Earlier this year the Norwegian Consumer Council published a study about terms of service (TOS) in cloud services. The council found terms were hazy at best and varied across the services iCloud, Drop Box, Sugar Sync Google Drive, Jotta Cloud, SpiderOak, and Microsoft OneDrive.
Based on the findings of this study, the Norwegian Consumer Council filed a complaint with the Norwegian Consumer Ombudsman on Tuesday. According to the complaint, it’s “… based on the discrepancies between Norwegian Law and the standard terms and conditions applicable to the Apple iCloud service (“the Agreement” hereafter), as they are presented at: http://www.apple.com/legal/internet-services/icloud/no/terms.html.”
The complaint further stated, “The Consumer Council finds that the Agreement in several aspects is in breach of the law regarding control of marketing and standard agreements.”
The EU takes data privacy and security very seriously, especially after the Snowden revelations. Breaches of Norwegian law by Apple included unfair contract terms and the ability to unilaterally alter the terms of the contract. European parliament has already ruled in favor of consumer privacy when it comes to data collection and who controls it. Additionally, the European Court of Justice ruled Tuesday in favor of the “right to be forgotten” which will force providers to remove search engine links at consumer request.
In addition to breaches of the law, the study found several items of interest to consumers in studying the TOS. None of these providers have a guarantee that data is safe from loss. Microsoft OneDrive and Google Drive allow the use of your content for purposes other than storage, allowing them to use the content in other services. Google has the most liberal license allowing use by their partners and extends even after service is canceled.
Google received a fine in January by the French Data Protection Authority. Regarding Google’s terms of service they said, “it permits itself to combine all the data it collects about its users across all of its services without any legal basis.“
Many of the providers have the ability to terminate an account without notice. All of them can change the terms of service but only Google and Microsoft give an advance notice.
Consumers generally presume privacy of their files but this not the case with all providers. Only SpiderOak, Dropbox and Jottacloud make it clear that they will not look at content. Microsoft and iCloud have broadly written TOS that give employees the right to browse user files. This is interesting since at least some of Microsoft’s other cloud services such as Azure, Office 355, Microsoft Dynamics CRM and Windows Intune have contracts that meet European privacy standards.