Re: Cloud vendor contracts starting to say they own the data you put in their cloud

[Jason Edelstein <jasone () UCHICAGO EDU>]

We see two variants:

1. We don't own your actual data, but we reserve the right to make 
anonymized copies of your data and use them for anything we want, 
including marketing, etc.

2. We own your stuff, thanks for uploading.

We've usually struck clauses of the second type or simply refused to 
sign that contract, where possible. I actually haven't seen one of the 
second type in a while.

For clauses of the first kind, we've had some success modifying 
contracts to restrict this to only allowing anonymized data for support 
or delivery of the contracted goods and services, but many copies 
complain that they don't have a way to opt us out of their Big Data.

In that case, I've been pondering simply saying that any release of 
data, anonymized or not, that ends up being identifiable information is 
considered a breach. Some have bought that, others have not.

Jason Edelstein
IT Risk and Compliance Program Manager
University of Chicago, IT Services
desk: 773 834 3457
security.uchicago.edu / 773 702 CERT

On 9/21/2018 11:10 AM, Grace Lynn Faustino wrote:
> Can Universities add the ownership of data clause to the contract terms?
>
> ~ Grace L. Faustino
>
> Public Key
>
> 7C4F 3117 131E A4AC 3B07 45FC 57E3 1235 59BE DFB4 6075 2ED2 A9DB C847 CBD8
>
> /“Learning is not attained by chance, it must be sought for with ardor 
> and diligence” ~Abigail Adams/
>
> *From: *The EDUCAUSE Security Community Group Listserv 
> <SECURITY () LISTSERV EDUCAUSE EDU> on behalf of Sue Rivera 
> <srivera () CSUB EDU>
> *Reply-To: *The EDUCAUSE Security Community Group Listserv 
> <SECURITY () LISTSERV EDUCAUSE EDU>
> *Date: *Friday, September 21, 2018 at 10:07 AM
> *To: *"SECURITY () LISTSERV EDUCAUSE EDU" <SECURITY () LISTSERV EDUCAUSE EDU>
> *Subject: *Re: [SECURITY] Cloud vendor contracts starting to say they 
> own the data you put in their cloud
>
> I ran into that recently as well.
>
> Have a breach free day!
>
> Thank you,
>
> Sue Rivera
>
> Information Security Analyst, Lead
>
> Information Technology Services
>
> California State University, Bakersfield
>
> *From:*The EDUCAUSE Security Community Group Listserv 
> [mailto:SECURITY () LISTSERV EDUCAUSE EDU] *On Behalf Of *randy
> *Sent:* Friday, September 21, 2018 9:03 AM
> *To:* SECURITY () LISTSERV EDUCAUSE EDU
> *Subject:* [SECURITY] Cloud vendor contracts starting to say they own 
> the data you put in their cloud
>
> The subject line  says it all.
>
> We're starting to see clauses in vendor cloud contracts where they are 
> stating that they will own any data that we store in their cloud. 
> Basically this sounds like cloud vendors are starting to adopt the 
> social media sites' approach of "gimme, gimme, gimme, it's mine". 
> Needless to say, this is disturbing in so many ways.
>
> Has anyone else run into this?
>
> -Randy Marchany
>
> VA Tech IT Security Office and Lab.