New Zealand Law Society - Cloud Computing Guidelines for Lawyers
Legal practices are increasingly using cloud storage and software systems as an alternative to in-house data storage and IT programmes.
The cloud has a number of advantages – particularly flexibility and cost – but these have to be balanced with risks to privacy and control.
The Lawyers and Conveyancers Act (Lawyers: Conduct and Client Care) Rules 2008 and the Privacy Act 1993 require lawyers to protect and hold in strict confidence all information concerning a client acquired in the course of the professional relationship.
This Practice Briefing aims to give Law Society members helpful guidance on best practices for moving to the cloud. It examines how cloud computing can be used while maintaining lawyers’ professional obligations.
It is not intended to endorse cloud computing, to be legal advice, or an industry standard nor does it provide a defence to misconduct or improper professional practice.
Lawyers need to be aware of their obligations to protect clients’ personal data. Any move to using cloud services cannot compromise these statutory obligations.
All use of cloud computing by lawyers and law firms must always be within the parameters of lawyers’ professional obligations under the Rules of Conduct and Client Care and the Privacy Act 1993. These pieces of legislation outline requirements for lawyers when dealing with client personal information.
Guidance on the obligations lawyers have to protect clients’ personal information in line with these two acts is available in another Law Society Practice Briefing. -Protecting Clients’ Personal Information.
Chapters 8 and 11 of the Rules of Conduct and Client Care outline lawyers’ fundamental obligations in protecting confidentiality.
Chapter 8 states the confidential information requirements:
Chapter 11 states the requirements for professional dealings:
Adopting a third party cloud computing platform is likely to constitute outsourcing an operational function that could make it possible for that third party to access your clients’ data.
It follows that you should seek contractual terms from your cloud supplier that would enable you to ensure:
To do this you need to understand the different layers of ownership and management in the arrangements.
These are clearly outlined in the United States’ National institute of Standards and Technology (NIST) definition of Cloud Computing below.
As laid out in the Practice Briefing Protecting Clients’ Personal Information, it is advised that lawyers and firms have personal information protection policies in place.
The starting point for evaluating cloud services should be your practice’s existing policies.
Under Information Privacy Principle 3 (section 6 The Privacy Act 1993) an agency must provide the name and address of the agency that will hold a client’s personal information.
Clients should be informed when their confidential information is to be held or stored with any third party and directly authorise the third party to store their personal information.
The Office of the Privacy Commissioner has published general guidance for small business moving to the cloud, frequently referred to in this Practice Briefing.
This Practice Briefing uses the NIST definition of cloud computing.
“Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g. networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.”
This cloud model is composed of five essential characteristics, three service models, and four deployment models.
A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.
Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (for example, mobile phones, tablets, laptops, and workstations).
The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand.
There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (eg, country, state, or datacentre). Examples of resources include storage, processing, memory, and network bandwidth.
Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at a time.
Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (eg, storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilised service.
The capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure.
The applications are accessible from various client devices through either a thin client interface, such as a web browser (eg,.web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user – specific application configuration settings.
The capability provided to the consumer is to deploy onto the cloud infrastructure consumer created or acquired applications created using programming languages, libraries, services, and tools supported by the provider.
The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application – hosting environment.
The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (eg, host firewalls).
The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (eg, business units). It may be owned, managed, and operated by the organisation, a third party, or some combination of them, and it may exist on or off premises.
The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organisations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organisations in the community, a third party, or some combination of them, and it may exist on or off premises.
The cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organisation, or some combination of them. It exists on the premises of the cloud provider.
The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardised or proprietary technology that enables data and application portability (eg, cloud-bursting for load balancing between clouds).
Amazon is an example of Infrastructure as a Service, and Platform as a Service. It allows users to operate databases and virtual servers.
Google Drive is an example of Software as a Service suite of ready-made applications – word processing, spreadsheets, databases and file storage. Through using Google Drive a consumer creates data which is then stored in Google’s data centres.
There are also numerous specialist cloud services. XERO, for example, pioneered a cloud-based accounting service.
Cloud storage does not have to be based overseas. There are a variety of New Zealand-owned cloud storage providers with servers located in New Zealand.
Initially it is important to assess your business’s IT needs, priorities and long term plan. For instance:
Below is a summary of the commonly cited benefits and risks associated with cloud computing. This list is indicative and not comprehensive.
Cloud computing benefits
Cloud computing risks
The Practice Briefing Protecting Clients’ Personal Information outlines best practice for storing personal information.
Part of this process is to label data and information stored in your organisation on a spectrum from high risk through to low risk. The degree of risk of this data should have storage correlations. A firm may decide that high risk data will be stored in a different way to low risk data.
It is important that the process is clear around storage of data and that staff do not use their own free cloud service-provided emails or storage facilities to transport high risk data.
For instance, a staff member should not be permitted to use their personal Gmail or Hotmail email accounts to store confidential information so they can work remotely.
As outlined, policies should be clear and enforced so the employer is doing the best they can to ensure best practice is followed.
Cloud computing contracts vary widely. A good starting point is a comprehensive study by Shelston IP partner Mark Vincent, Cloud Computing in 2013 – What legal commitments can you expect from your provider. Looking at Australian providers, it showed the massive range of cloud computing contracts where some were in line with Australian Privacy standards, while others were far from it.
See Cloud Computing Contracts – What Legal Commitments Can You Expect From Your Provider… by Katrina Crooks, Shelston IP
It used to be that service providers called all the shots; however, in an increasingly competitive market some cloud computing providers are willing to adapt their terms and conditions for big clients.
Small New Zealand cloud service providers may be willing to tailor a service to fit your needs, but these providers may not offer the financial and technology security of the bigger but less transparent or negotiable service providers.
Lawyers and firms thinking about moving to the cloud must go in with a clear understanding of their priorities and make risk evaluations in line with business goals.
The tech industry attracts some fly-by-night providers. When choosing a cloud provider it is extremely important that you look closely at the providers for:
In any contractual agreement it is important to be thorough. Cloud computing offers a unique range of risks.
Here are some of the risks lawyers need to be particularly aware of in a cloud context.
The Katrina Crooks report outlines that contracts concerning cloud service availability are most commonly governed by service level agreements (SLAs) which often provide a guarantee of the percentage of time for which the service will be operational.
The remedy for failure to meet the guarantee is typically a service credit provided to the customer to offset fees for the month in question.
However, some down time was often not included in that calculation. This included scheduled maintenance; force majeure events; outage resulting from misuse of the service; and outages elsewhere on the Internet.
Some included an exorbitant list of down-time excuses.
SLAs must be scrutinised carefully to determine their overall effect and so that customers are aware of the requirements to be met in order to seek service credits. And that these are reasonable.
The Law Society of England and Wales recommends that lawyers consider various aspects of service availability, including:
The Law Society of England and Wales also recommends weighing up the relative merits of a credit regime against damages at common law and to be careful before accepting that service credits are your sole and exclusive remedy. This will limit the right to sue for damages at large or terminate the contract.
You should ensure:
Make sure you are aware where your data will journey at all times, and that your provider and (if relevant) subcontractors can’t access your clients’ data. You should also be clear on the rules surrounding subcontracting – whether it is permissible and what your involvement should be in the process.
Some cloud providers sell data to third parties. You need to take precautions that your provider will not access or sell your data.
Lawyers should be aware of where their data is located and the privacy laws in the jurisdiction where their data is being stored.
If the cloud service provider is unwilling to tell you the exact location of their data storage facilities, they need to be able to provide evidence of binding contractual commitments they have made to keep data in locations which won’t compromise the privacy of their customers.
Examples are the European Union’s Binding Corporate Rules and the Asia Pacific Economic Co-operation Cross Border Privacy Rules or, locally, CloudCode, administered by the New Zealand Institute of IT Professionals, offers best practice cloud providers the ability to become signatories.
More about CloudCode is online.
The Office of the Privacy Commissioner’s guidance note Cloud Computing – A guide to making the right choices recommends that the following location information is sought from a cloud computing provider:
Will the provider let you know if it has to disclose information in response to a request?;
International and domestic police or intelligence agencies can in certain circumstances lawfully obtain access to your data via your cloud service provider.
However, it is important to remember, there are also times when international and domestic police or intelligence agencies can legally access data stored on your own server.
It is important to research the systems that a cloud service provider uses to deal with requests for information from government agencies and how they validate the legality of the requests. You should have a clear understanding with appropriate contractual and operational process in place to cover how the cloud service provider will deal with a request to access your data.
If a lawyer has concerns in respect of a certain client or class of client in respect of potential jurisdictional, privilege and third party access issues that may be a matter requiring serious consideration before choosing to store client info in the cloud.
The New Zealand Privacy Commissioner’s Cloud Computing guidance section “Where are the exits?” states that you need to be able to get your information out and make sure it’s no longer retained on the provider’s servers once you’re gone.
The provider should state:
The guidance note can be found on the Privacy Commissioner website.
Chapter 11 of the Rules of Conduct and Client Care states that:
A lawyer must take all reasonable steps to prevent any person perpetrating a crime or fraud through the lawyer’s practice. (This includes taking reasonable steps to ensure the security of and access to electronic systems and passwords).
International NGO the Cloud Security Alliance has put together a helpful matrix of cloud controls to assist organisations to determine whether their cloud service provider is providing adequate security.
Information in the Practice Briefing series is provided by the Law Society as a service to members. This briefing is intended to provide guidance and information on best practices. Some of the information and requirements may change over time and should be checked before any action is taken.
This list is based on the Office of the Privacy Commissioner’s Cloud computing checklist for small business.