1

DPIIT, MCI Chair on Intellectual Property Rights &

Centre for Intellectual Property Rights Research and Advocacy

National Law School of India University, Bangalore

“Analysis of IPR Challenges of Cloud Computing and Ways to

Overcome the Issues”

Under the Guidance of

Prof. (Dr) T. Ramakrishna,

MCI Chair Professor on IPR

Submitted By

Prapti Bhattacharya

Asian Law College, Noida

2

CERTIFICATE

This is to certify that Prapti Bhattacharya, student from Asian Law College, Chaudhary

Charan Singh University, Meerut, Uttar Pradesh; has successfully completed and submitted her

report, Analysis of IPR Challenges of Cloud Computing and Ways to Overcome the Issues.

This has been submitted in fulfilment of her internship at the Centre for Intellectual Property

Research and Advocacy (CIPRA) during the month of 15th

November to 15th

December, 2020.

Bangalore, 28th

December, 2020

Prof. (Dr.) T. Ramakrishna

DPIIT, MCI Chair Professor of IPR

Mr. Jnana Teja Bandi

Research Associate

3

DECLARATION

Certified that this research work is my original work and I have not borrowed any material from

other‟s work nor have I presented this partly or fully to any other institution/college/university.

I have completed with all the formalities prescribed in this regard

Date: 28/12/2020 Signature:

Place:Kolkata, W.B. Name: PRAPTI BHATTACHARYA

4

Analysis of IPR Challenges of Cloud Computing and Ways to

Overcome the Issues

PRAPTI BHATTACHARYA

ASIAN LAW COLLEGE, NOIDA

ABSTRACT

Can a human made technology work better than a human? Artificial Intelligence is that technology

which has adapted and adopted the rational methodology to function as human nervous system

faster than humans.

This article has given an in- depth analysis of the challenges in the field of “Cloud Computing”,

currently an inseparable part of AI. Although it is quite cost effective for the data storage and

processing function but the global reach of cloud technology makes personal data vulnerable. This

data set can be shared with third party even without their consent. Presence of third party for storing

data, scarcity of professional overview, lack of legal compliance and control, negligence of cloud

service providers have made us realize about the importance of privacy and data protection laws.

Only a critical advancement, organized management, and experts‟ entanglement can lessen IPR in

the application procedure, arising due to difference in the international laws.

It is high time for India to frame stringent privacy laws to solve issues related to cloud computing.

Thus the primary objective of this essay is to understand the impact of cloud computing and AI to

carve out probable solutions.

Keywords- Cloud Computing, Intellectual Property, Privacy Infringement, Trademark,

Copyright, Patent.

5

Table of Contents

1. Introduction

2. What is Cloud Computing?

2.1 Basics of the Cloud Computing

2.2 Types of Cloud Computing service

3. Technological evolution of Cloud throughout the world

3.1 Growing trend of cloud adoption in India

4. Privacy General Data Protection Laws

5. Challenges and IP infringement pattern of Cloud Computing

a. Patent infringement

b. Copyright infringement

c. Trademark infringement

d. Trade secret infringement

6. Challenges and IP infringement pattern of Cloud Computing

7. Recommendations to solve the legal challenges

8. India‘s evolution in Cloud technology

9. Conclusion

6

Research methodology:-

The questions addressed below, have been dealt here for better analysis of the situation:

How the IT sectors, government agencies, educational institutions have adopted cloud

computing system in India and in abroad?

What are the personal data protection laws implemented nationally and internationally to secure

the information of the cloud users?

What is the scope of Intellectual Property Rights Infringement related to Cloud and what are its

implications?

Recommendations to overcome the problems.

7

“Digital technology, pervasively, is getting embedded in every place: everything, every

person, every walk of life is being fundamentally shaped by digital technology — it is

happening in our homes, our work, our places of entertainment. It‘s amazing to think of a

world as a computer. I think that‘s the right metaphor for us as we go forward.‖

– Satya Nadella

Nadella, CEO of Microsoft

1. Introduction:

In this ultra modern digital era, Cloud Computing is one stop solution for most of MNCs‟, research

organizations because not only it makes the mobile and computer work easier giving multifold

advantages for storing and harmonizing uncountable information across unnumbered devices but

also it provides a seamless service enabling cross- border transactions, removing the shackles of

physical world.

But when we start protecting Intellectual Property Rights, Cloud Computing bring up a whole new

range of concerns since it has the power of controlling the proliferation of data across international

boundaries, and this concern is heightened up when cloud deals with the original work of authors,

or with confidential information and that creates the risk of infringing copyright, patents and trade

secrets and the result of such infringement is mostly catastrophic.

In this article we will try to analyze the basics of cloud computing and IPR challenges associated

with it.

2. What is Cloud Computing?

Cloud computing has been developing as one of the most useful contemporary concepts in

computer and information technology services recently.

Simply the storing and accessing of data and programs over the internet without using the internal

storage of the machine is termed as CLOUD COMPUTING. In this phrase, the word "cloud" is

just an analogy in place of the word “internet”.

But every technological development comes with some legal implications as well and likewise,

when data are stored in the cloud, several legal problems, including intellectual property issues

arise for both cloud computing providers and users. One of the most noteworthy features of cloud

8

computing is that individuals or businesses may fend off the purchase cost, or the cost of

installment and managing the hardware and/or software.

2.1. Basics of the Cloud Computing:

The term "cloud computing" has no universal definition to follow but generally it has been depicted

as the delivery of computing service through the medium of internet. Before proceeding with the

further analysis, we must know some definitions, which are as follows:

Cloud computer user: A customer or user who may be an individual, a business, a government

agency or any other entity.

Cloud service provider: Likewise a cloud computer user, a cloud service provider may be an

individual, a corporation or a business, a nongovernment agency or any other entity.

Third party: A cloud service provider can be perceived as a third party, because it maintains

information about or on behalf of another entity.

Personal data: Any information that relates to a natural person, which singly or mixed with other

information, will be able to identify the person separately when it will be presented to a corporate

entity.

Privacy: It simply signifies freedom from any external interference.

2.2. Types of Cloud Computing service:

Software-as-a-Service (SaaS models): This allows the users to connect to and use few software

applications over the internet only, without storing and using the applications offline.

Platform-as-a-Service (PaaS models): This allows to access to a computing platform (e.g. Microsoft

Windows) on which different applications can be run or developed.

Infrastructure-as-a-Service (IaaS models): This allows the consumers to run and control any digital

platform as per their requirements.1

1

Steve Ranger, What is cloud computing? Everything you need to know about the cloud explained (2018),

https://www.zdnet.com/article/what-is-cloud-computing-everything-you-need-to-know-about-the-cloud/.

9

As the term "cloud" suggests, one of the adversities of cloud computing is that it is devoid of

precise location of hardware and data. The services may be provided to a client in a particular

jurisdiction, but mostly that data will be stored and processed at multiple locations, even in

different countries in the same or different jurisdictions and unfortunately the client may not have

any knowledge of where the data is stored or processed.

3. Technological evolution of Cloud throughout the world:

Predominantly Asian countries have shown a different exponentially increasing algorithm of

technological advancement using Cloud computing than any other continent. But some industrial

sectors are still left who didn‟t touch this technology yet maybe due to technicalities and

complexion attached with its usage. The graphical statistics below shows how the IT sectors of the

following countries have been implementing Cloud computing in their service.

(Source: National Science Board, Science and Engineering Indicators. (2018). Global R&D: One

Measure of Commitment to Innovation. [Data file and codebook] Retrieved from

https://www.nsf.gov/statistics/2018/nsb20181/digest/sections/global-r-d-one-measure-of-

commitment-to-innovation)

This data set is a clear proof of the fact that IT professionals have been gathering knowledge and

exposure to cloud computing with their augmenting experience in IT sectors. But the graph is

diminishing down at certain places too. We can assume that this is happening because the all-

encompassing growth of cloud computing took a bit longer time along with its understanding.

The next chart shows the discrepancy between cyber security education and experience

requirements and also proves the variance of the adequate knowledge and empiricism about cloud

computing of some IT professionals against those who still need to shun their skill more in the

10

international IT working environment to handle clients in diverse manufacturing business,

industries and associated service sectors.

2

Western countries have always been on the forefront of development since the renaissance period.

Likewise here also, the western countries have covered a vast dimension regarding application of

Cloud computing system not only in commercial functions but also in education, healthcare and

entertainment industries as well.

In the commercial sector, small and medium companies have adopted cloud computing frequently.

In the educational background, elementary, middle and high schools have espoused cloud

computing mainly. Among government sector, federal government has endorsed this model than

any other sector.

3.1.Growing trend of Cloud adoption in India:

2 David Leaser, The demand for cybersecurity professionals is outstripping the supply of skilled workers (2019),

https://www.ibm.com/blogs/ibm-training/new-cybersecurity-threat-not-enough-talent-to-fill-open-security-jobs/.

11

The following two graphs show that since independence, how India advanced in scientific research

and technological field, and accommodated new age technologies in each and every sector and even

in day to day life.3

4

4. Privacy General Data Protection Laws :

India has no definite legislation on data protection. However, the Information Technology Act

(2000) (―IT Act‖) is amended to include Section 43A and Section 72A, which provides a right to

compensation for unauthorized disclosure of personal information.

Currently India has a system of biometric based unique identification number for citizens called

‗Aadhaar‘ under Aadhaar Act, 2016; by which Government has access to basic personal

information of all the citizens. Since accessing such information is infringement of right to privacy,

recently in a landmark judgment of Justice K.S Puttaswami & another Vs. Union of India and

Ors,5 the Supreme Court of India has distinguished the right to privacy as a fundamental right under

Article 21 of the Constitution as a part of the right to “life” and “personal liberty” and

―Informational privacy‖ has been identified as an integral part of the right to privacy. The

Supreme Court stated for the first time that every resident of India should have the right to regulate

commercial use of his or her identity.

3 Sriyansh Jain, India‟s Move To Adopting Cloud Services In The Public Sector Is A Game Changer (2019),

https://analyticsindiamag.com/indias-move-to-adopting-cloud-services-in-the-public-sector-is-a-game-changer/. 4

NASSCOM Cloud: Next Wave Of Growth In India 2019, , https://nasscom.in/knowledge-

center/publications/nasscom-cloud-next-wave-growth-india-2019 5 WRIT PETITION (CIVIL) NO 494 OF 2012

12

The Government of India established a drafting committee which proposed a draft law and the

Government of India has introduced the Personal Data Protection Bill 2019 (―PDP Bill‖) based

on this draft only. This can be termed as first law enacted by India on the protection of personal

data and it will nullify section 43A of the IT Act.

This set of laws easily point out that the privacy law in India is obtained from the fundamental

rights set out in the Indian Constitution. Every law is set on the basis of “physical privacy” against

the attack by public authorities. But to adjust with the changing scenario and the overgrowing

virtual world, there is still no strict enforcement to protect the public and private data.6

5. Analysis of the international legal principle:

The Directive 95/46/EC of the European Parliament and of the Council of the European

Union (of 24th October 1995) applied to cloud computing and talks about controller of data, the

scope of authority, and what happens when data is transferred outside the EU. While Cloud

computing focuses on the reduction of direct control over data; on the other side the EU legislation

goes on talking about controlling of data. Also, The Health Insurance Probability and

Accountability Act, (HIPPA) of 1996 controls the storage, usage and leakage of the Protected

Health Information (PHI).

The Financial Privacy Rule of Gramm–Leach–Bliley Act of 1999, puts the chill on the financial

organizations to send out notices to each customer with a describing the data collected about the

consumer, where that data may be shared, how that data is being used or would be used in future,

and also the clauses which talks about the data protection.

While the main concern is protection of personal data from cloud main server, it is very hard for

both cloud users and cloud service providers to identify those specific data which are accessed by

government and the time of such access too. Even Government can‟t be reprimanded for this

overall surveillance because controlling some data is required prior to analyze bigger cyber attack

to maintain the integrity and national security.

6 Michael Nadeau, General Data Protection Regulation (GDPR): What you need to know to stay compliant (2020),

https://wfww.csoonline.com/article/3202771/general-data-protection-regulation-gdpr-requirements-deadlines-and-

facts.html.

13

In USA, Cloud data is controlled by the Electronic Communications Privacy Act (―ECPA‖),

1986; but government can locate it easily showing ECPA court order to the cloud service provider.7

The US government enacted a statute named Protect America Act, 2007 to get hold of any digital

information without a prior warrant.

Through Prism Internet Surveillance Program (PRISM), 2008; the US government acquired

huge amounts of private communications of natives, their saved photographs, emails, any detail of

data, money transactions, all data are saved on various social media platforms, from both domestic

and foreign providers. This has advanced numerous questions on the confidentiality issues of cloud-

based services.8

6. Challenges and IP infringement pattern of Cloud Computing:

This study is a qualitative and quantitative analysis of cloud computing and its embracement and

utilization in different sections of commercial firms and other institutions.

The challenges in this field are so vast that it cannot be jotted down in a single piece of writing but

the author has tried to discuss the IP infringement issues in the following manner.

a. Patent infringement

If we look into the Canadian patent system, we see that here the patentee has the exclusive right to

make, use and sell an invention in his country only. However, this system won‟t be applied in case

of cloud computing systems because it is not territorial in nature and it may extend across

international borders and this cause trouble to patent owners or licensees who are trying to confirm

their patents against probable infringements.

First, it is highly difficult to identify the activities which pertain to infringement. If a particular

patent is issued in France, but a competitor's cloud computing service uses tools to perform some or

all of its data processing outside of France, the French patent(s) may not be infringed. Since the

"cloud" contains the parts and parcel of multiple countries, the laws of other countries are required

to be considered.

7 Leighton Johnson, Security Controls Evaluation, Testing, And Assessment Handbook (2015).

8T. C. Sottek & Janus Kopfstein, Everything you need to know about PRISM (2013),

https://www.theverge.com/2013/7/17/4517480/nsa-spying-prism-surveillance-cheat-sheet.

14

Second, cloud computing systems generally consists of several components, which are operated by

a different party from different places. For example, while the data storage servers may be owned

and run by one company, the main system components, processing data from those data storage

servers may be owned and operated by another company. These components again get transferred

to yet another company or companies, who then use(s) those to deliver services to users. Since

several parties are involved in the whole processing and management of the components, most of

the time, all the parts of a single invention are not exploited by a single party.

Third, as we have seen earlier the data storage and processing of cloud computing program occurs

at different places, reverse engineering from the user's end to detect infringement is difficult in

general. That is why here the technical setup of a service provider's is not accessible to the public

which will allow them to disclose the patent infringement.

From the points aforementioned it is clearly illuminated that we need to consider some solutions

from client-side elements of a cloud computing system to be eligible for patent protection or for IP

protection. Operations at the client-side can be narrowed down fast because of its sectarian nature.

However, it is quite important to detect the potential infringers first while ensuring protection for

client-side elements of a cloud computing system. This measure is important on different

company‟s part because no company will wish to avow patents against the users of a cloud

computing service, since that may estrange those users from becoming future customers. 9

a.(I)Action Plan for Protection of Cloud-Related Patents:

Now here we need to discuss the rising importance of PAEs (Patent Assertion Entities, businesses

who litigate their patents but generally don‟t otherwise use their patented technology) because it has

been observed that compensations awarded for PAEs are almost four times higher than granted for

other patent claimants.

Since the economic value of cloud is rising day by day, the cloud customers are preparing

exclusively interesting targets for PAEs because customers usually don‟t have the same level of

knowledge to understand the difficulties of cloud as cloud service providers (CSPs), and also

9 'Cloud Computing Patent Litigation Trends – Competitor Cases, Open Source Targets, Cloud Customers | JD Supra'

(JD Supra, 2018) <https://www.jdsupra.com/legalnews/cloud-computing-patent-litigation-23203/>

15

because they are less prepared to fight an IP suit, and have very less incitement to solve an IP

disputes for others.

This is the reason why cloud patent claim risk is being accommodated by the largest global CSPs in

their cloud service agreements.

Microsoft has already introduced Azure IP Advantage programme with uncapped indemnification

for its Azure cloud services and Google in its Cloud Platform Terms of Service seeks to exclude

open source software entirely from its IP infringement indemnification.

In Amazon Web Services‘ (AWS) Customer Agreement, section 10 states that AWS does not

offer any IP protection for its services in the standardised manner.

Currently all the largest CSPs are starting to use the cloud patent risk explicitly in their contract

terms and it is the most promising evidence that this PAE-fuelled risk is being of relevant

importance to the IP infringement issues. Cloud customers, and their regulators in regulated sectors

in India, should take note as well.

b. Copyright infringement

Copyright laws vary from one territory to the other. The copyright infringement is a subjective

topic which will vary with each and every country. Therefore, just like the patent infringement,

detecting copyright infringement from different locations becomes laborious and burdensome than

it would be from a single jurisdiction. For example, if a copyrighted work is copied and distributed

by an Indian user, after the expiry of 60 years i.e. the period of protection, the action would

continue violating the US Copyright laws where period of protection is 70 years. 10

Hence the

international jurisidiction is a matter of concern in determining the copyright infringement issues.11

The other issues are as follows,

10

Vijay Pal Dalmia, 'Copyright Law In India- Everything You Must Know'

<https://www.mondaq.com/india/copyright/655852/copyright-law-in-india-everything-you-must-know> 11

'Copyright Law In The United States' (Bitlaw.com, 2020)

<https://www.bitlaw.com/copyright/index.html#:~:text=Copyright%2>

16

i. The use of copyright is itself cloudy because it is generally assumed that the owner of the

copyright has the power to control the display of their owned material. Search engines like

Google copies author‟s work as well but that is done for better referencing and it is considered

as non display use. But the cloud providers copy the works for commercial use of other‟s

works and make duplicate copies of such personal works.

ii. Generally pure technological work such as the owners and the original producers of music files

enjoy a licensing right rather than a general ownership. In some countries individuals enjoy the

right to copy of music and film files for the personal use, but when the same files get uploaded

on cloud servers, it is difficult to decipher till which extent the distribution is permissible and

this can create a confusion about the liability of intermidiaries, who supply cloud services since

geographical limitations play a major role in spreading the copyrighted work which results in

ambiguity and dilemma of licensing rights, for companies and customers outside. 12

b.(I) Case laws

The copyright laws have been unpredictable determining the vicarious or contributory

liability of cloud service providers and the response of judiciary has been discussed in the

following cases.

i. In the landmark case of Penguin v American Buddha,13

the jurisdiction issue of copyright suit

has been vividly measured. Here American Buddha operated a website with the name Ralph

Nader Library and the information provided in the online library was promulgated from the

servers located in States of Arizona and Oregon. When the Penguin publishers found four of

their published books in the website, a cased was filed against American Buddha in the US

Southern District Court of New York for infringing Penguin‟s copyright. Here the defendant

said that the real infringement has occurred at the place where it was electronically copied. The

location of copying were Arizona or Oregon i.e. the server locations but the plaintiff filed the

suit in New York. That is why the New York Court dismissed the case due to lack of

jurisdiction.

12

Komal Chandra Joshi, Cloud Computing: In Respect to Grid and Cloud Approaches, ISSN: 2249-6645, IJMER, Vol.

2, Issue. 3, May- June 2012, pp 902-905

13

Penguin Group (USA) Inc v American Buddha, 609 F3d (2nd Cir 2010) (“American Buddha II”)

17

ii. In Religious Technology Center v. Netcom On-Line Communication Services Inc,14

the

court upheld that specific knowledge of the offence is important to prove the contributory

infringement.

iii. Following the same the court applied the concept of „substantial participation in copyrighted

material‟ in the Netcom case, because Netcom could not stop the worldwide distribution of

copyrighted material.

iv. The downsteam downloading is a grave issue in such scenario which is prevalent from the case

Arista Records, LLC v. Usenet.com, Inc.15

Here the defendant, USENET Network, termed as

“a global system of online bulletin boards”, were used by millions by users to post their

documents, texts and any other files including any music files. Here the Court stated that such

flagrant and unrestrained posting of contents has directly violated the copyright laws when over

the course of time, the already protected contents of the original authors and artists have been

uploaded and downloaded by users umpteenth time.

c. Trademark infringement

In this technologically evolving world Trademark infringement issue is applied in the digital sector

as well.

i. Extensive infringement

It means that a mark posted in a site is accessed worldwide, even by the countries where the

mark was not meant to be used. This can make the sign vulnerable to world wide

infringement.16

ii. Restrictive infringement

Generally a link is required to cause restrictive infringement between the use of the sign on the

Internet and the country in which the trademark requires protection and this infringement can

take place by the way of advertising, mail orders etc from the popular e-commerce sites like

Amazon, e- Bay etc.

14

907 F. Supp. 1371(1995)

15

2009 WL 1873589 (S.D.N.Y.) (June 30, 2009).

16 'Trademark Infringement In India - What Is It, Types, Penalties For Infringement' (Cleartax.in, 2020)

<https://cleartax.in/s/trademark-infringement-india> accessed 30 November 2020.

18

Keeping the worldwide trademark jurisdiction in mind, the judiciary need to determine a

definite way to use the link over internet, which does not barge in another country‟s Trademark

protection rights.

Along with this the judicial system can enable restricted access to particular users and they can

impose authority to refuse to deliver goods and services in a particular country. However the

owners of unregistered trademark do not get much protection in such scenario.

c.(I) Case Laws

i. The landmark case in this aspect is Inwood Labs. Inc v. Ives Labs Inc.,17

and it was applied in

the case of Tiffany (NJ) Inc. v. eBay Inc.,18

wherein Tiffany reported that the eBay users were

using eBay resources to sell replicated Tiffany products, the court used the Inwood test to

determine the criminal liability of the intermediary service providers and relieved eBay of its

liability due to lack of specific knowledge of the infringement.

ii. Contrarily the court used this Inwood test in a different sense, in Louis Vuitton Malletier, SA

v. Akanoc Solutions, Inc.,19

to determine the liability of Akanoc Solutions Inc, for

exploitation of Vuitton‟s trademarks and copyrights because Akanoc used Louis Vitton‟s server

space, IP addresses without any permisison and provided the same to foreign resellers who

produce and sell spurious Vuitton goods.

iii. These two distinct cases prove that to get rid of the liability of trademark infringement, one

should have the specific knowledge of the offence and the service providers should keep in

mind that services must be stopped right at the moment of getting notified of the infringement.

c.(II) Action Plan for Protection of Cloud-Related Trademarks and Copyrights

i. Select Your Trademark(s):

At the beginning, determine a name for your goods, services, tag lines, and/or company.

17

456 U.S. 844, 854 (1982)

18

600 F.3d 93 (2d Cir 2010)

19

658 F.3d 936 (9th Cir. 2011

19

Example- one might select the term “Cloud” in the brand name, e.g. SYMBI CLOUD

COMPUTING, but provided the descriptive and generic characteristics of the term “CLOUD

COMPUTING” it won‟t be possible to claim exclusive rights to these terms. So trademark or

trademarks must be selected in the way so that they would not only describe a feature or

characteristic of your goods or services.

ii. Trademark Research:

After selection of the name, it must be checked whether trademarks are available to be

registered by conducting a trademark clearance report for each trademark. This clearance report

will give the information that trademark(s) are likely to be registered or whether they will be

refused for standing too similar to other already registered trademark along other grounds of

refusal.

iii. Register Your Trademark(s) & Copyright(s):

Registration is very important step because it will help in preventing infringement of the goods

or services and it may also assist in shielding against allegations of infringement suits. In the

same way the copyright need to be registered as well.

iv. Monitor for Infringement:

To be vigilant about monitoring for infringement of the trademarks and copyrights the

customers must create a system, or appoint an agency which expertises in the same, for

monitoring trademarks filed with Patent and Trademark Office, and routine searches need to be

conducted of the major search engines to make sure that the goods and services and the related

copyright and trademark rights are not infringement is not taking place.

v. Enforce Your Rights:

The moment infringement takes place, if the user has registered the trademark/ copyright

already, it is easier to stop the attack incurring less cost and one can get the infringing materials

removed from the search engines, and social media sites because such sites have their separate

20

policies that preclude infringement of another‟s rights on their servers. If they are not registered

generally the infringer gets more time and huge cost is incurred to stop the attack.

d. Trade secrets infringement

Confidential data like formula, pattern, program, technique, device, method, or process; are also

termed as trade secrets and breaching of this secret brings serious repercussions. Before uploading

confidential data to the cloud, a user should consider what sorts of confidentiality clause will be

followed by the cloud storage service provider. The users need to check if somehow the sub-

contractors also get hold of such confidential information from such service providers because here

the extent of encryption can only prevent preliminary naive access but it is hard to prevent the

attack by proficient hackers who are expert in decrypting all the hidden codes. A thoughtful and

sincere user of a cloud storage service should also contemplate the consequences that will take

place after the termination of the cloud storage service between the user and service provider.20

It is yet to be determined that whether the information can be terned as trade secret if it is stored in

the cloud. Still no austere rules have established which can give extra security to such highly

secretive information. The only recommendation will be not to store any confidential material in

the cloud.21

7. Recommendations to solve the legal challenges :

Following are the probable recommendations to remove the IPR breaches of Cloud Computing

discussed above.

i. Privacy Impact Assessment

Privacy Impact Assessment (PIA) is a predictive process of privacy audit containing a set of

questions and graded answers to examine how a particular activity will hamper the cloud user's

privacy. If any serious privacy issue arises then decision makers should be informed about it

to determine the next steps of completion the task.

20

Himanshu Sharma & Martand Nemana, Cloud Computing & IP Challenges (2016),

https://www.mondaq.com/india/it-and-internet/524422/cloud-computing-ip-challenges. 21

Robert B. Milligan and D. Joshua Salinas, 'A Brave New World: Protecting Information (Including Trade Secrets) In

The Cloud And Social Media' (2012) 21 NYSBA Bright Ideas.

21

This assessment method can help both public and private sector undertakings to evaluate the

infringement of personal privacy. PIA tools should be used as one of the multiple layers for

checking the breach of personal privacy because it has to be used by the organizers itself,

intermediary service providers won‟t have access to it.22

ii. Assessment of cloud design

Different phases of design like initiation, planning, execution, closure stages need to be

assessed separately to set high level privacy strategy. The planning stage should be used to

determine the input and output to strengthen the security and the execution phase should be

used to cancel last minute errors after chalking out the solutions. Privacy experts should get

adequate training to operate each of these phases seamlessly.

iii. Use of Privacy Enhancing Technology (PET)

PET should be use in accordance with the different privacy protection laws to segregate the

lacunas of privacy service of internet and the breaching tendencies of the network providers.

This technology should be used to eliminate the anonymity of the user‟s personally identifiable

information.

iv. Legal as a service

Legal-as-a-service (LaaS) should be used by Cloud Service Providers to implement their cloud

resources and services without the tension of infringing the law and it is applied at the super-

peer levels which provide protected service in super peer domain. This Cloud service policy

enhances the performance of SaaS on the automated security policy in virtual data centres.23

8. India‘s evolution in Cloud technology:

With the introduction of GI cloud, Meghraj, India has realized the importance of potential of the

cloud. From the cases discussed above, we have seen lack of jurisdiction has relieved the

defendants from their liability. The same is applied in India. Under the Indian Civil Procedure

Code, 1908, the defendant‟s liability is based on two principles: his place of residence and the place

where the cause of action arises. But it is unsure if the same can be applied in case of cloud service.

22

PRIVACY IMPACT ASSESSMENT (PIA) GUIDE (US Securities and Exchange Commission Office of Information

Technology 2007). 23

'Cloud Computing In The Legal Industry' (Directlaw.com, 2020) <https://www.directlaw.com/cloudcomputing.asp>

accessed 30 November 2020.

22

The Information Technology Act, 2000 deals with any kind of computer networks and data

infringement issues and the act does not held the service provider liable if any third party data is

provided by him if he can prove that he took reasonable care and protection to prevent the

breach.24

When the IPR infringement is concerned, we find that copyright infringement is safeguarded by

section 81 of the Information Technology Act but other IPR domain are left untouched.25

9. Conclusion:

In summary, cloud computing has brought up quite a new challenges to the IPR system.

Client-plus-cloud computing surely offers strong choices, flexibility, and also cost effectiveness for

industries as well as general consumers. But to enjoy the service without any hesitation, the users

must have the assurance regarding the security of private personal data available online.

In order to flourish online cloud computing, some jurisdictional, and issues of public policy must be

resolved too. Since the time of independence, the corporate privacy principles, industrial and

commercial service have strengthened our engagement to maintain the yardstick of security in our

online services which also enables the expansion of the economical value of cloud computing.

As we have seen, for preserving cloud breach, the privacy jurisprudence plays a very influential

role which may vary in respective countries and the concept of privacy may be perceived from

different point of views.

In the United States and England, data privacy forms a part of consumer law and fundamental

rights respectively but in India, “data privacy” is not strictly enforced as a statute, but under Article

21, the right to “life” encompasses right to “privacy” too.

24

Section 79, The Information Technology Act, No. 21 of 2000: Network service providers not to be liable in certain

cases.-For the removal of doubts, it is hereby declared that no person providing any service as a network service

provider shall be liable under this information or data made available by him if he proves that the offence or

contravention was committed without his knowledge or that he had exercised all due diligence to prevent the

commission of such offence or contravention. Act, rules or regulations made thereunder for any third party

Explanation.-For the purposes of this section,- (a) “network service provider” means an intermediary; (b) “third party

information” means any information dealt with by a network service provider in his capacity as an intermediary;

25

Section 81: Provided that nothing contained in this Act shall restrict any person from exercising any right conferred

under the Copyright Act, 1957 or the Patents Act, 1970.

23

Working with the global legislation hand in hand, India is also struggling with the lack of legal

frameworks to safeguard personal data and privacy and it has already set the motion to draft a

stringent set of codified laws of data protection and privacy laws.

India requires a proper environment to develop technology awareness and prowess to build up the

confederacy between the public and private institutions, to compose a far- reaching legal system for

future technologies.