GETTING THROUGH THE DEAL Cloud Computing Cloud Computing Contributing editor Mark Lewis 2019 2019 © Law Business Research 2018 Cloud Computing 2019 Contributing editor Mark Lewis Bryan Cave Leighton Paisner LLP Reproduced with permission from Law Business Research Ltd This article was first published in November 2018 For further information please contact [email protected] Publisher Law The information provided in this publication is Tom Barnes general and may not apply in a specific situation. [email protected] Business Legal advice should always be sought before taking Research any legal action based on the information provided. Subscriptions This information is not intended to create, nor does James Spearing Published by receipt of it constitute, a lawyer–client relationship. [email protected] Law Business Research Ltd The publishers and authors accept no responsibility 87 Lancaster Road for any acts or omissions contained herein. The Senior business development managers London, W11 1QQ, UK information provided was verified between Adam Sargent Tel: +44 20 3780 4147 September and October 2018. Be advised that this is [email protected] Fax: +44 20 7229 6910 a developing area. Dan White © Law Business Research Ltd 2018 [email protected] No photocopying without a CLA licence. Printed and distributed by First published 2017 Encompass Print Solutions Second edition Tel: 0844 2480 112 ISBN 978-1-78915-001-8 © Law Business Research 2018 CONTENTS Global overview 5 India 48 Mark Lewis Samuel Mani and Abraham Mathew Kandathil Bryan Cave Leighton Paisner LLP Mani Chengappa & Mathur Argentina 7 Japan 52 Diego Fernández Atsushi Okada and Hideaki Kuwahara Marval, O’Farrell & Mairal Mori Hamada & Matsumoto Australia 12 Korea 56 Adrian Lawrence and Caitlin Whale Seungmin Jasmine Jung, Jeong Kyu Choe and Jung Han Yoo Baker McKenzie Jipyong LLC Bangladesh 16 New Zealand 61 Sharif Bhuiyan and Maherin Khan Richard Wells Dr Kamal Hossain and Associates MinterEllisonRuddWatts Belgium 19 Poland 65 Edwin Jacobs, Stefan Van Camp and Bernd Fiten Krzysztof Wojdyło and Rafał Kuchta time.lex Wardyński & Partners Brazil 25 Sweden 72 José Mauro Decoussau Machado, Ana Carpinetti and Peter Nordbeck and Dahae Roland Gustavo Gonçalves Ferrer Advokatfirman Delphi Pinheiro Neto Advogados Switzerland 77 China 30 Jonas Bornhauser Matthew Murphy and Fei Dang Bär & Karrer Ltd MMLC Group United Kingdom 81 France 36 Mark Lewis Olivier de Courcel and Stéphanie Foulgoc Bryan Cave Leighton Paisner LLP Féral-Schuhl/Sainte-Marie Alain Recoules Arsene Taxand United States 95 Amy Farris, Manita Rawat and Matthew Mousley Germany 43 Duane Morris Thomas Thalhofer and Lars Powierski Noerr LLP 2 Getting the Deal Through – Cloud Computing 2019 © Law Business Research 2018 PREFACE Preface Cloud Computing 2019 Second edition Getting the Deal Through is delighted to publish the second edition of Cloud Computing, which is available in print, as an e-book and online at www.gettingthedealthrough.com. Getting the Deal Through provides international expert analysis in key areas of law, practice and regulation for corporate counsel, cross- border legal practitioners, and company directors and officers. Throughout this edition, and following the unique Getting the Deal Through format, the same key questions are answered by leading practitioners in each of the jurisdictions featured. Our coverage this year includes new chapters on Argentina, Brazil, France and Korea. Getting the Deal Through titles are published annually in print. Please ensure you are referring to the latest edition or to the online version at www.gettingthedealthrough.com. Every effort has been made to cover all matters of concern to readers. However, specific legal advice should always be sought from experienced local advisers. Getting the Deal Through gratefully acknowledges the efforts of all the contributors to this volume, who were chosen for their recognised expertise. We also extend special thanks to Mark Lewis of Bryan Cave Leighton Paisner LLP, the contributing editor, for his continued assistance with this volume. London October 2018 www.gettingthedealthrough.com 3 © Law Business Research 2018 Bryan Cave Leighton Paisner LLP GLOBAL OVERVIEW Global overview Mark Lewis Bryan Cave Leighton Paisner LLP It took from November 2009 to September 2011 and 15 drafts for the composed of ‘two or more distinct cloud infrastructures (private, com- US National Institute of Standards and Technology (NIST) to pro- munity or public) that remain unique entities, but are bound together duce its final definition of cloud computing. (For the short story by standardised or proprietary technology that enables data and of that journey, see www.nist.gov/news-events/news/2011/10/ application portability (eg, cloud bursting for load balancing between final-version-nist-cloud-computing-definition-published, and for clouds)’. (NIST definition, page 3.) the final version of the definition, see The NIST Definition of Cloud This is not without its challenges, but it reflects a more measured Computing, Recommendations of the National Institute of Standards approach. Organisations that are even more concerned about risk and and Technology, Peter Mell and Timothy Grance, Special Publication compliance (eg, regulated financial services firms), but that want some 800-145 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpub- of the benefits of the computing model, are likely to deploy a private lication800-145.pdf.) It was worth the wait, because the NIST defini- cloud, which is ‘provisioned for exclusive use by a single organisation tion remains de facto the definitive universal statement of what cloud comprising multiple consumers (eg, business units). It may be owned, computing is. managed and operated by the organisation, a third party, or some com- By the way, in the time it took the NIST to produce 15 drafts and bination of them, and it may exist on or off premises’. (NIST definition, release a final version of the world’s favourite cloud computing defini- page 3.) Alternatively, in a community of common interests, for exam- tion, the global public cloud services market had grown from US$58.6 ple within local government, health and law enforcement communi- billion to US$92.97 billion – by an astonishing 58.65 per cent. ties, they may deploy a community cloud: Arranged over just one and a half pages, the NIST’s definition of cloud computing is: provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (eg, mission, security a model for enabling ubiquitous, convenient, on-demand network requirements, policy, and compliance considerations). It may be access to a shared pool of configurable computing resources (eg, owned, managed, and operated by one or more of the organizations networks, servers, storage, applications, and services) that can be in the community, a third party, or some combination of them, and rapidly provisioned and released with minimal management effort it may exist on or off premises. (NIST definition, page 3) or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deploy- As the community cloud shares the characteristic of ‘exclusive use’ ment models. with the private cloud deployment model, we may treat it as a variant of the private cloud for the purposes of this work. For the purposes of Getting The Deal Through – Cloud Computing, we can So, we observe that the four deployment models are currently in look up the five essential characteristics at our leisure. Of more imme- use, but to varying degrees. For the reasons given below, in our analysis diacy are the three service models: software-as-a-service (SaaS), plat- of how cloud computing has been adopted in the countries covered by form-as-a-service (PaaS) and infrastructure-as-a-service (IaaS). And this work, we need to address the deployment models as a composite we need instantly to refer to the four deployment models: private cloud, of cloud computing, and as virtually interchangeable. Besides, finding community cloud, public cloud and hybrid cloud. That is because one data to compare and contrast the adoption of each of the deployment of the first challenges, when answering the questions outlined below, is models (and for that matter each of the service models) – that will for to tell readers which of the cloud deployment models we mean. the most part be freely available to our readership, while also being In general, what most people mean when they refer generically to authoritative – is a real challenge. And it does not help that, in their cloud computing is the third deployment model, which is most often endeavours, law and policymakers and regulators have not generally seen as the archetypal cloud, ie, the public cloud: – yet – seen the need to distinguish precisely between the cloud deploy- ment models and service models. the cloud infrastructure . provisioned for open use by the general However, where we can do so within the limitations of our allot- public. It may be owned, managed, and operated by a business, ted space, we try to identify the characteristics of a deployment model academic, or government organisation, or some combination of that may be relevant to our analysis. Take, for example, the question them. It exists on the premises of the cloud provider. (NIST defini- concerning labour and employment law considerations applicable to tion, page 3) the cloud. And in particular, whether the EU Acquired Rights Directive (ARD) and EU member state legislation implementing it will apply to a It is the cloud model for which the most extensive claims are made in cloud migration. If that legislation does apply, it will transfer staff auto- this computing model: utility, multi-client, location neutral, almost matically on their existing terms of employment to the cloud service infinitely scalable and pay-per-use (see ‘Essential Characteristics’, provider (CSP) where their employer is migrating some or all in-house NIST definition, page 2). IT functions to the cloud.