I’ve recently had the opportunity to participate in or moderate several panels on cloud computing, addressing issues such as governance, security, privacy, and legal liability.  

One issue that frequently comes up is whether cloud computing is really new or different.  That depends on how you look at it.  As a legal matter, the model itself is not that different.  You can view it as another form of outsourcing, which is hardly new.  Or, you can draw the analogy to per-seat software licensing for enterprises, which is also not new.  What is new and different, however, is both the elasticity (the use of cloud can be scaled up or down with ease) and the volume of data that it can involve — and it’s really that volume that makes the subject so interesting and that raises many of the questions most often discussed in connection with cloud computing. 

Another question that frequently comes up is how companies should approach using the cloud and addressing the complex jurisdictional issues that can arise as data freely crosses borders.  These are hard issues with no silver bullet solutions.  But the questions underscore the importance of approaching the issue holistically and taking a principled approach to the cloud.   The first order of business should be to take a look internally and ask whether your organization has a clear, principled, and coherent way for addressing these myriad issues — privacy, security, responding to law enforcement requests — in the use of cloud computing services.  For example, on the issue of law enforcement requests (for those businesses that receive them), businesses will be far better off if they take the time, really examine their practices, and develop principles and guidelines for how they will deal with requests globally.

There is another potential benefit to taking such a principled approach on privacy and security issues, too.  It is quite possible that the business “winners” in the cloud will be those that offer the best products and services and compete on things that matter to customers, including security and privacy.  Customers care about how their data will be protected.  For users to make informed evaluations and decisions, however, they need to have some baseline information – which requires some degree of transparency around privacy practices, at least a general description around security, and information on where the data will be stored.  The most successful businesses are likely to be those that are best able to engage with customers and communicate their core principles, values, and practices.

Email this postTweet this postLike this postShare this post on LinkedIn
Photo of David Fagan David Fagan

David Fagan co-chairs the firm’s top ranked practices on cross-border investment and national security matters, including reviews conducted by the Committee on Foreign Investment in the United States (CFIUS), and data privacy and cybersecurity.

Mr. Fagan has been recognized by Chambers USA and…

David Fagan co-chairs the firm’s top ranked practices on cross-border investment and national security matters, including reviews conducted by the Committee on Foreign Investment in the United States (CFIUS), and data privacy and cybersecurity.

Mr. Fagan has been recognized by Chambers USA and Chambers Global for his leading expertise on bet-the-company CFIUS matters and has received multiple accolades for his work in this area, including twice being named Dealmaker of the Year by The American Lawyer for 2016 and 2019. Clients laud him for providing “excellent advice,” “know[ing] everything there is to know about CFIUS” and being “extremely well regarded” by key regulators. (Chambers USA)

In the foreign investment and national security area, Mr. Fagan is known for his work on matters requiring the mitigation of foreign ownership, control or influence (FOCI) under applicable national industrial security regulations, including for many of the world’s leading aerospace and defense firms, private equity firms, and sovereign investors, as well as telecommunications transactions that undergo a public safety, law enforcement, and national security review by the group of agencies known as “Team Telecom.”

Mr. Fagan’s practice covers representations of both foreign and domestic companies before CFIUS and related national security regulators. The representations encompass matters in which the principal assets are in the United States, as well as those in which there is a smaller U.S. nexus but where solving for the CFIUS issues – including through proactive mitigation and carve-outs – is a critical path for the transaction. Mr. Fagan is also routinely called upon to rescue transactions that have run into challenges in CFIUS, and to negotiate solutions with the U.S. government that protect national security interests, while preserving shareholder and U.S. business interests.

Reflecting his work on U.S.-China investment issues and his experience on complex U.S. national security matters intersecting with China, Mr. Fagan is regularly engaged by multi-national companies, including the world’s leading technology companies, to advise on strategic legal projects, including supply chain matters, related to their positioning in the emerging competition between the U.S. and China. Mr. Fagan also has testified before a congressional commission regarding U.S. national security, trade, and investment matters with China.

In the privacy and data security area, Mr. Fagan has counseled companies on responding to some of the most sophisticated documented cyber-based attacks on their networks and information, including the largest documented infrastructure attacks, as well as data security incidents involving millions of affected consumers. He has been engaged by boards of directors of Fortune 500 companies to counsel them on cyber risk and to lead investigations into cyber attacks, and he has responded to investigations and enforcement actions from the Federal Trade Commission (FTC) and state attorneys general. Mr. Fagan has also helped clients respond to ransomware attacks, insider theft, vendor breaches, hacktivists, state-sponsored attacks affecting personal data and trade secrets, and criminal organization attacks directed at stealing personal data, among other matters.

In addition, he routinely counsels clients on preparing for and responding to cyber-based attacks on their networks and information, enhancing their supply chain and product development practices, assessing their security controls and practices for the protection of data, developing and implementing information security programs, and complying with federal and state regulatory requirements. He also frequently advises clients on transactional matters involving the transfer of personal data.