SWITCHING – TRANSFER AND DELETION OF DATA AFTER THE END OF THE RELATIONSHIP Cloud users may wish to change providers. The reasons why a consumer or a small firm may want to change providers may be diverse. It could be, for example, for mere convenience because competitors offer better prices or services with more functionalities but also because of other reasons which are outside their sphere of influence, for instance the bankruptcy of the cloud provider. Most cloud computing contracts allow users "to stop using the service at any time for any reasons".1 However, they often remain silent on the conditions (e.g. notice) or require a certain amount to be paid. Providers are also sometimes entitled to stop the service at their own discretion2 and, in case of “free” services, after a certain period of inactivity without warning. All these situations trigger a risk for the user to lose certain data stored on the cloud. User will not be able to retrieve the data because they cannot access them anymore or because the data has been deleted. As most cloud contracts which are offered to consumers and small businesses are not negotiable, users depend on the contractual switching rights and modalities provided by the respective cloud provider. Small firms are particularly vulnerable when switching from one provider to another. They need to ensure their business continuity and respect their legal obligations (e.g. tax obligations). Consumers and small firms will therefore want to know what will happen to their data when switching. The concerns regarding data transfer and data deletion are not only limited to switching. They exist for each scenario in which the relationship between the cloud provider and the user comes to an end. The current practice may create a lack of trust towards cloud computing services and slow down the up-take of such services. For providers, the preservation and transfer of the data or its complete deletion imply costs. This is particularly true when the data to be transferred/deleted not only include the initial data up-loaded by the consumer or the small firm in the cloud but also the metadata (structure of the data). Cloud computing providers are therefore reluctant to automatically cover such costs which may have a direct impact on the cloud computing service prices. This is particularly true when they offer cloud computing capacity for “free” or when the relationship 1 For instance, "You may terminate your account at any time, for any reason, by following the instructions on the Site and discontinuing use of the Products.", " 16.2 Termination for Convenience. Customer may terminate the MSA for convenience at any time as provided in Section 4.1 through the Customer Portal." And " You may terminate the Services associated with your [X] account at any time and for any reason by going to your Account webpage 2 Termination – X may at any time, under certain circumstances and without prior notice, immediately terminate or suspend all or a portion of your Account and/or access to the Service. Cause for such termination shall include: (a) violations of this Agreement or any other policies or guidelines that are referenced herein and/or posted on the Service; (b) a request by you to cancel or terminate your Account; (c) a request and/or order from law enforcement, a judicial body, or other government agency; (d) where provision of the Service to you is or may become unlawful; (e) unexpected technical or security issues or problems; (f) your participation in fraudulent or illegal activities; or (g) failure to pay any fees owed by you in relation to the Service. Any such termination or suspension shall be made by Apple in its sole discretion and X will not be responsible to you or any third party for any damages that may result or arise out of such termination or suspension of your Account and/or access to the Service. 1 with the customer comes to an end because the user has breached one of his contractual obligations. Helping consumers and small firms to preserve and transfer their data is often seen as an extra service offered for a fee to users in addition to the cloud service itself. National rules that may apply to cloud computing contracts (e.g. rules on services contracts or lease contracts) may contain default rules on the conditions of termination (e.g. rules on notice of termination) but they do not contain specific requirements of what needs to be done with the data stored in the cloud after the end of the contract. While in the area of personal data, the cloud provider has at least an obligation not to process the data longer than necessary for the purpose of which it was obtained3, there are no general clear-cut obligations for a cloud provider to return the data to the cloud user or to delete non-personal data. In order to encourage the up-take of cloud computing service, consumers and small firms should be confident on what will happen to their data when the relationship with the cloud provider comes to an end. At the same time, cloud providers should not be overburdened with unnecessary obligations that may impact in a sizeable way on cloud computing services prices. Preservation of the data Practices vary considerably regarding the preservation of the data following the end of the relationship between the cloud provider and the user. Some providers will retain the data of the user after termination of the contract. The delay of the retention period generally varies (often 30 days4). Some providers allocate a “reasonable period of time”5. During that period users will still be able to access the service and retrieve the data. However, if the user has breached one of his contractual obligations (e.g. non-payment of fees, no respect of the Authorised Use Policy) cloud providers will generally stop the service immediately without notice6. Users will not be able to access the service to retrieve their data. Other providers will stop the service and erase the data immediately after termination7. 3 This means that the data will have to be deleted or rendered unintelligible after the termination of the contract. If after termination of the contract, the cloud provider store the data without the customer's consent, they risk being liable under data protection rules. See Article 6 (1) (e) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 0281). 4 Termination 12.5. Your Data Portability and Deletion. Upon request by You made within 30 days after the effective date of termination or expiration of this Agreement, We will make the Your Data available to You for export or download as provided in the Documentation. After that 30-day period, We will have no obligation to maintain or provide Your Data, and will thereafter delete or destroy all copies of Your Data in Our systems or otherwise in Our possession or control as provided in the Documentation, unless legally prohibited. 5 Termination 11.5 Effects of Termination. If this Agreement (including all Order Pages) terminates, then: (i) the rights granted by one party to the other will cease immediately; (ii) X will provide Customer access to, and the ability to export, the Customer Data for a commercially reasonable period of time atX’s then-current rates for the applicable Services; (iii) after a commercially reasonable period of time, X will delete Customer Data by removing pointers to it on X’s active and replication servers and overwriting it over time; and (iv) upon request each party will promptly use reasonable endeavours to return or destroy all other Confidential Information of the other party. 6 Termination (X for business agreement)- You're free to stop using our Services at any time. We also reserve the right to suspend or end the Services at any time at our discretion and without notice. For example, we may suspend or terminate your use of the Services if you're not complying with these Terms, or use the Services in a 2 Cloud providers should allocate a sufficient period of time to users to retrieve their data. Even in case of breach of his obligation by the cloud user, the immediate end of the service may be considered disproportionate. The provider should give advance notice to the user that the service will come to an end to enable users to retrieve their data. In case of a free service, the cloud provider should also give advance notice to users that the service will end after they have not used it for a certain period in order to enable them to retrieve their data. Nature and format of the data to be transferred Users want to be able to retrieve their data in a format that they can re-use. Therefore, they need to retrieve not only the data that they have initially stored in the cloud but also the metadata. Very few contracts guarantee the portability of the data at all and even if they do they remain silent on its technical aspects.8 They do not clarify which data (i.e. whether both data and metadata are included) users will be able to retrieve at the end of the contract and what would be the format. As technology evolves quickly it may not always be easy to define at the time of the signature of the contract what will be the adequate format to transfer the data at the time of termination. The parties may not know at the time of the signature of the contract what would be the need of the user at the time of termination. In the absence of an obligation to guarantee the portability of the data, cloud providers should clarify in the contract if they guarantee portability or not. If the cloud provider does not guarantee portability they could clarify in the contract which data users will be able to retrieve and in which format. As it is not always possible to foresee at the time of signature of the contract what will be the format needed by the user at the time of termination, the provider could clarify in the contract that the user will be able to retrieve the data in a “commonly used” format. Cooperation between cloud providers for the transfer of the data Contracts generally do not foresee the obligation for the cloud provider to cooperate with a new cloud provider in case of switching. Recently, a French court has used the principle of manner that would cause us legal liability, disrupt the Services or disrupt others' use of the Services. Except for Paid Accounts, we reserve the right to terminate and delete your account if you haven't accessed our Services for 12 consecutive months. We'll of course provide you with notice via the email address associated with your account before we do so. 7 Termination (X master service agreement) 16.4 Access to Customer Content. The deletion of Customer Content is automatic upon termination or expiration of the MSA. Consequently, unless X determines otherwise, Customer will not have access to Customer Content, and X may immediately erase or delete Customer Content from its computer infrastructure after the effective date of termination or expiration of this MSA. 8 An example where content cannot be transferred: "What happens if my Services are cancelled or terminated? (…..) If any your Services are cancelled or terminated, or if your X account is closed, we will delete information or Content associated with your Microsoft account or will otherwise disassociate it from you and your X account. We are under no obligation to return Content to you. (4.4)". And an example where content can be retrieved by the user: X will provide Customer access to, and the ability to export, the Customer Data for a commercially reasonable period of time X’s then-current rates for the applicable Services; (iii) after a commercially reasonable period of time, X will delete Customer Data by removing pointers to it on X’s active and replication servers and overwriting it over time; and (iv) upon request each party will promptly use reasonable endeavours to return or destroy all other Confidential Information of the other party. 3 good faith to impose an obligation upon a service provider to help its customer transfer data to a new service provider9. Costs Switching may imply important costs linked to the transfer of the data. These costs may greatly depend on the nature (e.g. personal data, metadata, non-personal data) and the format of the data to be transferred (e.g. a simple copy or a full migration of all the data). Full deletion of the data from the initial cloud service provider's infrastructure platform or software may also be quite expensive. It seems practice that it is for the user to retrieve his data when the relationship comes to an end. The cost for deletion seems to be on the cloud provider. A distinction could be made whether the decision to switch by the end user is taken at their own initiative or depends on facts that are independent of their sphere of influence (e.g. the bankruptcy of the cloud provider, the modification of the contract by the provider). When the decision to switch is due to facts that are outside the user’s sphere of influence, the latter should as a matter of principle not bear costs to retrieve their data. On the other hand, a decision of the user to switch before the end of the contract for mere convenience (e.g. a better offer on the market) may justify that the user bears the costs linked to switching. For example, when the contract has been signed for a certain duration and the user decides to switch before the end of the term the former cloud provider could for example retain the fees already paid and claim all or some of the fees which are to fall due under the remainder of the contract. The amount of fees that could be retained should be proportionate to the duration of the contract. In case of a contract for a very short duration (e.g. for 1 month contract), the cloud provider could be entitled to retain the entire fee until the end of the contract. In case of a longer contract, the cloud provider should be able to retain the fees until the end of the contract up to a certain amount (e.g. 3 months fees). A second element that could be taken into account is whether the cloud computing service is offered for “free” or not. In case of “free” services, the cloud service provider should not have to support the cost of transferring back all the data (e.g. giving back all the messages exchanged on an email platform), in particular if the service has not been used for a certain period of time. 9 Tribunal de Grande Instance de Nanterre, 30 Novembre 2012 4