. Over the last few years, the legal system has been giving businesses more reasons to retain e-mail and other electronic records. In addition, thanks to laws like Sarbanes-Oxley Act (SOX) you can end up in legal hot-water if you “destroy, conceal, or cover up any record to impede or influence a federal lawsuit or an investigation by any federal agency, or in relation to or contemplation of any such matter or case.””
That’s pretty heady stuff, but the cloud complicates it even more.
“But what about when your records aren’t on your machines, when the data resides on your provider’s clouds? You’re not off the hook. And you get to worry about a whole new set of legal issues.
“Responding effectively to e-discovery issues in a cloud computing implementation requires that a variety of concerns be fully considered, weighed, and thoroughly discussed by a company’s legal and IT teams prior to any selection of and successful migration to the cloud,” says Rich Santalesa, senior counsel at Information Law Group, says. “For starters, ‘e-discovery’ is not a single act, event or process. Rather it and the search through and production of electronically stored information (ESI) in connection encompasses the entire life cycle of an potential, pending or actual legal action.””
So do yourself a favor, read Steven’s story – there are some great tips in there. But you might also want to consider first storing your data in your own private cloud first, then – and ONLY then – begin to parse out that data to public clouds.
In other words, keep yourself and your data safe – and avoid a ball and chain situation!
