Cloud Data Ownership: 'Onus Is On Cloud Providers'

Printer-friendly version Email this CRN article

Data ownership concerns clouded the initial move to the cloud, with questions swirling over what happens to data when it's moved to the cloud; what happens if a cloud provider goes out of business; and what happens if cloud customers fails to pay their bills.

And as more cloud providers spring up and more workloads and data are moved into the cloud, those questions become more pressing.

The issue came to a head earlier this year when cloud storage provider Dropbox tweaked its terms of service to include language that led customers to believe that Dropbox could use their files, documents and other data as it saw fit.

When Dropbox revised its Terms of Service in July, it wrote: "By submitting your stuff to the Services, you grant us (and those we work with to provide the Services) worldwide, non-exclusive, royalty-free, sublicenseable rights to use, copy, distribute, prepare derivative works (such as translations or format conversions) of, perform, or publicly display that stuff to the extent reasonably necessary for the Service."

The wording sent Dropbox customers into a frenzy, worrying how Dropbox may "prepare derivative works" or sublicense their data. Dropbox quickly did an about-face and changed its tune, apologizing for the gaffe and told customers that customers own their data and Dropbox will not use it.

"We want to be 100 percent clear that you own what you put in your Dropbox. We don't own your stuff. And the license you give us is really limited. It only allows us to provide the service to you. Nothing else," the company wrote.

The UK's National Computing Centre also recently found that IT decision-makers from private and public sector organizations rank their largest concern when it comes to cloud security as "loss off control of data and loss of control over where data is held." And in the U.S., cloud users share similar fears.

And in the U.S., Gartner last year crafted a cloud computing bill of rights, where data ownership was the first and most important right afforded cloud users. Gartner said cloud users were entitled to "the right to retain ownership, use and control of one's own data" and that cloud providers must specify what they can do with customer data.

The rise of social networks has also called into question data ownership, when networks like Facebook were rumored to be leveraging user photos for advertising and other content without consent. In reality, Facebook's social ads require users and their friends to take "express action" to share information.

The thorny issue of data ownership has caused businesses to wonder if it's safe to turn their data over to cloud providers and trust it off-site on someone else's servers.

But for cloud providers and cloud VARs, data ownership isn't even a question. The customer owns it. No ifs, ands or buts. But it is up to the vendor and cloud provider to spell out exactly what it has access to and what happens in the event that data is unavailable or inaccessible.

"Data that is uploaded to the cloud belongs to the individual supplying the information. The normal ownership rules of proprietary data still apply," said Brian Fino, managing director of Fino Consulting.

NEXT: The Cloud Customer Owns The Data -- Period

Printer-friendly version Email this CRN article