SWITCHING – TRANSFER AND DELETION OF DATA
AFTER THE END OF THE RELATIONSHIP
Cloud users may wish to change providers. The reasons why a consumer or a small firm may
want to change providers may be diverse. It could be, for example, for mere convenience
because competitors offer better prices or services with more functionalities but also because
of other reasons which are outside their sphere of influence, for instance the bankruptcy of the
cloud provider.
Most cloud computing contracts allow users "to stop using the service at any time for any
reasons".1 However, they often remain silent on the conditions (e.g. notice) or require a
certain amount to be paid. Providers are also sometimes entitled to stop the service at their
own discretion2 and, in case of “free” services, after a certain period of inactivity without
warning. All these situations trigger a risk for the user to lose certain data stored on the cloud.
User will not be able to retrieve the data because they cannot access them anymore or because the
data has been deleted.
As most cloud contracts which are offered to consumers and small businesses are not
negotiable, users depend on the contractual switching rights and modalities provided by the
respective cloud provider. Small firms are particularly vulnerable when switching from one
provider to another. They need to ensure their business continuity and respect their legal
obligations (e.g. tax obligations). Consumers and small firms will therefore want to know
what will happen to their data when switching.
The concerns regarding data transfer and data deletion are not only limited to switching. They
exist for each scenario in which the relationship between the cloud provider and the user
comes to an end. The current practice may create a lack of trust towards cloud computing
services and slow down the up-take of such services.
For providers, the preservation and transfer of the data or its complete deletion imply costs.
This is particularly true when the data to be transferred/deleted not only include the initial
data up-loaded by the consumer or the small firm in the cloud but also the metadata (structure
of the data). Cloud computing providers are therefore reluctant to automatically cover such
costs which may have a direct impact on the cloud computing service prices. This is
particularly true when they offer cloud computing capacity for “free” or when the relationship
1
For instance, "You may terminate your account at any time, for any reason, by following the instructions on the
Site and discontinuing use of the Products.", " 16.2 Termination for Convenience. Customer may terminate the
MSA for convenience at any time as provided in Section 4.1 through the Customer Portal." And " You may
terminate the Services associated with your [X] account at any time and for any reason by going to your
Account webpage
2
Termination – X may at any time, under certain circumstances and without prior notice, immediately terminate
or suspend all or a portion of your Account and/or access to the Service. Cause for such termination shall
include: (a) violations of this Agreement or any other policies or guidelines that are referenced herein and/or
posted on the Service; (b) a request by you to cancel or terminate your Account; (c) a request and/or order from
law enforcement, a judicial body, or other government agency; (d) where provision of the Service to you is or
may become unlawful; (e) unexpected technical or security issues or problems; (f) your participation in
fraudulent or illegal activities; or (g) failure to pay any fees owed by you in relation to the Service. Any such
termination or suspension shall be made by Apple in its sole discretion and X will not be responsible to you or
any third party for any damages that may result or arise out of such termination or suspension of your Account
and/or access to the Service.
1
with the customer comes to an end because the user has breached one of his contractual
obligations. Helping consumers and small firms to preserve and transfer their data is often
seen as an extra service offered for a fee to users in addition to the cloud service itself.
National rules that may apply to cloud computing contracts (e.g. rules on services contracts or
lease contracts) may contain default rules on the conditions of termination (e.g. rules on
notice of termination) but they do not contain specific requirements of what needs to be done
with the data stored in the cloud after the end of the contract. While in the area of personal
data, the cloud provider has at least an obligation not to process the data longer than necessary
for the purpose of which it was obtained3, there are no general clear-cut obligations for a
cloud provider to return the data to the cloud user or to delete non-personal data.
In order to encourage the up-take of cloud computing service, consumers and small firms
should be confident on what will happen to their data when the relationship with the cloud
provider comes to an end. At the same time, cloud providers should not be overburdened with
unnecessary obligations that may impact in a sizeable way on cloud computing services
prices.
Preservation of the data
Practices vary considerably regarding the preservation of the data following the end of the
relationship between the cloud provider and the user. Some providers will retain the data of
the user after termination of the contract. The delay of the retention period generally varies
(often 30 days4). Some providers allocate a “reasonable period of time”5. During that period
users will still be able to access the service and retrieve the data. However, if the user has
breached one of his contractual obligations (e.g. non-payment of fees, no respect of the
Authorised Use Policy) cloud providers will generally stop the service immediately without
notice6. Users will not be able to access the service to retrieve their data. Other providers will
stop the service and erase the data immediately after termination7.
3
This means that the data will have to be deleted or rendered unintelligible after the termination of the contract.
If after termination of the contract, the cloud provider store the data without the customer's consent, they risk
being liable under data protection rules. See Article 6 (1) (e) of Directive 95/46/EC of the European Parliament
and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal
data and on the free movement of such data (OJ L 0281).
4
Termination 12.5. Your Data Portability and Deletion. Upon request by You made within 30 days after the
effective date of termination or expiration of this Agreement, We will make the Your Data available to You for
export or download as provided in the Documentation. After that 30-day period, We will have no obligation to
maintain or provide Your Data, and will thereafter delete or destroy all copies of Your Data in Our systems or
otherwise in Our possession or control as provided in the Documentation, unless legally prohibited.
5
Termination 11.5 Effects of Termination. If this Agreement (including all Order Pages) terminates, then: (i) the
rights granted by one party to the other will cease immediately; (ii) X will provide Customer access to, and the
ability to export, the Customer Data for a commercially reasonable period of time atX’s then-current rates for
the applicable Services; (iii) after a commercially reasonable period of time, X will delete Customer Data by
removing pointers to it on X’s active and replication servers and overwriting it over time; and (iv) upon request
each party will promptly use reasonable endeavours to return or destroy all other Confidential Information of the
other party.
6
Termination (X for business agreement)- You're free to stop using our Services at any time. We also reserve the
right to suspend or end the Services at any time at our discretion and without notice. For example, we may
suspend or terminate your use of the Services if you're not complying with these Terms, or use the Services in a
2
Cloud providers should allocate a sufficient period of time to users to retrieve their data. Even
in case of breach of his obligation by the cloud user, the immediate end of the service may be
considered disproportionate. The provider should give advance notice to the user that the
service will come to an end to enable users to retrieve their data. In case of a free service, the
cloud provider should also give advance notice to users that the service will end after they
have not used it for a certain period in order to enable them to retrieve their data.
Nature and format of the data to be transferred
Users want to be able to retrieve their data in a format that they can re-use. Therefore, they
need to retrieve not only the data that they have initially stored in the cloud but also the
metadata. Very few contracts guarantee the portability of the data at all and even if they do
they remain silent on its technical aspects.8 They do not clarify which data (i.e. whether both
data and metadata are included) users will be able to retrieve at the end of the contract and
what would be the format. As technology evolves quickly it may not always be easy to define
at the time of the signature of the contract what will be the adequate format to transfer the
data at the time of termination. The parties may not know at the time of the signature of the
contract what would be the need of the user at the time of termination.
In the absence of an obligation to guarantee the portability of the data, cloud providers should
clarify in the contract if they guarantee portability or not. If the cloud provider does not
guarantee portability they could clarify in the contract which data users will be able to retrieve
and in which format. As it is not always possible to foresee at the time of signature of the
contract what will be the format needed by the user at the time of termination, the provider
could clarify in the contract that the user will be able to retrieve the data in a “commonly
used” format.
Cooperation between cloud providers for the transfer of the data
Contracts generally do not foresee the obligation for the cloud provider to cooperate with a
new cloud provider in case of switching. Recently, a French court has used the principle of
manner that would cause us legal liability, disrupt the Services or disrupt others' use of the Services. Except for
Paid Accounts, we reserve the right to terminate and delete your account if you haven't accessed our Services for
12 consecutive months. We'll of course provide you with notice via the email address associated with your
account before we do so.
7
Termination (X master service agreement) 16.4 Access to Customer Content. The deletion of Customer
Content is automatic upon termination or expiration of the MSA. Consequently, unless X determines otherwise,
Customer will not have access to Customer Content, and X may immediately erase or delete Customer Content
from its computer infrastructure after the effective date of termination or expiration of this MSA.
8
An example where content cannot be transferred: "What happens if my Services are cancelled or terminated?
(…..) If any your Services are cancelled or terminated, or if your X account is closed, we will delete information
or Content associated with your Microsoft account or will otherwise disassociate it from you and your X
account. We are under no obligation to return Content to you. (4.4)". And an example where content can be
retrieved by the user: X will provide Customer access to, and the ability to export, the Customer Data for a
commercially reasonable period of time X’s then-current rates for the applicable Services; (iii) after a
commercially reasonable period of time, X will delete Customer Data by removing pointers to it on X’s active
and replication servers and overwriting it over time; and (iv) upon request each party will promptly use
reasonable endeavours to return or destroy all other Confidential Information of the other party.
3
good faith to impose an obligation upon a service provider to help its customer transfer data to
a new service provider9.
Costs
Switching may imply important costs linked to the transfer of the data. These costs may
greatly depend on the nature (e.g. personal data, metadata, non-personal data) and the format
of the data to be transferred (e.g. a simple copy or a full migration of all the data). Full
deletion of the data from the initial cloud service provider's infrastructure platform or
software may also be quite expensive. It seems practice that it is for the user to retrieve his
data when the relationship comes to an end. The cost for deletion seems to be on the cloud
provider.
A distinction could be made whether the decision to switch by the end user is taken at their
own initiative or depends on facts that are independent of their sphere of influence (e.g. the
bankruptcy of the cloud provider, the modification of the contract by the provider). When the
decision to switch is due to facts that are outside the user’s sphere of influence, the latter
should as a matter of principle not bear costs to retrieve their data. On the other hand, a
decision of the user to switch before the end of the contract for mere convenience (e.g. a
better offer on the market) may justify that the user bears the costs linked to switching. For
example, when the contract has been signed for a certain duration and the user decides to
switch before the end of the term the former cloud provider could for example retain the fees
already paid and claim all or some of the fees which are to fall due under the remainder of the
contract. The amount of fees that could be retained should be proportionate to the duration of
the contract. In case of a contract for a very short duration (e.g. for 1 month contract), the
cloud provider could be entitled to retain the entire fee until the end of the contract. In case of
a longer contract, the cloud provider should be able to retain the fees until the end of the
contract up to a certain amount (e.g. 3 months fees).
A second element that could be taken into account is whether the cloud computing service is
offered for “free” or not. In case of “free” services, the cloud service provider should not have
to support the cost of transferring back all the data (e.g. giving back all the messages
exchanged on an email platform), in particular if the service has not been used for a certain
period of time.
9
Tribunal de Grande Instance de Nanterre, 30 Novembre 2012
4