Cloud computing may be revolutionising the delivery of online services, but it has the potential to create a legal liability headache for in-house lawyers, writes Macquarie Telecom General Counsel
Heather Tropman.

Whilst cloud computing offers a number of significant benefits to most businesses in terms of the ability to store data in a cost effective way and buy hosting services based on a 'pay per use' model, there are risks GCs need to know about when it comes to data sovereignty.

Most global cloud providers reserve the right to store their customer's data in any location across the globe. This can create a legal and regulatory minefield. Data is subject to the laws of the jurisdiction where it resides but in a global cloud hosting model, it can be hard to pinpoint the relevant jurisdiction.

The risks GCs need to think about include:

(i) whether the data can be sent offshore in the first place. APRA issued a letter late last year to the companies it regulates, cautioning them on the use of an offshore cloud model. The Australian government has also indicated that it will adopt a risk based approach to the global cloud.

(ii) maintaining compliance across multiple jurisdictions. One area where this is proving problematic is in relation to an Australian businesses' ability to continue to comply with the Privacy Act if they store data in a country that does not enjoy the same level of privacy protection as we do.

(iii) foreign tax liability. In the fiscally constrained, post GFC US economy, tax authorities such as the IRS are investigating areas of underreporting. For example, Australian businesses that have transactional websites hosted in the US or that use dedicated hosting facilities in the US could be liable for US tax and should obtain very clear tax advice on whether their offshore data storage (whether in the US or elsewhere) triggers tax implications. 

(iv) the impact of foreign laws such as the US Patriot Act or the Singapore Computer Misuse Act on Australian businesses.

This is a developing area that represents a step change in the industry and provides a real opportunity for the legal and business community to work together. In some cases, particularly where sensitive business records or personally identifiable information is involved, an Australian cloud offering with infrastructure exclusively "onshore" may be the answer.

Heather Tropman is also this month's feature GC in the ALB-Clayton Utz In-house Perspective series, in issue 9.5 of ALB magazine.