Cloud Computing and the Public SectorRisks and Rewards

John O’Connor, Partner - Head of Technology & Commercial Contracts

INTRODUCTION

Public Sector Outsourcing

UK (Varney Report), US, Australia and others

Ireland has not undertaken any large outsourcing deals

Reform and transformation of public sector

OPPORTUNITIES IN THE CLOUD

OPPORTUNITIES IN THE CLOUD

Cloud Computing Defined?

“A bundle of traditional IT services using the Internet or “Cloud” as the delivery channel”

Services: storage, database capabilities; Platform: application development in a multi-tenant environment; Software: turnkey applications delivered online; Infrastructure: delivery of computer infrastructure and related

managed services.

OPPORTUNITIES IN THE CLOUD cont’d..

Public Cloud, Private Cloud (also hybrid models)

US – Federal Cloud Computing Strategy - Feb 2011

UK - ICT Strategy - G cloud – March 2011

Common features include: Private or hybrid model with trusted public clouds Data to be hosted on shore in home country Compliance with laws and regulations Minimum standards and levels of service Data control, data security and data access guarantees

RISKS IN THE CLOUD

RISKS IN THE CLOUD

Security, integrity and confidentiality of data

Availability of data and systems – readily accessible data

Compliance with laws and regulations Data Protection Laws (data processing, security and location of data) Statutory duty and some laws unique to the Public Sector Ability to audit, monitor compliance

Compliance with contracts with third parties

Service failure

Poorly written and/or very one sided contract with cloud provider

RISKS IN THE CLOUD cont’d …

Principal contractual/legal issues Limitations and Exclusions of Liability (i.e. disclaimers) Choice of Law and Jurisdiction Data Protection other applicable laws and regulations Strength and specifics of obligations including SLAs / KPIs Ability to termination for persistent or material breach Ability to migrate data on termination – avoiding lock-in Ability to audit/monitor service delivery, security and integrity of

data Scope and detail of force majeure, down-time

RISK MITIGATION

RISK MITIGATION

Risks can be managed, mitigated commercially and legally

But, there is a trade-off

Contract should be carefully reviewed commercially and legally

Conclusion