Page 12 - CCCA61_2010

CCCA_V4No1_Dept-Technology-FIN.qxd:CCCA_V1No2_Dept-CrossBdr-V1.qxd 2/3/10 11:37 AM Page 12 Technology Breaches in the cloud As the world goes digital and governments ramp up privacy requirements, corporate counsel face new security challenges. By Pablo Fuchs — are among the best known. adopted its own privacy legislation,which “From a business perspective, there is has been found to be substantially similar great appeal to moving to the cloud to PIPEDA, then PIPEDA applies.There because of cost savings, convenience, scal- are three provinces that have their own ability and flexibility, and the fact that it’s privacy framework: Quebec, Alberta and the latest technology,” explains Lisa R. British Columbia.” Lifshitz, a partner in Gowling Lafleur For Canadian companies, this presents Henderson LLP’s Toronto office who some serious challenges. First, they must focuses on IT and business law. And yet comply with four laws in Canada alone if cloud computing still makes people nerv- they send the data to another jurisdiction ous.“It’s a more economic way of man- either domestically or internationally.And aging data, but there’s definitely a data sent outside of Canada will be sub- loss of control in the process. ject to local laws, Gratton says:“If data is Users have no control transferred to the U.S., it will be subject over how their data to the Patriot Act even if the contract is kept and between the local organization and the stored and third party in the U.S. states that the third he digital flow party may not disclose the data. So, there Tof information is always a risk of data ending up in the may have led to signifi- hands of the U.S. government.” cant productivity gains for Although there is nothing one can do businesses, but not without cost. from preventing government access to a Compromised data incidents are on company’s data, in-house counsel can take the rise, exposing companies to substan- protective measures.One way,Gratton says, tial risk, not least of which is the expo- is to inform customers that their data is sure of highly confidential information. cannot ensure that there are adequate being stored externally, as well as the loca- No surprise then that managing tech- security safeguards in place.” tion of the data centre. (In Quebec, this is nology risk and protecting data has That’s because,“under cloud computing an obligation.) “You may be outsourcing become a major endeavour, with corpo- business models, the data moves around data storage to the U.S. right now, but rate counsel playing a key part in ensuring across different jurisdictions,” says Éloïse maybe later, you’ll be outsourcing to more that their companies comply with a Gratton, a technology counsel with jurisdictions.You don’t want to go back to growing number of privacy laws. McMillan LLP in Montreal. clients all the time, so make sure you make Making matters more urgent is the Complicating matters are the different the proper disclosures.” growing importance of cloud computing. privacy laws that have been implemented It’s also vitally important to protect one’s Cloud computing is a catch-all term for across Canada and around the world in company’s interests contractually, says services, accessible from anywhere, provid- recent years. “Each country has its own Lifshitz: “Business people won’t be aware ed from a centralized server delivered over privacy framework. In Canada, we have of the significant legal pitfalls,such as own- the Internet.These are often subscription- the Personal Information Protection and ership of company data and being able to based: online data storage and software-as- Electronic Documents Act (PIPEDA),” retrieve it upon termination/expiration of ISTOCKPHOTO a-service — Web-based email for example Gratton explains. “Unless a province has the contract, security and privacy issues, 12 CCCA Canadian Corporate Counsel Association SPRING 2010