* Considerations for using cloud services to store records
At the recent RSA conference an attorney pointed out that cloud services have an impact on e-discovery – the turning over of electronic documents in response to lawsuits.
First, businesses are legally required to keep certain kinds of records and entrusting them to a cloud service provider can muddy that distinction. You could argue that by hiring a third party to store such records, a business is losing control of it and therefore breaking the rules about keeping it.
In a more concrete sense, if the provider messes up and somehow the records are lost or otherwise inaccessible, the business that entrusted them to the cloud is responsible. That could result in more lawsuits than the one for which the records were being subpoenaed, the attorney says.
Even if the data is accessible from the cloud, lawyers could question its integrity. Has it been altered or been open to alteration while in the cloud? While these issues are known in legal circles and even in IT circles, in this attorney’s experience, businesses rarely address these potentially thorny and costly legal issues.
The flip side of this is that records need to be destroyed. Business policies driven by legal counsel often call for the routine deletion of records that are no longer needed and that, from a liability standpoint, ought to be deleted.
Many businesses have been ignoring this advice. “We never delete our data,” one privacy officer said at RSA. “If you use the cloud, you have to start deleting data. I’m not going to leave everything out there forever.”
So as businesses consider using cloud services to store records, they ought to look at it as an opportunity to improve the data retention policies they’ve been operating under.
