Cloud Security – Who Owns The Data?

Strip away the ethereal ‘cloud’ moniker, and the reality of where such data is physically stored can be rather concerning for many. The cloud is simply a collection of servers housed in massive, acre-filling complexes and owned by some of the world’s largest corporations. This essentially means that our data sits on computers we don’t have access to.

Microsoft, Amazon and Apple have all invested huge sums in creating homes for our personal data. The end result is a service which is convenient, portable and reduces the need for expensive hardware in our homes. That precious photo of your son blowing the candles out on his birthday cake for the first time is suddenly accessible on all of your devices, no matter where you are.

The same benefits can be felt in business. With organisations increasingly moving file storage to the cloud, staff can now access critical information in an instant, anywhere on the planet. But with such data often being highly confidential, it begs one simple question: who owns it?

When it comes to cloud data, the contract between the company providing the storage service and the client is of paramount importance. A clear distinction should be made between the provider’s right to store and process the data and the ownership that is retained by the customer.

Here are three examples that set just the right tone:

• Office 365: “You own your data and retain all rights, title, and interest in the data you store with Office 365. You can download a copy of all of your data at any time and for any reason, without any assistance from Microsoft.”
• Amazon Web Services (AWS): “Other than the rights and interests expressly set forth in this Agreement, and excluding Amazon Properties and works derived from Amazon Properties you reserve all right, title and interest (including all intellectual property and proprietary rights) in and to Your Content.”
• Google: “Some of our Services allow you to upload, submit, store, send or receive content. You retain ownership of any intellectual property rights that you hold in that content. In short, what belongs to you stays yours.”

The word ‘your’ should be used judiciously within such contracts and a tone set that puts the provider strictly in the role of enabling storage and data access – nothing more.

Whether you’re using a cloud hosting service for personal or business use, there are a few key things you can do to ensure you retain ownership:

1. Read every term and condition from the provider to ensure they follow the examples set above.
2. If you’re a business and are considering storing highly confidential information on the cloud, it is advisable to take legal advice before choosing a partner to ensure the legal framework surrounding the data storage is clear.
3. Never stop backing up locally. Your stuff may be on the cloud, but if the provider goes under, you could lose everything if you don’t have a local copy.
4. Ensure that your chosen cloud partner fully encrypts your data and uses end-to-end encryption when transmitting it.
5. Check the location of where your data will be stored. If in a foreign country, ensure their data regulations match up with your own.

If you create something digitally, you are automatically granted ownership of it in the UK under the Copyright, Designs and Patents Act of 1988. But what if that data is stored in the cloud? Can its ownership change and instead become the property of the hosting provider?

The EU has long campaigned to clear up this common source of confusion, and on 25th May 2018 introduced a new directive that sets new rules to help citizens retain control over their personal data.

With Britain due to leave the EU following the Brexit vote, it is likely the UK government will need to introduce similar measures to avoid any doubt over digital ownership when it comes to cloud storage.

The fact remains, though – if you created the data, you’re the legal owner, regardless of where it is stored.

Thankfully, we only have to look at Microsoft, Google and Amazon for confirmation that one of the most important elements of cloud security is retaining data ownership.

You own your personal data. Businesses own their data. Any cloud storage service provider should clearly set out within its terms and conditions that this is the case and if there is ever any doubt or ambiguity, alternatives should be sourced or legal assistance called upon.