Social media sites are transforming not only the daily lives of consumers, but also how companies interact with consumers. Here at Morrison Foerster, across all of our practice groups, we are seeing complex, cutting-edge legal issues arising out of social media. As with the Internet boom during the mid-to-late 1990s, social media is generating new legal questions at a far faster pace than the law’s ability to provide answers to such questions. In an effort to stay on top of these emerging issues, and to keep our clients and friends informed of new developments, Morrison Foerster publishes this blog devoted to the law and business of social media.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

sociallyaware-abajournalweb100-1

Aaron is the chair of the firm’s Technology Transactions Group and co-chair of the Interactive + Digital Media Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals.Aaron’s practice focuses on advising both established and emerging companies in a variety of data- and technology-intensive sectors, including software, SaaS, cloud-based technology, digital media (social media, AR/VR, gaming, streaming media, AdTech), AI, healthcare, consumer electronics, e-commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on branding and marketing, trademark licensing, and content-related transactions, as well as the intellectual property aspects of mergers, acquisitions, asset spin-offs, and private equity investments.He has represented clients such as Autodesk, Meta, OpenAI, Splunk, Konami, Kaiser Permanente, SoftBank, Visa, and Yahoo, among others.Aaron has been recognized by numerous publications for his work on market-defining technology transactions. He is currently ranked by Chambers USA for “Technology Transactions.”Aaron also serves as co-editor of Socially Aware, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics. Aaron is also a sought-after speaker on new and emerging areas of law, and is a frequent presenter and panelist at conferences and legal services programs. In addition to his active practice, Aaron regularly provides pro bono assistance to various nonprofit and charitable organizations such as Common Sense Media and the Starlight Children’s Foundation. He is a member of the board of directors of California Lawyers for the Arts.While in law school at the University of California, Berkeley, Boalt Hall School of Law, Aaron served as executive editor of the California Law Review and was elected to the Order of the Coif. Following law school, Aaron served as law clerk to the Honorable William H. Orrick and the Honorable Martin J. Jenkins, both United States District Judges for the Northern District of California.

rubin_aaron_blog_150x150.png

rubin_aaron_common_640x280.jpg

rubin_aaron_heroretina_2700x1160.jpg

rubin_aaron_mobileretina_750x1040.jpg

rubin_aaron_social_600x600.jpg

Partner

Aaron is the chair of our Technology Transactions Group. He advises clients on a wide range of complex transactions involving intellectual property and technology, including structuring and negotiating strategic licensing, development, collaboration, procurement, and distribution deals. Aaron’s practice focuses on advising both established and emerging companies in a variety of data– and technology–intensive sectors, including software, SaaS, cloud computing, AR/VR, AI, gaming, healthcare, consumer electronics, social media, e–commerce, other online business models, and mobile applications. He also maintains an active practice counseling companies on the intellectual property aspects of mergers, acquisitions, asset spin–offs, and private equity investments.

Aaron P. Rubin

Lawrence Gallick is of counsel in the firm’s Austin office and a member of the Technology Transactions Group.Lawrence focuses his practice on technology transactions and licensing matters. His diverse experience includes advising on SaaS agreements, cross-licensing agreements, research and collaboration agreements, development agreements, and distribution agreements. He counsels a broad range of companies across the software, hardware, life sciences, biotech and FinTech spaces, as well as other entities including universities.He advises clients in connection with general corporate matters including contract negotiations, and leasing and technology placement agreements.Lawrence also serves as co-editor of <a href="https://www.sociallyawareblog.com/" target="_blank">Socially Aware</a>, the firm’s award-winning newsletter and blog devoted to the law and business of social media, and regularly publishes on various IP and technology-related topics.Prior to joining the firm, Lawrence was counsel at another major law firm. Before earning his law degree, Lawrence was a web consultant, project manager, and web developer in Portland, Oregon, where he managed and consulted on projects using industry methodologies and performed custom development and integration of content management systems.Lawrence was named a Super Lawyers “Rising Star” in 2015 and 2018–2022, and is licensed in both California and New York. Lawrence earned his J.D. from the University at Buffalo School of Law, where he was the electronic systems editor for the Buffalo Law Review and awarded the ABA-BNA Award for Excellence in the Study of Intellectual Property Law.

gallick_lawrence_blog_150x150.png

gallick_lawrence_common_640x280.jpg

gallick_lawrence_heroretina_2700x1160.jpg

gallick_lawrence_mobileretina_750x1040.jpg

gallick_lawrence_social_600x600.jpg

Of Counsel

Lawrence Gallick

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster.Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions. His clients include technology, digital media and content for television and music, financial services, and communications companies with diverse intellectual property assets and issues.His practice focuses on the legal aspects of developing, licensing, and commercializing technology and intellectual property, as well as negotiating general commercial contracts, including outsourcing transactions, as well as content and data licenses. He regularly assists clients with legal issues relating to licensing and commercialization of digital media and content, digital content that is distributed over the Internet or streamed, mobile applications and social media, as well as the licensing of recorded music for distribution via digital platforms. Anthony is also experienced with issues relating to open-source software, software development, artificial intelligence and machine learning, cloud-based technology, and protection of proprietary information.Anthony has extensive experience working on matters involving disruptive technologies, such as blockchain. He has helped fintech clients with general intellectual property issues in connection with terms of service for online financial products and services.Anthony is an integral part of the outside pro bono legal team for nonprofit organizations based in New York, including advising clients on legal issues regarding entertainment, social media, privacy rights, and the negotiation of outsourcing and service agreements. Anthony received his J.D. from the University of Michigan Law School in 2009. He received his B.S. from Cornell University in 2004.

ramirez_anthony_blog_150x150.png

ramirez_anthony_common_640x280.jpg

ramirez_anthony_heroretina_2700x1160.jpg

ramirez_anthony_mobileretina_750x1040.jpg

ramirez_anthony_social_600x600.jpg

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. He advises clients on general commercial and transactional matters. His clients include technology, media, and communications companies with considerable intellectual property assets. His practice focuses on the legal aspects of licensing and commercializing technology and intellectual property, as well as negotiating general commercial contracts. He also regularly assists clients with legal issues relating to mobile applications and social media.

Anthony M. Ramirez

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

Welcome to Socially Aware

240920-socially-aware-header.jpg

Welcome to Socially Aware

240920-socially-aware-header

Socially Aware is devoted to the law and business of social media, proactively addressing emerging issues and keeping our clients informed of new developments. We cover fields such as artificial intelligence, privacy and data security, Section 230, intellectual property, and much more.

News and Announcements

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides a data-driven look at the Federal Circuit.

Federal Circuitry

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Mofo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

Government Contracts Insights

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

MoFo’s Socially Aware blog provides timely updates and analysis of the many complex and cutting-edge legal and business issues arising out of social media.

Socially Aware

  Linkedin

MoFo LinkedIN

Socially Aware Blog - RSS

Stay Connected

Never miss a post from Socially Aware. Enter your email below to stay up-to-date.

Subscribe

The Law and Business of Social Media

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Web Scraping

Advertising

Antitrust

Arbitration

Artificial Intelligence

Asia

Autonomous Vehicles

Bankruptcy

Big Data

Blockchain

Class Actions

Cloud Computing

Compliance

Contracts

COPPA

Copyright

Crowdsourcing

Cyberbullying

Cybersecurity

Data Security

Defamation

Digital Content

Disappearing Content

Discovery

DMCA

E-Commerce

E-Discovery

E-Personation

Electronic Contracts

Employment Law

Endorsement Guides

Ephemeral Messaging

Ethics

European Union

Event

Fair Use

FDA Regulations

Financial Institutions

First Amendment

Fraud

Free Speech

GDPR

Hacking

Influencer Marketing

Infographic

Internet of Things

Investment Management Law

JOBS Act

Labor Law

Litigation

Live streaming

Marketing

Mobile

Online Contracts

Online Endorsements

Online Promotions

Online Reviews

Patent

Privacy

Product Liability

Protected Speech

Right of Publicity

Right To Be Forgotten

Section 230 Safe Harbor

Securities Law

Social Media Policy

Statistics

Status Updates

Stored Communications Act

Supreme Court

Terms of Use

Trademark

UK High Court

User-Generated Content

Wearable Computers

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

Lawrence W. Gallick

2024 Recap: Ten Lords A-Leaping!

Social Links: If the Suit Fits

Social Links: Age Verification, X Appeal, and the Great White North

Social Links: Fake Reviews, Real Rulings, and an Epic Fail

Lawrence W. Gallick on Toth v. Everly Well, Inc.

IBM has been receiving rave reviews in the media for simplifying its Cloud Services Agreement to a mere two pages in length. And yes, the Agreement also boasts healthy margins and a normal font. But does the Agreement’s reasonable length equate to reasonable terms?After all, from a customer’s perspective, shorter doesn’t necessarily mean better.Certainly IBM’s new Agreement was designed to reduce negotiation. According to the International Association for Contract & Commercial Management, which declared IBM a finalist for an <a href="https://www.iaccm.com/resources/?id=8288" target="_blank" rel="noopener">award</a> because of the Agreement’s simplified approach, IBM has competitively benchmarked the terms of the new Agreement and IBM apparently feels that the terms will meet the business requirements of most enterprise clients.Indeed, of the customers presented with IBM’s new Agreement, 80 percent have reportedly signed it without negotiation. The remaining 20 percent, however, still chose to treat the new Agreement – simplified or not – as merely IBM’s opening draft.Upon review of the new agreement, it becomes clear why these why these “20 percenters” chose to negotiate.For example, the first section of the Agreement is entitled Service Performance and Commitments, but the 208 words of the section contain little in the way of actual commitments; the Cloud Services are merely “designed” to be available 24/7, and while IBM agrees to provide notice of scheduled maintenance, there are no limits on the timing or duration of such maintenance.Customers must also review the Service Description — in a separate document — to determine what, if any, license rights, data security obligations, service levels and renewal options will apply to the Agreement.At times, the Agreement does provide terms that a customer will want to see — such as an indemnity against third-party patent and copyright claims — but the value of these terms is often limited. (Even in the shortest contract, the devil is still in the details.)Customers must also be careful not to skip over short statements with potentially broad implications. For example, while IBM does not ask the customer to expressly indemnify IBM, the Agreement does contain a very short — and very vague — statement making the customer “responsible for” any “violation of law or any third party rights caused by” by the customer’s content uploaded to the service or other use of the service. Could this statement require that a customer indemnify IBM for claims arising from any such violation? If so, the customer’s liability for such third-party claims could be unlimited, because the Agreement’s limitation-of-liability provision protects only IBM, not the customer.Service providers are often urged to keep an agreement as “short and simple” as possible, and this is unquestionably an important goal that will help to reduce costs for both parties. At the same time, anyone reviewing such an agreement should bear in mind that it may have been “shortened and simplified” by the omission of key legal protections.Ultimately, an informed customer wants an agreement that is short, simple and sweet.

Anthony Ramirez is a partner in the Technology Transactions Group in the New York office of Morrison Foerster. Anthony advises clients on general commercial and transactional matters. He regularly advises companies on the IP aspects of their M&A transactions.











Anthony Ramirez

contact-300x206-1.jpg

Shorter and Simpler, Yes – But Is IBM’s New Cloud Services Agreement Any Sweeter?

Shorter and Simpler, Yes – But Is IBM’s New Cloud Services Agreement Any Sweeter?

IBM has been receiving rave reviews in the media for simplifying its Cloud Services Agreement to a mere two pages in length. And yes, the Agreement also boasts 

From our sister blog, <a href="http://www.mofotechblog.com/2014/12/16/post-wisely/#more-2210" target="_blank" rel="noopener">MoFo Tech</a>:Two FDA Guidelines Help Life Sciences Companies Solve Social Media ConundrumsSocial media presents new challenges for life sciences companies. Companies that post about their products on space-constrained social media platforms such as Twitter or Facebook don’t have the luxury of a full page or a long voiceover listing risks or side effects. And it’s unclear how to respond to misleading information about products posted online by third parties. In June, the Food and Drug Administration produced two much-anticipated draft documents that provide some guidance in each case.The “Twitter Guidance”“Internet/Social Media Platforms with Character Space Limitations— Presenting Risk and Benefit Information for Prescription Drugs and Medical Devices” (found at http://1.usa.gov/1kGYdgK) specifies that a brand should, within the post:<ul><li>Include the brand and established name, dosage form, and ingredient information</li><li>Accompany benefit with risk information</li><li>Provide a link to a page devoted “exclusively” to risk information.</li></ul>If both benefit and risk information can’t be included in the limited space, the company should consider using a different platform, the FDA advises. “The Twitter Guidance provides a fictional example to show that it’s not impossible to produce an acceptable tweet. But it is very difficult,” says Erin M. Bosman, chair of the Product Liability Practice Group at Morrison & Foerster. Companies that go the Twitter route may want to focus on products with only a few risks or risks that are easy to understand, she says.Correcting third-party MisinformationThis guidance, called “Internet/Social Media Platforms: Correcting Independent Third-Party Misinformation About Prescription Drugs and Medical Devices.”“Companies can breathe a sigh of relief with this guidance because it says companies are not obliged to correct third-party information,” Bosman says. “This reduces the need to monitor and mine massive quantities of Internet data about their products.”The FDA suggests guidelines for voluntary correction of third-party misinformation, such as posting the correction in the same area or forum where the misinformation is found, when possible. Bosman suggests that companies should have “a standard policy about the type of information to correct. For example, misinformation that presents serious health risks should be a higher priority than correcting more innocuous misinformation.” She also recommends formulating a standard response for correcting common misinformation in order to ensure accuracy and consistency.

Post Wisely

From our sister blog, MoFo Tech: Two FDA Guidelines Help Life Sciences Companies Solve Social Media Conundrums Social media presents new challenges for life sci

Post Wisely

Advergames are online video games that are created in order to promote a brand, product or organization by immersing a marketing message within the game. They are typically accessed via an organization’s website or app, or via a social media platform. Advergames are not particularly new. The concept of advertising via gaming has been around since the 1980s and the term advergame was included in Wired magazine’s Jargon Watch column back in 2001. In the early days of the advergame, though, the medium was generally embraced by brands that targeted the youth market.  These days, the growth of tablets, smartphones and mobile apps, as well as the rise in popularity of online gaming, has led to the increased adoption of advergames by a wide variety of organizations, including charities, financial services firms, car manufacturers, toy makers and government agencies.Given the increased challenges of traditional advertising, advergames are considered a great way to help increase brand awareness and engagement—whether an organization is promoting a new product, educating, trying to grow its market, carrying out market research, or reaching out to prospective recruits. A key benefit of advergames is that users interact with a brand for far longer than they would with traditional forms of advertising. The best advergames can go viral and provide worldwide exposure and a shelf-life much longer than that of a traditional advert. For example, in 2013 Chipotle, the Mexican fast food chain, published a <a href="http://venturebeat.com/2013/09/30/chipotle-scarecrow-is-the-future-of-advergaming-on-mobile/" target="_blank" rel="noopener">Scarecrow advergame </a>that was downloaded 250,000 times within four days of its release.In this post, we will consider some of the legal issues that organizations operating in the UK will need to consider when employing advergames as a marketing tool.Advertising RulesThe first issue that an organization will need to consider is compliance with applicable advertising rules, as advergames are very likely to be regarded as advertising. That’s certainly the case in the UK.In May 2012, the Advertising Standards Agency (ASA), the UK’s independent regulator of advertising, published guidance on the use of advergames. In the guidance, the ASA made clear that advergames in paid-for space online are covered by the relevant rules of the UK Code of Non-broadcast Advertising, Sales Promotion and Direct Marketing (<a href="https://www.asa.org.uk/codes-and-rulings/advertising-codes.html" target="_blank" rel="noopener">the CAP Code</a>). In addition, advergames that are made available on an organization’s website or app or via a social media platform under the organization’s control, and that are directly connected with the supply or transfer of goods, services, opportunities or gifts, must comply with the CAP Code.Particular issues arise when advergames are considered appealing to children. The CAP Code includes an overarching principle that marketers must be careful when addressing children in marketing, and must bear in mind that children’s understanding of, and reaction to, marketing communications will be affected by their age and experience, and the context in which the message is delivered. The CAP Code also requires that advertisements be obviously identifiable as such. When deciding whether an advergame complies with this rule, the ASA will consider the context in which the advergame is made available; any references to the product, brand or organisation in or around the game; and the target audience.To date, many of the complaints made to ASA about advergames concern their use by food manufacturers to promote foods perceived to be unhealthy. Under Rule 15.11 of the CAP Code, advertisements must not condone or encourage poor nutritional habits or an unhealthy lifestyle in children. In addition, Rule 15.15 states that, in general, food advertisements that are targeted directly at pre-school or primary school children must not include licensed characters or celebrities popular with children.By way of example, in 2012, the ASA considered a Krave cereal advergame made available to Facebook users who had, via their Facebook profile information, confirmed themselves to be aged 16 or over.  The advergame featured a character, the Krave Krusader, which players controlled in order to collect chocolate and score points. The complainant considered that the advergame encouraged poor nutritional habits and an unhealthy lifestyle in children in breach of the CAP Code. However, the ASA rejected the complaint, precisely because the advergame was targeted at Facebook users over the age of 16.In the same year, the <a href="http://asa.org.uk/Rulings/Adjudications/2012/8/Swizzels-Matlow-Ltd/SHP_ADJ_196069.aspx" target="_blank" rel="noopener">ASA considered</a> advergames published on the website of a confectionary manufacturer, www.swizzels-matlow.com. It held that a “Cola Capers” game that was (i) relatively long in duration, (ii) aimed at young children, and (iii) condoned eating a large number of sweets while hiding such consumption from the user’s parents irresponsibly encouraged poor nutritional habits and an unhealthy lifestyle in children. In addition, it held that certain games involving the character Scooby Doo were aimed at primary-school children and therefore in breach of the CAP Code.It only takes one complaint for the ASA to investigate an advergame, and if the ASA upholds the complaint, the offending advertisement is very likely to be banned. As the ASA is a non-statutory body it does not have the power to fine advertisers or take advertisers to court.However, some parties want more action. In March 2014, the UK’s Local Government Association (LGA), which represents almost 400 councils in England and Wales, called for pop-up health warnings to accompany “addictive” advergames used by food firms “targeted at children.” The <a href="http://www.asa.org.uk/News-resources/Media-Centre/2014/Food-advertising-and-children-Making-sure-we-have-a-healthy-debate-part-2.aspx" target="_blank" rel="noopener">ASA responded</a> to this call by making reference to its recent bans and stating that it would not hesitate to ban any other advergames that breached the CAP Code. However, in May 2014, the University of Bath’s Institute for Policy Research issued a policy brief, Advergames: It’s not child’s play, looking at the use by food firms of advergames to promote high-salt, high-sugar and high-fat food and drink products. The brief concluded that children up to the age of 15 do not recognize that advergames are advertising, and called for various actions, including an obligatory, clear, uniform labelling system for all children’s advergames. So, as you can see, this issue is not going away.Other IssuesIt’s not just a question of advertising rules. Some of the other key issues advertisers will need to consider when launching an advergame include:<ul><li>Terms of use for the advergame</li><li>Privacy and data protection laws</li><li>Consumer protection rules</li><li>Industry regulations affecting advertisements and promotions</li><li>App store rules and restrictions</li><li>Prize promotion rules</li><li>Intellectual property rights in the advergame</li><li>Ownership of data</li><li>Contracts with third-party providers (e.g., the game developer)</li></ul>ConclusionAdvergames are a fun, interactive marketing tool. However, it’s important to comply with all applicable rules to make sure that your advergame doesn’t give you publicity for all of the wrong reasons.

3478925590_d8a102f299_o-300x198-1.jpg

What Are the Rules of the Advergame in the UK?

What Are the Rules of the Advergame in the UK?

Advergames are online video games that are created in order to promote a brand, product or organization by immersing a marketing message within the game. They a

The cloud computing market is evolving rapidly. New as a service (aaS) platforms are appearing and the dichotomy between public and private cloud domains has been fractured into many different shades of hybrid cloud alternatives. And while many of the key issues – privacy risk, data location, service commitment – remain the same, service providers’ commercial offerings are becoming more flexible.Over the past 18 months, we have even started to see changes in the “take it or leave it” approach to cloud contracts. Negotiations of cloud contracts have started to occur. But at this stage in cloud computing’s evolution, even more so than for traditional ICT contracting, the key is to know what can be negotiated and how much.Cloud MarketThe global cloud computing market is reportedly worth approximately $157 billion in 2014, and is expected to reach $290 billion by 2018. The market is growing at an annual rate of almost 50%. North America continues to represent the largest share of the global cloud market with over 50% of the market, followed by the EMEA region with approximately 29%.Software as a service (SaaS) is still the biggest sell, followed by infrastructure as a service (IaaS) and platform as a service (PaaS). The Big 3 aaS cloud offerings represent 90% of the global cloud market according to a recent survey.Flexibility and cost savings are still the main drivers for customers selecting cloud services – while security and privacy remain the top concerns. Interestingly, some customers are starting to consider cloud offerings as a means of improving the security of their data, taking the view that leading cloud providers have more expertise in protecting data and are able to invest more heavily in evolving technologies.As the cloud market continues to grow in volume terms, the diversity of the market offerings is also increasing.  There is more competition than ever before in most of the main cloud market segments, with well-publicized price cuts, more service offerings and many, if not most, software providers examining ways to move into service-based offerings. Traditional market leaders, such as Microsoft and IBM, experience year-on-year growth. Reputation and cost are the key factors in cloud vendor selection, followed by performance assurance related issues.In general, most large cloud providers are showing a renewed focus on multinational clients and also want to move up the value chain and target larger institutional clients. Outsourcing arrangements now increasingly encompass a cloud computing element, and some cloud providers are prepared to offer managed services to mimic elements of so-called “traditional” outsourcing.Genuine adoption by regulated entities, especially financial services institutions, is the next big target; although the take-up is not helped by the reticence of regulators in some key global markets (with the notable exception of the United States) to provide a road map to assist regulated entities’ engagement of the cloud model.  Nevertheless, reticence to adopt a multi-tenanted cloud solution in regulated sectors is being eroded by the availability of aaS models available through virtual private cloud services and dedicated servers.Cloud ContractsIt remains axiomatic that contracts for cloud computing services are generally implemented on the provider’s terms. Even projecting forward at the current rate of evolution, it is hard to see that core principle changing.  However, contract terms are increasingly negotiable to some extent; although the degree of negotiability pales in comparison with the contracting model in traditional services-based outsourcing.In our experience there continues to be a (resigned) acceptance from most customers of the providers’ terms, i.e., the terms are what they are, and there’s a general recognition that that is the place to start. After all, if a customer organization expects customization of services and a genuine negotiation of service terms, then maybe the cloud is not the right place to be considered as a solution for those specific services.Nevertheless, we have experienced greater negotiability compared to 18 months ago, and we anticipate that trend continuing in the future. The contracting areas where we perceive the most scope for negotiation tend to be commercially oriented issues such as price, privacy and security, scope and service levels, and liability caps. Technical areas, such as the variability of service elements that depend on specific data center features, do not lend themselves to negotiation because the shared service nature of cloud facilities limits the ability of providers to agree on changes in those areas. These are areas where customers often show their naivety of how cloud computing works by asking for changes that directly contradict the commoditized nature of the service offering.  That said, some providers do not help themselves by justifying their refusal of almost every requested change based on the invariability of the technical solution, even when an issue is plainly commercial and not technical.Among the key issues that recur in cloud contract negotiations are:<ul><li>Customer control and visibility over subcontracting: there is a general reluctance of providers to allow approval of, or even to identify, subcontractors.  Often, that can be for very good reasons, especially in a public cloud situation;</li><li>The limitation of the provider’s ability to change the nature of the services provided. Again, there may be very valid reasons for this depending on the nature of the services, but, typically, the negotiation ought to focus on the commercial implications of such changes rather than the basic right itself;</li><li>Privacy and data security commitments by the provider;</li><li>Rights of the provider to suspend services under circumstances such as non-payment or violation of an acceptable use policy;</li><li>Limitation of liability;</li><li>Termination assistance provisions allowing the customer to extend service for a period after termination or expiration to allow migration to the replacement solution; and</li><li>The stretching of some common contracting provisions into some pretty unfamiliar directions. One motto to bear in mind when reviewing cloud terms is “never assume that you know what’s in a provision based on its heading.” Force majeure provisions are a good example. You may have thought that it would be hard to reinvent force majeure, but in some cloud instances force majeure seems to be elastic-sided enough to capture “changes in the taxation basis of services delivered via the Internet” as a force majeure event.</li></ul>Another area where some providers have not helped their industry’s cause is in the proliferation of complex, multi-document contract structures which are often poorly updated and oddly worded. Customers need to wade through the many pieces of paper and URL links, and with a lack of consistency among the documents frustration mounts and patience wears thin. These multi-layered contract structures are unwieldy and often, when quizzed, even the providers’ representatives cannot navigate their way around them. It would be beneficial if the cloud industry generally – and some notable large cloud providers specifically – were to address this contracting approach over the next couple of years.Privacy and SecurityMoFo’s <a href="https://www.mofo.com/capabilities/privacy-data-security" target="_self" rel="noopener">Global Privacy Group</a> has already written extensively about the <a href="http://www.sociallyawareblog.com/2014/10/29/privacy-in-the-cloud-a-legal-framework-for-moving-personal-data-to-the-cloud/" target="_blank" rel="noopener">privacy implications of moving data to the cloud</a>. The conjoined issues of privacy and security remain center stage in most cloud contract negotiations. The key issues generally are who is responsible for data security and how obligations should be allocated between service provider and customer. Importantly, there may be a different analysis between different types of cloud services, e.g., between IaaS and SaaS for example. But it is worth understanding the exact commercial and legal implications of a provider that commits only to be responsible for the “security of our network” and expects its customer to be responsible for the “security of its data.”Typically, of course, providers are more willing to take responsibility for the integrity of their networks, while attempting to steer clear of obligations in relation to data. However, some service providers now accept that a failure to improve their privacy offerings may compromise future growth in certain markets and be a competitive disadvantage.So, for example, there is an increased willingness to adopt the EU model clauses for data transfer, and most of the large cloud providers are reacting to commercial pressures from Europe-based clients to offer services from ring-fenced European data centers. Despite this, there is still a lack of appreciation among many customers of the difference between commitments in relation to data “at rest” (i.e., where the data are stored) and where data can be accessed from.PerformanceIn general, most cloud contracts are still relatively light in terms of service level commitments, with availability being the main measurement metric. There is no sign yet of widespread (or, indeed, early stage) acceptance of the EU’s standardized SLA suggestions.In terms of remedies for service failure, the concept of providing credit via further services or contract extension is still prevalent despite the illogicality (from a customer perspective) of accepting more of the same as a service remedy.ConclusionThe old maxim “Be careful what you wish for” applies to the cloud market at this stage of development. Many commercial users of cloud services have chafed at the “take it or leave it” approach to cloud contracts. But, now that some degree of negotiation is becoming possible in some areas of the cloud market, it is clear that users need to understand more than ever what can realistically be negotiated.At the same time, users need to clearly distinguish their reasons for adopting cloud solutions in the first place and understand the specific sector of the market that they are seeking to access. If users perceive the risks to be so great that contract negotiation seems essential before putting services in the cloud, it is possible that they need to consider whether the services that they have in mind properly belong there in the first place.In general, customers need to approach cloud computing transactions with realistic expectations. It is unrealistic to expect to re-negotiate a provider’s cloud contract terms materially on a project with a relatively low cost/value.  Providers are either technically constricted or simply commercially unwilling to devote expensive commercial management time or legal resources to negotiate the terms of a project with a relatively low margin or revenue generation.

Autodesk

HM Revenue and Customs

Home Office, Department for Communities and Local Government, Department of Health

Intel

ITworx

lastminute.com

NYSE-listed health tech company

One of UK's largest public EV charging networks

Phoenix Group

Telenor

UK Border Agency

maughan_alistair_blog_150x150.png

maughan_alistair_common_640x280.jpg

maughan_alistair_heroretina_2700x1160.jpg

maughan_alistair_mobileretina_750x1040.jpg

maughan_alistair_social_600x600.jpg

Alistair Maughan co-leads Morrison & Foerster's European Technology & Commercial Practice.

Alistair Maughan

Alistair advises on the deployment of new technology platforms involving, for example, the internet of things, AI and machine-learning, and blockchain and distributed ledger technology.

4403695523_7e7993cc0d_o1-300x225-1.jpg

Negotiating Cloud Contracts

Negotiating Cloud Contracts