Your company is embroiled in a lawsuit, and your general counsel has come to IT for help in conducting e-discovery on a batch of data. You easily gather some of the information from storage in your data center, but some of it is sitting in the cloud. Easy enough, you think, to get that data as well.
You may be in for a rude awakening.
Many lawyers and IT staff "just assume if they put data in the cloud it's going to be at their fingertips, that it's inherently discoverable," says Barry Murphy, co-founder and principal analyst at eDJ Group Inc., a consulting firm specializing in e-discovery. "That's not necessarily the case."
The cloud has dramatically expanded the number of places where electronically stored information (ESI) can live. Under the Federal Rules of Civil Procedure (pdf), a party to litigation is expected to preserve and be able to produce ESI that is in its "possession, custody or control."
With cloud, those duties are split -- the ESI may not technically be in your possession anymore, and yet it's presumably under your control, says James M. Kunick, principal and chair of intellectual property and technology practice at law firm Much Shelist P.C.
Because this area is so new, the legal ramifications of storing data in the cloud are still murky. Among the few instances of case law is Gordon Partners v. Blumenthal, which found that if a company has "access to documents to conduct business, [then] it has possession, custody and control of the documents for purpose of discovery," according to Murphy.
That could potentially pose a significant problem. Depending upon the relationship they have with their cloud vendor, companies may not know exactly where their data is stored. Even if they do, information in the cloud can be difficult to access in the right format and in a timely manner.
And there is a danger that companies can lose control over access to that data -- opposing attorneys, for example, might subpoena not only your company, but also your cloud provider. "You need to make sure your contract with the provider allows you to control what happens if they get a subpoena," Kunick warns.