Jusletter IT

Imagine you have outsourced your (business) data, e.g. customer base, production data or inventory, into the cloud. And imagine you do not have a copy of that data and the agreement you have with your cloud provider does not – for whatever reason – regulate the retransition of your data upon expiration or termination of the cloud service. How can you obtain a copy of (what you might believe is) «your» data?

The main legal problem with (raw) data is that our law does not foresee the concept of data ownership.¹ (Raw) Data are neither chattel (tangible asset)² nor conventional intellectual property rights³.

Assuming that you cannot agree with your cloud service provider on the terms of a (paid or free of charge) retransition of the data, and you therefore are in a technical lock-in, the following legal remedies might support your retransition claim:

First, assuming that the retransition of data from the cloud provider to you is merely an unimportant contractual point, or else you would have regulated it from the beginning⁴, the missing terms on retransition could be viewed as an unintended omission. In the event of failure to reach agreement on such unimportant terms, the court must determine them with due regard to the nature of the transaction (art. 2 (2) and 18 (1) CO⁵). An omission must be completed by construing the hypothetical will of the contracting parties.⁶

Presumably the court would rule that the cloud provider is obligated to return the data to you in a portable and interoperable manner (i.e. in an open and not proprietary form, e.g. CSV⁷ format), albeit not necessarily free of charge. So you might be required to pay an additional fee for the retransition of the data because if you had regulated it from the beginning in the cloud agreement, the cloud provider might have either increased the recurring service fee to include the retransition effort or added a one-time charge for the retransition service.

Second, assuming the cloud provider agrees to a retransition of data but – taking advantage of your technical lock-in – charges a high retransition fee, the cloud provider might be in breach of antitrust law. According to art. 7 (2) (c) CartA⁸ dominant entities behave unlawfully if they, by abusing their position in the market, hinder other entities from starting or continuing to compete, or disadvantage trading partners, among others, by, for instance, imposing unfair prices or other unfair conditions of trade.

An entity is dominant, if it is able to behave to an appreciable extent independently of the other participants in the market, i.e. competitors, suppliers or consumers. The intention of the legislator was to introduce thereby the notion of relative market dominance. An entity is relatively market dominant if it has a superior market position in relation to entities which are dependent of it.⁹ In applying this principle to the cloud data, the cloud provider has relative market dominance due to the lock-in effect. Thus charging a high price for the retransition might be unlawful under the CartA.

Third, if the cloud agreement is based on simple agency contract law¹⁰, pursuant to art. 400 CO the agent is obligated, at any time upon the principal’s request, to give an account of his agency activities and to restitute anything received for whatever reason as a result of such activities. This means that the agent must return everything that it received from the principal itself or that has been created in the execution of the mandate.¹¹ The accounting of information must be timely, correct and complete.¹² Whether renouncing the right to restitution is legal or not, is debated controversially in doctrine. According to the Swiss Federal Court renouncing the right to restitution is permissible.¹³ The restitution cannot be made dependent of conditions¹⁴ and must remain free of charge¹⁵.

Hence, under mandate law the cloud provider is obligated to retransition immediately upon first demand and free of charge the data you uploaded to, or that was generated on your behalf during the term of the cloud service on, the cloud provider’s server(s).

Finally, pursuant to data protection law¹⁶ any person may request information from the controller of a data file as to whether data concerning her is being processed. The controller of a data file must notify the data subject, among others, of all available data concerning the subject in the data file. The information must normally be provided in writing, in the form of a printout or a photocopy, and is free of charge.

Art. 8 FADP might seem a quick solution for restituting your data. The problem, however, is that the information right provided by the FADP is limited to personal data, i.e. information relating to an identified or identifiable (natural or legal) person. It does not relate to the data of your customers and other information you might have uploaded to the service provider’s cloud. An information request under art. 8 FADP will result in a pile of paper relating to your personal data only.

In any case it is advisable to request the retransition shortly before or at the expiration or termination of the cloud service agreement. The obligation to restitute might be valid for 10 years but once the data has been (irretrievably) deleted from the service provider’s servers the data is gone and you might end up with a monetary damage claim (if at all) but not the (valuable) data.

Daniel Ronzani