Two articles that I’ve come across over the last week have sparked my interest in the question of what impact cloud computing has on employment law.
Realizing that there are several of you who may think "cloud computing" is simply using your laptop on your next airline flight, let’s start with a discussion of cloud computing. As explained in a very good piece published by Kroll OnTrack:
Cloud computing is best understood as a concept rather than a particular technology. Cloud computing involves entrusting electronic data for storage and/or processing to a third-party provider, and then remotely accessing the data "in the cloud" via the Internet. The data is in fact stored on a server—sometimes on a virtual server—operated by the cloud provider, often alongside data from other clients on the same storage services and processors. By allowing clients to pay based on use, cloud computing provides potentially sky-high cost savings to corporations, which can avoid the serious and recurring capital expenditures associated with setting up and maintaining their own servers, such as IT personnel costs. In other words, the users of cloud computing technology pay for what is used. Cloud computing further enables a corporation to quickly and easily ramp up or ramp down computing and storage capacity based on business needs.
So what’s the downside? Kroll has highlighted a few issues that employers have glossed over so far including data location, forensic investigation recovery, and cloud provider integrity.
Doug Cornelius, who runs the Compliance Building blog, is attending a conference where he has highlighted other issues including: records management; data privacy; and compliance logs. In other words, there’s great upside and cost savings to using cloud computing, but has anyone thought about the real-world implications?
From an employment law perspective, I have not seen much, if anything on the subject. For example, Connecticut’s wage and hour laws require employers to keep track of various records of the employee including hours worked, etc. The catch? Such records need to be kept at the employer’s place of business for three years. Does storing the information in "the cloud" satisfy that?
And suppose an employee is fired for improper use of the Internet and you want to "image" (or copy) the computer that the employee has worked on to preserve the evidence. How do you do that when the computer you want to image may be in a server thousands of miles away?
Or consider the lawsuit filed by an employee and the call that needs to go out to your IT department to put a "litigation hold" on your data. How do you do that when it’s based in the "cloud"?
These are not insurmountable issues for employers. Every new technology brings with it new questions. But employers who are jumping into cloud computing should look past the sales pitches of the companies and ensure that what they are doing will allow them to comply with the law.