1. 18 th Annual Canadian IT Law Association Conference Insider View from the EU Expert Group on Cloud Computing Dr Sam De Silva Partner, Head of IT & Outsourcing Group Penningtons Manches LLP, UK Member of EU Expert Group on Cloud Computing Immediate Past Chair – UK Law Society’s Technology & Law Reference Group

2. Outline  European Cloud Computing Strategy – State of Play  EU Expert Group on Cloud Computing Contracts  Cloud Service Level Agreement Standardisation Guidelines

3. European Cloud Computing Strategy – State of Play

4. Objectives of Expert Group on Cloud Computing Contracts  Commission Decision of 18.6.2013 on setting up the Commission Expert Group on Cloud Computing Contracts (ref: 2013/C 174/04)  Identification of safe and fair contract terms for consumers and SMEs  Consideration of best market practices and Data Protection Directive  Improving legal framework for cloud computing contracts for consumers and SMEs in order to strengthen confidence

5.  30 experts across Europe appointed –20 in Ts&Cs work-stream –10 in data protection work-stream  First meeting was held on 19/20 November 2013, completed 6 x 2 day meetings  Key list of topics / issues were discussed (next slides) –Different cloud models (SaaS, IaaS, PaaS) –“Free” versus paid  Policy paper currently being drafted  Further meeting to finalise paper prior to issue and public consultation  No model clauses / contracts at this stage Process

6. Key Topics (1)  Switching – data portability upon switching  Pre-contractual information  Liability due to non compliance with data protection  Data location and data security  Auditing reporting and monitoring  Modifications of the contract  Cloud specific unfair terms  Subcontracting

7. Key Topics (2)  Jurisdiction / applicable law  Availability of the service  Compliance with the provisions of data transfers  Liability for non-performance including remedies / service credits  Data disclosure and integrity  Use and control of content  Consequences and conditions of termination of the contract such as preservation, transfer or erasure of data

8.  Cloud Select Industry Group – Service Level Agreements (C-SIG-SLA)  Over 100 industry participants  Published guidelines in June 2014 available: http://ec.europa.eu/digital-agenda/en/news/cloud- service-level-agreement-standardisation-guidelines  To be tested with users, particularly SMEs  To be discussed with Expert Group on Cloud Computing Contracts  Feeding into efforts of international groups - ISO Cloud Service Level Agreement Standardisation Guidelines (1)

9.  Overview of concepts / definitions  Series of service level objectives –performance –security –data management –personal data protection  Limitations / challenges –guidelines only –recommendations from EU –No clear thresholds Cloud Service Level Agreement Standardisation Guidelines (2)

10. Contact details Dr Sam De Silva Email: sam.desilva@penningtons.co.uk DDI: +44 (0) 1865 813 735 Q & A