I’ve recently had the opportunity to participate in or moderate several panels on cloud computing, addressing issues such as governance, security, privacy, and legal liability.  

One issue that frequently comes up is whether cloud computing is really new or different.  That depends on how you look at it.  As a legal matter, the model itself is not that different.  You can view it as another form of outsourcing, which is hardly new.  Or, you can draw the analogy to per-seat software licensing for enterprises, which is also not new.  What is new and different, however, is both the elasticity (the use of cloud can be scaled up or down with ease) and the volume of data that it can involve — and it’s really that volume that makes the subject so interesting and that raises many of the questions most often discussed in connection with cloud computing. 

Another question that frequently comes up is how companies should approach using the cloud and addressing the complex jurisdictional issues that can arise as data freely crosses borders.  These are hard issues with no silver bullet solutions.  But the questions underscore the importance of approaching the issue holistically and taking a principled approach to the cloud.   The first order of business should be to take a look internally and ask whether your organization has a clear, principled, and coherent way for addressing these myriad issues — privacy, security, responding to law enforcement requests — in the use of cloud computing services.  For example, on the issue of law enforcement requests (for those businesses that receive them), businesses will be far better off if they take the time, really examine their practices, and develop principles and guidelines for how they will deal with requests globally.

There is another potential benefit to taking such a principled approach on privacy and security issues, too.  It is quite possible that the business “winners” in the cloud will be those that offer the best products and services and compete on things that matter to customers, including security and privacy.  Customers care about how their data will be protected.  For users to make informed evaluations and decisions, however, they need to have some baseline information – which requires some degree of transparency around privacy practices, at least a general description around security, and information on where the data will be stored.  The most successful businesses are likely to be those that are best able to engage with customers and communicate their core principles, values, and practices.