The proposals include an individual’s right to be forgotten under which individuals will be able to delete uploaded personal information if there is no legitimate grounds to retain it. There is also an emphasis that consumers must give their express consent for their data to be share. In general, the proposals require explicit consent from the consumer.

Companies that deal with personal identifiable information from EU citizens need to revisit their privacy policies and determine if they need to be strengthened. Companies should also consider the U.S.-EU Safe Harbor Framework to ensure that their privacy policies comply with the EU Privacy Directive. The proposals will be passed on to the European Parliament and EU member states, and will take effect two years after they are adopted.

Companies that have not operated a social media website will need to familiarize themselves with the laws that are unique to these types of websites.  Two bodies of law unique to social media websites are the Digital Millennium Copyright Act and the Communications Decency Act.  Companies will have to develop sound Terms and Conditions of Use agreements to address the new functionality of their social media websites.  Additionally, companies will need to consider whether to house their new social meda website on their premises or in the cloud.  I was recently interviewed by Finance and Commerce on cloud computing and how to integrate it into a company’s IT planning for 2012.  You can read the article here. Operating a social media website requires much more involvement by a company, but it is generally better to ride a trend that to buck it.

It also means that businesses and consumers will have to become more familiar with service level agreements and how these agreements differ from traditional software licenses.  It will also require businesses and consumers to understand how to work with cloud providers and structure their relationships.  I have posted several times on the differences these cloud relationships have to the traditional relationships with software developers. 

One thing end users of cloud computing services need to become more comfortable with is negotiating fair and balanced agreements.  End users need to have the resolve to walk away from a cloud provider if that provider is unwilling to negotiate the terms of a service level agreement.  Unfortunately, given the low price of most cloud computing services, this is the only leverage an end user has.  But being pressured into an agreement is usually a red flag and an early indication of what any future dealings with the cloud provider will be like.  But like negotiating the price of a car, there will be another cloud provider that will be willing to accommodate your concerns.

When you scale down, data is left on the server that is no longer in use. What happens to this data? I have not encountered a service level agreement from a cloud provider that addresses this issue. Arguably, the data belongs to the cloud provider since it is the owner of the server. However, this data should remain the property of the customer. As the customer, you should negotiate in the service level agreement that when you scale down the cloud provider will send you any data residing on the servers that are no longer in use and then reformat the hard drive and re-install the operating system to make sure that all of your data is wiped from the server.

Reputable cloud providers will have gone through an information technology security audit such as SSAE 16 (which has replaced the SAS 70), but has your company done the same? The fact is that a company’s data may actually be more vulnerable to a breach than if it was stored in the cloud. After all, data security is ancillary to the business of most companies whereas it is part and parcel to most cloud computing businesses.

More importantly, even if a company is confident that its internal data security measures would pass a SSAE 16 audit, the chances are that your employees are using less secure cloud computing resources without your knowledge. For example, many people use Dropbox or Google Docs store files, sometimes sensitive files, so they are accessible by others or from a location away from the office. These cloud computing options may be less secure than the company’s security measures.

Like the social media policies that most companies have adopted, companies should consider adopting cloud computing policies as well. These policies should include, among others, lists of approved providers, a process for approving new providers, and guidelines governing what information may be used with a cloud computing vendor. An ounce of prevention is always worth a pound of cure.

Microsoft’s move is not surprising given that business is routinely conducted on a global scope, but it is somewhat concerning because it means that the Chinese market for cloud computing services is significant enough to attract the attention of big companies like Microsoft.  This also means that if Microsoft wants to launch its cloud computing architecture in China, that China has the infrastructure to support Microsoft’s cloud computing architecture and the consumer demand for it. The infrastructure for cloud computing services is broadband connections and data centers.

Like many other products that are manufactured in China at lower costs, the Chinese cloud computing infrastructure could ultimately cost less that the U.S. cloud computing infrastructure.  If this happens, cloud computing providers may elect to operate their services from China to take advantage of the lower costs and increase profits.  This move would impact U.S. consumers in a number of ways including customer service when there are periods of downtown, access to any data stored in the cloud, and the security of any data stored in the cloud. Just another thing the cloud computing consumer needs to keep its eye on and be aware of when selecting a cloud computing provider.

Over the years, the increase in Internet use and projections for future Internet use caused a boom in the construction of data centers. Data centers house and link the servers and other hardware that form the backbone of the Internet.  And many companies and states want a part of the action. Minnesota, for example, passed a bill during its special session giving tax exempt status to “qualified” data centers. There was a time when the construction of data centers could not keep up with demand, but now the data center space may have reached a peak.  

In key markets for data centers, there are signs that supply is catching up with demand.  For the tenant of data center space or the end user of a cloud computing service this should be a welcome sight.  As supply and demand in the data center space approach equilibrium, prices will fall. As an end user of a cloud computing service, the hope would be that the cloud provider will pass these lower prices on to the end user of its service and most likely this will happen if competition exists for the cloud service. These are all signs of an industry that continues to mature.

This is all good news for consumers.  Competition spurs innovation and better, more cost efficient products.  Although significant issues remain with cloud computing, in particular the data security and data privacy issues, the competition between the major players in the IT industry will hopefully result in fixes for these problems.

Last week at the G-8 summit, French President Nicolas Sarkozy proposed saying goodbye to what has primarily been private governance of the Internet, which is to say that little, if any, governance exists, and proposed welcoming an international governance regime with government at the helm. As one would imagine, the isle is divided on whether government should control a private enterprise and, if so, to what extent should government intervene. Generally, countries have taken differing stances in their approach to such issues as Internet privacy and taxation.

Eric Schmidt, former CEO of Google, said on a panel discussion that “you want to tread lightly on regulating brand new, innovative industries.” He added, “clearly you need some level of regulation for the evil stuff. But I would be careful about over-regulating the Internet,” and that “I cannot imagine any delegate in this conference that would want Internet growth to be significantly slowed by a government that slows it down because of some stupid rule that they put in place.” 

Harmonizing privacy laws is one area of regulation that would be beneficial. Although the United States and European Union created the Safe Harbor Framework to assist U.S. companies to comply with the European Union Privacy Directive, companies doing business globally face a significant expense in ensuring their privacy policies comply with the laws of numerous countries. Governments also need to equip intellectual property owners with the tools necessary to combat online piracy of intellectual property rights. The U.S. IP Protect Act is one such measure that would provide intellectual property owners with such a tool. 

The G-8 summit is unlikely to result in any significant changes to Internet governance. But as the use of networks that are accessible by the Internet continue to grow and more businesses and individuals take advantage of cloud computing services, how the Internet is governed will also continue to grow in importance.

Because the use of cloud computing services is becoming more prolific, as a business that may store customer data in the cloud, it is support to understand what legal responsibilities exist in the event of a data security breach. Forty-six states, the District of Columbia, Puerto Rico and the Virgin Islands have enacted legislation requiring notification of security breaches involving personal information. Only Alabama, Kentucky, New Mexico, and South Dakota do not have security breach laws. Generally, the time for making the required notification is not set in stone, but must be made in the most expedient time possible and without unreasonable delay. If you are storing personal identifiable information of your customers in the cloud, make sure you are familiar with the data security breach notification laws.

But today is not the day to be talking about negative things. After all, it is the royal wedding of Prince William and Kate Middleton. So congratulations to the newly weds!