Cloud computing is a technology that is rapidly developing due
to its benefits like minimizing the costs of operations while
eliminating the burden of managing hardware and software. As cloud
computing spreads to a wider range of users, cloud computing
contracts -contracts that are regarding the performance of the
services offered by cloud computing service providers- are starting
to draw more attention in the legal field. It is essential to
determine the qualification of cloud computing contracts within the
legal framework since this shall affect the legal provisions to be
applied to the disputes arising from such contracts. This article
focuses on the classification of cloud computing contracts in the
Turkish and European legal frameworks.
1. Cloud computing and cloud computing service models
Prior to classifying cloud computing contracts, it is important
to understand what kind of services are provided pursuant to such
contracts and who the parties to the contracts are.
The term “cloud computing” does not have a common
legal definition, and various jurisdictions have different
definitions regarding said term. According to Information
Commissioner’s Office, cloud computing is internet-based
computing that “involves an organization using services – for
example, data storage – provided through the
internet.”1 The Communication European Council has
published statements that cloud computing is defined as storing,
processing, and using data on remotely located computers accessed
over the internet.2 Based upon these definitions, cloud
computing can be understood as everything relating to distributing,
managing, serving; and storing applications, services, and data
relating to these activities.3
The main services cloud computing can provide under these
service system types are virtualization, service-oriented
architecture, and network services.
Virtualization is when software mimics the physical computers to
optimize energy consumption, economize on the physical space that
computers carrying servers will take, and maximize the
capacity.4
Service-oriented architecture is a way to make software
components reusable and interoperable via common interface
standards, rapidly incorporating them into new applications and
making it easier for the user to use different and incompatible
systems together.5
Network services can be defined as applications at the network
application layer that connects users working in offices, branches,
or remote locations to applications and data in a
network.6
If a company is using cloud computing, it is regarded that the
data is kept in a data center reserved by a cloud computing service
provider with infrastructures outside the company. The data centers
may have different cloud service models depending on the type of
services they offer. The
Turkish Data Protection Authority, in its decision dated
23.12.2021, specifically mentioned three main models as services of
cloud computing contracts: Software as a Service
(“SaaS“), Platform as a Service
(“PaaS“), and Infrastructure as a
Service (“IaaS“). 7
The most common cloud computing service model is SaaS, which
allows the user to use an application through the web, and mainly
aims at developing hardware and software while decreasing the total
cost of maintenance and operations.8
On the other hand, PaaS provides services aimed at developers
while decreasing the cost of managing, controlling, and purchasing
hardware and software components while minimizing the
complications. This model allows its user to develop software and
program without the burden of managing a server.
IaaS mostly used in services such as data processing, storing,
and forming a network while it offers its user software and storage
opportunity.9
2. Contractual Status of Cloud Computing Contracts in Turkish
Law
Cloud computing contracts are not regulated as special contracts
under Turkish Law. As seen from the service models and types
mentioned above, the services offered under a cloud computing
contract can expand to a large scope that might fall under various
contract types. Therefore, the type of the agreement may change
depending on who the parties are and what services are offered. To
decide on the characteristics of these contracts, parties and the
nature of the services provided must be considered.
In cloud computing contracts, there is mostly the obligation of
performing duties since the service provider undertakes the
responsibility of processing, securing, and backing up data, as
well as ensuring the safety and maintenance of the hardware and
equipment that is used to keep the data. Some of these obligations
can be undertaken by the cloud computing service provider as
performance obligations under a contract of
mandate. These services include but are not limited to the
obligation to process data, maintain the software, and increase the
bandwidth if requested by the user and the user receiving financial
consultancy through cloud computing.10
On the other hand, users’ data being processed after being
digitalized, and cloud computing users downloading software into
their devices to use cloud computing services are considered as
performances of a work contract by some
scholars.11 However, as a counterargument, some indicate
that this cannot be the case since there is no work created
specifically for the cloud computing service users, rather, it is a
general service and must be considered as an obligation under a
service agreement.12
The dominant view in the Turkish doctrine is that cloud
computing contracts mostly have the characteristics of
lease agreements.13 The basis for this
view is the decision of the German Federal Court, in which the
Court concluded that application service provider (“ASP”)
contracts that allow the provider to temporarily transfer the
online usage of software to the users are considered lease
agreements.14
Some scholars argue that cloud computing contracts are
lease agreements as well, since the cloud
computing service provider leaves the use of the software or the
right to benefit from it to the user, even if it is virtually, same
as the ASP contracts.15 However, according to Turkish
Law of Obligations Article 299, only goods can be subject to lease
agreements. In cloud computing services, computer programs are
subject to transfer of use, and there is serious debate on whether
computer programs can be considered goods. It can be seen that in
some of its decisions, the German Federal Court decided that
computer programs can be classified as goods, yet there is serious
criticism of these decisions amongst scholars.16
Whether computer programs can be considered goods is a subject
of debate, when there is little doubt that computer programs can be
considered as work that can be subject to license agreements under
Article 2 of the Law on Intellectual and Artistic
Works.17 Therefore, it is more likely a safer ground
to consider cloud computing contracts license
agreements rather than lease agreements when
“transfer of use” is the service provided under these
agreements.
As explained above, cloud computing contracts consist of
characteristics of different types of agreements and do not fit
into just one type of contract. The fact that separate services can
be set as the performance obligation in cloud computing contracts
prevents these from being considered under a single type of
contract and makes them sui generis
agreements.18
3. Contractual Status of Cloud Computing Contracts in European
Union Law
In the European Union, there is no specific regulation applied
to cloud computing contracts as well, and the contractual status of
these agreements depends on the classification of the services
provided.
In a comparative study conducted by the European Commission on
cloud computing contracts, evaluations similar to Turkish
scholars’ have been made. This study firstly rules out the
possibility that cloud computing contracts are sales agreements
since only “goods” that are tangible and moveable objects
can be subject to these agreements, and cloud computing contracts
do not fulfil this requirement.19
In this study, different named agreements’ characteristics
have been attributed to cloud computing contracts depending on the
service provided. For example, in a cloud computing contract made
for storage capacity, infrastructure, or third-party applications,
rules applying to service contracts are most
likely to apply in countries such as England, France, Italy, and
the Netherlands.20
On the other hand, work contract regulations
apply where the cloud provider has agreed to perform customized
services for the users; and lease contracts may be
applicable where the provider offers hosting
services.21
Since several types of classification based on the subject
matter of the contract may be applied to cloud contracts, it is
concluded in the Commission’s report that cloud computing
contracts are “sui generis” contracts, as is
also regarded in the Turkish legal doctrine.
4. Conclusion
Both in Turkish Law and European Union Law, cloud computing
contracts are not classified as a special type of contract. Rather,
they are considered sui generis contracts that carry the
characteristics of different types of agreements, such as lease,
employment, and service contracts, depending on the service
provided and the parties of the contract. Therefore, it is
important to understand the functioning of cloud computing
contracts to decide whether the courts will separately apply
provisions of the legal agreements that cloud computing contracts
carry the characteristics of; or whether a judicial law-making will
be required each time a cloud computing contract is subject to a
dispute.
Footnotes
1. Information Commissioner’s Office,
“Personal Information Online Code of Practice,”
accessed September 29, 2022, https://ico.org.uk/media/for-organisations/documents/1591/personal_information_online_cop.pdf.
2. European Commission,
“Communication from The Commission to The European
Parliament, The Council, The European Economic and Social Committee
and The Committee of The Regions,” 2.
3. Aybike Tunç, “Bulut
Bilisim Sözlesmelerinin Hukuki Yapisi” (Doktora tezi,
Ankara Haci Bayram Veli Üniversitesi, 2020), 5-6.
4. Tunç, “Bulut
Bilisim,”35-36.
5. IBM Cloud Education, “SOA
(Service-Oriented Architecture),” accessed 29 September
2022, https://www.ibm.com/cloud/learn/soa.
6. CISCO, “What are network
services?” accessed 29 September 2022, https://www.cisco.com/c/en/us/solutions/enterprise-networks/what-are-network-services.html.
7. Resolution of the Personal Data
Protection Board dated 23/12/2021 and numbered 2021/1304 on
blacklisting practices in the car rental sector, https://kvkk.gov.tr/Icerik/7414/2021-1304
8. Tunç, “Bulut
Bilisim,”13.
9. Hesham Elmasry, “Cloud computing:
A study of infrastructure as a service (IAAS),” accessed 31
October 2022, 62.
10. Tunç, “Bulut
Bilisim,” 45.
11. Tunç, “Bulut
Bilisim,” 45.
12. Ibid.
13. Ibid., 46.
14. BGH, Urt. V. 15.11.2006 – XII ZR
120/04.
15. Tunç, “Bulut
Bilisim,”46.
16. Ibid., 49.
17. Basak Erdem, “Bulut Bilisim
Uygulama Maliyetlerinin, Müsteri Isletmeler Tarafindan
Muhasebelestirilmesi,” (Istanbul Ticaret Üniversitesi,
Muhasebe ve Denetime Bakis Dergisi, 2020), 238.
18. Tunç, “Bulut
Bilisim,”27.
19. European Commission,
“Comparative Study on Cloud Computing Contracts,”
accessed 1 September 2022, https://data.europa.eu/doi/10.2838/16333.
20. Ibid.
21. European Commission,
“Comparative Study on Cloud Computing Contracts,”
accessed 1 September 2022, https://data.europa.eu/doi/10.2838/16333.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.