Re: Cloud vendor contracts starting to say they own the data you put in their cloud

[Alex Lindstrom <aglind () UDEL EDU>]

In the same vein as Jason, I've seen vendors propose a few things:

   1. You own your data, but we can use anonymized copies.
   2. We own your feedback, suggestions, and data about your use of the
   service.

I haven't yet seen a vendor propose to own all customer-provided data.
Typically, the two above points are blended such that the customer owns
their actual data, but the vendor can aggregate it for service management
purposes.

To Grace's comment: yes, and we often do if it's not already there.
(Usually, the vendor's standard agreement acknowledges that the customer
retains all rights to, title to, and interest in their data.) We also
include clauses that limit the vendor's use of the data to only the
purposes necessary to provide the services.

-----

Alex Lindstrom

IT Security Analyst II
UD IT Security

(302) 831-4823
https://www.udel.edu/security/ <https://www1.udel.edu/security/>
https://sites.udel.edu/threat/


On Fri, Sep 21, 2018 at 12:28 PM Jason Edelstein <jasone () uchicago edu>
wrote:

> We see two variants:
>
> 1. We don't own your actual data, but we reserve the right to make
> anonymized copies of your data and use them for anything we want, including
> marketing, etc.
>
> 2. We own your stuff, thanks for uploading.
>
> We've usually struck clauses of the second type or simply refused to sign
> that contract, where possible. I actually haven't seen one of the second
> type in a while.
>
> For clauses of the first kind, we've had some success modifying contracts
> to restrict this to only allowing anonymized data for support or delivery
> of the contracted goods and services, but many copies complain that they
> don't have a way to opt us out of their Big Data.
>
> In that case, I've been pondering simply saying that any release of data,
> anonymized or not, that ends up being identifiable information is
> considered a breach. Some have bought that, others have not.
>
> Jason Edelstein
> IT Risk and Compliance Program Manager
> University of Chicago, IT Services
> desk: 773 834 3457security.uchicago.edu / 773 702 CERT
>
> On 9/21/2018 11:10 AM, Grace Lynn Faustino wrote:
>
> Can Universities add the ownership of data clause to the contract terms?
>
>
>
> ~ Grace L. Faustino
>
>
>
> Public Key
>
> 7C4F 3117 131E A4AC 3B07 45FC 57E3 1235 59BE DFB4 6075 2ED2 A9DB C847 CBD8
>
>
>
> *“Learning is not attained by chance, it must be sought for with ardor and
> diligence” ~Abigail Adams*
>
>
>
>
>
>
>
>
>
> *From: *The EDUCAUSE Security Community Group Listserv
> <SECURITY () LISTSERV EDUCAUSE EDU> <SECURITY () LISTSERV EDUCAUSE EDU> on
> behalf of Sue Rivera <srivera () CSUB EDU> <srivera () CSUB EDU>
> *Reply-To: *The EDUCAUSE Security Community Group Listserv
> <SECURITY () LISTSERV EDUCAUSE EDU> <SECURITY () LISTSERV EDUCAUSE EDU>
> *Date: *Friday, September 21, 2018 at 10:07 AM
> *To: *"SECURITY () LISTSERV EDUCAUSE EDU" <SECURITY () LISTSERV EDUCAUSE EDU>
> <SECURITY () LISTSERV EDUCAUSE EDU> <SECURITY () LISTSERV EDUCAUSE EDU>
> *Subject: *Re: [SECURITY] Cloud vendor contracts starting to say they own
> the data you put in their cloud
>
>
>
> I ran into that recently as well.
>
>
>
> Have a breach free day!
>
>
>
> Thank you,
>
> Sue Rivera
>
> Information Security Analyst, Lead
>
> Information Technology Services
>
> California State University, Bakersfield
>
>
>
> *From:* The EDUCAUSE Security Community Group Listserv [
> mailto:SECURITY () LISTSERV EDUCAUSE EDU <SECURITY () LISTSERV EDUCAUSE EDU>] *On
> Behalf Of *randy
> *Sent:* Friday, September 21, 2018 9:03 AM
> *To:* SECURITY () LISTSERV EDUCAUSE EDU
> *Subject:* [SECURITY] Cloud vendor contracts starting to say they own the
> data you put in their cloud
>
>
>
> The subject line  says it all.
>
>
>
> We're starting to see clauses in vendor cloud contracts where they are
> stating that they will own any data that we store in their cloud. Basically
> this sounds like cloud vendors are starting to adopt the social media
> sites' approach of "gimme, gimme, gimme, it's mine".  Needless to say, this
> is disturbing in so many ways.
>
>
>
> Has anyone else run into this?
>
>
>
> -Randy Marchany
>
> VA Tech IT Security Office and Lab.