i.

Costs associated with maintaining a traditional internal data center can be reduced by using cloud services, because the cloud resources are typically shared with other customers.

ii.

Cloud services provide the ability to quickly increase or reduce resources to meet demand. This allows a customer to use computing power or storage, on an as needed basis, rather than having to permanently build out their own data center.

iii.

Cloud services provide the ability to have a third party monitor and rapidly deploy security patches and other upgrades.

iv.

Many small and medium sized businesses find that cloud service providers have more expertise than the business can independently hire.

i.

Single Tenant Model

ii.

Shared Multi-Tenant

i.

Content as a Service (CaaS) - Delivers content to users

ii.

Software as a Service (SaaS) - Provides access to software over the internet, thereby eliminating the need to install and run the software application on the user’s machine

iii.

Platform as a Service (PaaS) - Delivers a platform (a cloud operating system) via the internet and allows “cloud applications” to be built on top of it

iv.

Infrastructure as a Service (IaaS) - allows customers to rent underlying computer resources, such as servers, storage and firewall protection

i.

A public cloud infrastructure provides resources (such as computer applications or storage services) that are shared between multiple unrelated customers.

ii.

A private cloud infrastructure typically provides dedicated resources for a single organization. Those resources may be located at the organization’s facilities or from an external location.

iii.

A community cloud infrastructure provides shared resources between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.).

iv.

A hybrid cloud has combined elements of private, community, or public cloud services.

i.

Courts apply traditional principles of contract law to assess the enforceability of online agreements, focusing on whether the party challenging enforcement had reasonable notice of and manifested assent to the terms.¹ Generally, courts differentiate online agreements between “clickwrap” agreements and “browsewrap” agreements. A clickwrap agreement appears on an internet webpage and requires that a customer agree to any terms or conditions by engaging in some affirmative act, such as by clicking on a check box on the screen, in order to proceed with the internet transaction. In contrast, a “browsewrap” agreement occurs where the website provides customers with the ability to view the terms of the agreement, such as through a hyperlink at the bottom of a web page, but does not otherwise require that the customers take any affirmative action to signify their assent to the agreement.

ii.

Courts routinely enforce clickwrap agreements because notice and assent are more easily established.² In contrast, the enforceability of browsewrap agreements involves a more fact-sensitive inquiry in which courts determine whether the customer has “actual or constructive knowledge” of the contract prior to being bound.³ Actual knowledge is most often obtained through a defendant’s admission of knowledge of the site terms or through the presence of a cease and desist letter that advises the defendant of the existence of such terms.⁴ Alternatively, constructive knowledge is typically found where reasonable notice of the terms is provided such that the court can impute knowledge of their existence to the customer.⁵ Courts have found notice to be sufficient to impute knowledge where a website provided prominent notice of the hyperlinked terms with easy access to the full agreement.⁶ In contrast, courts have held browsewrap

agreements unenforceable where customers were required to scroll down below the fold (i.e., to a secondary or submerged screen) to see the hyperlinked notice, an action which was not necessary to complete their transaction.⁷

i.

Generally, an agent can bind his principal when the agent has either actual or apparent authority or if the principal ratifies the agent’s agreement.⁸ Actual authority may be express or implied, and is triggered by the principal’s objective manifestations to the agent. ⁹With apparent authority, the manifestations are made to a third person, and must be made by the principal rather than the purported agent.¹⁰ The principal’s manifestations will support a finding of apparent authority only if (1) they cause the one claiming apparent authority to actually or subjectively believe that the purported agent has authority to act for the principal and (2) the claimant’s actual, subjective belief is objectively reasonable.¹¹ Such objective manifestations to third parties do not necessarily need to come directly from the principal, but rather can also arise “from authorized statements of the agent.”¹² Whether apparent authority exists is normally a question of fact.¹³ A principal ratifies an agent’s agreement if the principal,

with full knowledge of the facts: (1) receives, accepts, and retains benefits from the contract; (2) remains silent or fails to repudiate the contract; or (3) otherwise exhibits conduct demonstrating adoption and recognition of the contract.¹⁴

ii.

Courts generally will apply these same agency contract law principles when evaluating authority to bind in the context of online agreements. For instance, a Massachusetts District Court held that there was no apparent agency as a matter of law where the only relevant conduct by defendant was that it issued the purported agent an e-mail address with the defendant’s corporate domain name.¹⁵ In denying the plaintiff’s claim of apparent agency in this context, the court cited opinions finding that giving someone a business card with the company name or logo, access to a company car, or company stationery, by themselves, did not create sufficient indicia of apparent authority.¹⁶ Similarly, a Tenth Circuit Court refused to infer that a corporation’s ownership of an IP address used in connection with an online purchase was sufficient to establish that the individual who agreed to the user agreement from that IP address had authority to bind the corporation.¹⁷ Finally, where a plaintiff company expressly notified both its employees and the defendant that only three executives were authorized to bind the plaintiff to an online agreement, the court held that unauthorized employees had no actual or apparent authority to bind the plaintiff when they used defendant’s website and agreed to defendant’s online agreements.¹⁸

i.

Many cloud service contracts have evolved from a software licensing model that in the past were governed by the Uniform Commercial Code (UCC) Article 2. While UCC obligations may be triggered by the delivery of software applications that are used to access the cloud services, generally the UCC doesn’t apply to a pure services contract. This can lead to questions concerning the enforceability of various exculpatory clauses,

since most case law concerning the interpretation of such clauses arises under the UCC rather than the common law.

ii.

Using a traditional license grant clause in a cloud services contract may cause confusion, because it may grant a user rights in the underlying software used to provide the service (i.e., the cloud provider’s software infrastructure) rather than a right to obtain the services provided by the software. Therefore, many cloud service contracts are drafted in the form of a service contract rather than as a license.

i.

Shared Multi-Tenant – it is difficult for the vendor to convey IP ownership of any service feature, because all customers must use the same service

ii.

Single Tenant - customer ownership of improvements is at least possible, as the customer is able to use a personalized instance of the software

i.

Many service providers will seek annual payment in advance (may need to address refund issues for certain breaches and termination issues)

ii.

Pay for use - How is “use” determined?

iii.

Price Changes

iv.

Does the customer have any rights to obtain prices lower? (e.g., benchmarking right, and obligation on provider to match benchmark price)

v.

MFN ?

i.

A services description protects both the customer and the provider so that each party understands what services will be provided (and what services will not be provided)

ii.

Common items that are included in the services description: technical specifications; published materials; FAQs; and, bug and technical reports

i.

The contract should specify the process to changing the service

ii.

Can the customer refuse or delay a change?

iii.

What is the process for changing the platform, operating system or application?

iv.

Notification?

v.

How does pricing work?

vi.

Is the data accessible by the customer for other purposes?

i.

How are service metrics defined? Does the entire service have to be unavailable or only particular portions of the service?

ii.

How are service metrics reported?

iii.

Does the customer need to have access to any vendor tools?

iv.

Does the customer need to report a service issue to obtain a service credit or will a credit be automatically generated?

v.

What is the process for strengthening service metrics over time?

vi.

Are service credits the sole and exclusive remedy arising from a performance breach?

vii.

Vendors often want to reserve the right to “immediately” suspend the service in the event of an “emergency” issue. However, the standard for what constitutes an emergency may not be clearly defined other than an event that has or could have the potential of causing a material disruption in service or potential risk to data integrity.

viii.

Service Levels Agreements typically have two components:

i.

Cloud service provider contracts often require that customers “ensure” that their end users comply with the vendor’s terms of service. Many sophisticated customers will attempt to soften this requirement. For example, a customer may only want to undertake an obligation to use “commercially reasonable efforts” to cause its users to comply with the terms of service, or simply “inform” its users of the obligations. Other customers may want the vendor to directly contract with the end users.

ii.

Vendor terms of service typically prohibit the customer and its end users from engaging in inappropriate activities or using the services to store or process inappropriate content (which activities and content may, or may not be, identified in further detail).

iii.

Vendor contracts may require the customer to notify the vendor in the event the customer terms of service are breached.

iv.

Vendor contracts typically allow the vendor to suspend or terminate the customer or its users in the event the terms of service are breached, and require the customer to indemnify the vendor against any third party claims arising from the breach. Customers will often try to limit the suspension to: (1) material violations or violations that significantly threaten the security or integrity of the cloud service; and, (2) those end users that actually caused the breach (rather than the customer itself). Customers will also request advance notification of any suspension.

v.

Cloud vendor agreements may incorporate by reference additional terms and policies posted to the vendor’s website, such as policies addressing privacy practices and end user obligations concerning the use of the service, which are typically are subject to the vendor’s unilateral amendment. Customers will frequently attempt to require the vendor to provide direct notice in advance of the effective date of any amendments to incorporated terms, along with the right to terminate if such amendments are materially detrimental to the customer’s interests.

i.

Every contract will end at some time

ii.

Contract should address

i.

Does the service provider:

ii.

Contract may require the service provider:

iii.

Disaster Recovery

i.

Parties can bargain for effects of “FME”

ii.

Consider scope and wording (what is/is not considered FME)

iii.

What form of relief is granted (excused from performance, suspension of performance, termination, etc.)?

iv.

Does the FME clause override disaster recovery and service level credits?

v.

What are the disaster recovery obligations during an FME?

i.

Data protection and privacy laws should be considered when evaluating a cloud services offering. Different laws may be implicated depending on the nature of the content that is being stored or processed by vendor or the location where the data originates or is processed. Generally, cloud service providers will attempt to shift some or all of the compliance obligations to the end users, because the cloud service provider may be unaware of the actual content being processed or stored in its services. Depending on the circumstances, some of these laws may impose specific security requirements and, may require the imposition of various obligations on subcontractors. Some frequently implicated laws include:

ii.

EU Data Protection Act prohibits export of personally identifiable information from EU to countries that have inferior (as viewed from an EU perspective) data protection laws.

1.

Rule: Data must not be transferred to countries outside the EU that do not offer an “adequate level of protection” a. Currently only: Andora, Argentina, Canada, Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland, Uruguay b. Exceptions: i. ask permission from every “data subject” involved ii. US/EU Privacy Shield Adopted by European Commission on July 12, 2016 (US Companies can certify compliance August 1, 2016) iii. EU model contract clauses iv. “Binding Corporate Rules”

2.

From a cloud perspective, EU data protection law will apply when a “controller” is located in its territory; or, when a “controller” outside the EU uses “equipment” within the EU territory. When applied to cloud computing, EU law can be triggered when using an EU-based data center. Many authorities interpret “equipment” in an extremely broad way (e.g., browser cookies).

iii.

Sophisticated customers will often want to review a service provider’s internal security and control policies, audit security and control procedures and impose contractual obligations on the service provider to ensure that the service provider is in compliance and remains in compliance with the applicable laws. Many cloud service providers may have difficulty imposing contractual obligations on their subcontractors. For example, cloud service providers will often subcontract with very large data storage providers (such as Amazon) to provide underlying storage or computing resources.

iv.

Note: Some vendors will attempt to minimize the impact of various laws by: (i) refusing to comply with laws that are triggered by specific content; (ii) providing each customer with encryption tools that do not allow the vendor to access the customer data; and (iii) requiring the customer to warrant that it is legally permitted to have the vendor process the information provided by the customer.

i.

It is important to

ii.

Will the vendor be permitted to use the data (or subsets of the data) for other purposes?

i.

Does the service provider use subcontractors?

ii.

Can the service provider impose contractual obligations on the subcontractors?

iii.

Does the customer have a right to approve new subcontractors? (or a category of subcontractors, such as those that have access to that data in either encrypted or unencrypted form?)

iv.

What does the approval/disapproval process look like?

v.

Should the customer have a subcontractor termination right rather than an approval right?

i.

Location - Some cloud provider contracts expressly reserve the right to store customer data in any country in which the provider does business. While dispersed geographical storage may be beneficial from a data back-up perspective, it can raise security issues.

ii.

What are the characteristics of the data center?

iii.

How is data backed-up? On-site? Off-site? How is off-site data protected?

iv.

Where is the data stored?

v.

Is the data and back-up data encrypted?

i.

Cloud service providers may offer to provide “commercially reasonable” security for data. In some instances, contracts may also offer to adhere to “industry standard” security practices, without specifying the specific standard. For some customers, it may be beneficial to specify an actual, specific security requirement (e.g., data subject to HIPAA, Gramm-Leach-Bliley, PCI DSS, or the Massachusetts Standards for the Protection of Personal Information of Residents of the Commonwealth) or industry standard (e.g., ISO 27001) that must be followed.

ii.

Customers may want to consider the following factors when evaluating the cloud provider’s security:

i.

In more complex agreements, it may be import to distinguish between an actual security breach (“Security Incidents”) and a vulnerability (“Security Issues”) and provide different rights, obligations and remedies for each category of issues.

i.

May impose a back door security obligation on the service provider

ii.

Is the service provider obligated to keep a customer’s information “confidential”?

iii.

Some providers will state that they will employ “commercially reasonable efforts” to “protect” a customer’s confidential information

i.

Customers and vendors of cloud services can be compelled to produce data under several mechanisms. It is important to note that in some circumstances, certain categories of vendors are not allowed to voluntarily disclose information to the government.

ii.

Typically vendors will:

i.

Customers may want two conflicting obligations:

ii.

Depending on the service, vendor may not know the content of the data and will be unable to assess legal retention requirements

iii.

Contract should specify when data is destroyed

i.

Customer may want the contract to contain procedures for auditing compliance issues:

ii.

Customer may want to impose compliance obligations on the vendor

i.

Typically, the customer wants to impose a combination of the following obligations on the service provider:

i.

In some jurisdictions, warranty disclaimers must be explicitly negotiated or bargained for.¹⁹ It is unclear what constitutes adequate negotiation in the commercial context. Cases frequently note that the parties did not discuss the disclaimer term— suggesting a high bar for negotiation—but involve distinguishable factual scenarios where the disclaimer was first presented in a post-sale invoice.²⁰ Consumer cases applying the negotiation rule vary; some suggest that knowledge and understanding of the term is sufficient, while others insist that actual

knowledge of the term is not sufficient if the negotiation does not address the terms of the disclaimer and possible defects.²¹

ii.

Other jurisdictions allow a seller to disclaim warranties.²² For example, in Texas, to exclude the implied warranty of merchantability, the contract “must mention merchantability and in case of a writing must be conspicuous[.]”²³ In Colorado, implied warranties may be excluded “by a conspicuous writing which states generally that there are no warranties extending beyond the description in the contract.”²⁴

iii.

To be conspicuous, a warranty exclusion must reasonably give notice to the person against whom it will operate.²⁵ For example, Texas courts determining conspicuousness consider capitalization, prominent placement,²⁶ setoff from surrounding text, and larger or contrasting type or font.²⁷ Courts are more likely to find a disclaimer conspicuous when the transaction is between commercial entities.²⁸

i.

Three Categories of Damages

i.

The enforceability of exclusionary clauses (which include both remedy limitations and disclaimers of liability) can vary widely from jurisdiction to jurisdiction.²⁹ In most jurisdictions, they are largely enforceable under unless unconscionable. For example, under Washington law, “Exclusionary clauses in purely commercial transactions … are prima facie conscionable and the burden of establishing unconscionability is on the party attacking it.”³⁰ When the party seeking to avoid the limitation argues that it should be not be enforced, the court first considers where there are any “indicia of unfair surprise.” That is, was the buyer advised of the limitation term, was the contract short and clear, and was this an arm’s length transaction among competent parties. Compare this to Colorado, which also allows

general disclaimers of tort liability for the manufacture and sale of products.³¹ But, it disfavors such disclaimers, however, and requires that they be “specifically agreed to in negotiations between a commercial seller and commercial buyer.”³²

ii.

Courts may sometime not enforce limits on remedies if the only available remedy fails of its essential purpose. The doctrine is driven generally by concern that contracts should provide at least a fair quantum of remedy for breach of the contract. Many jurisdictions apply two-part test: (1) identify essential purpose of limited remedy; and, (2) identify whether or not limited remedy in fact failed to meet such essential purpose

iii.

Cases are mixed as to whether the failure of Essential Purpose Doctrine applies to pure services agreements.