Microsoft vs the US Government could have implications for cloud services in BC

The US Supreme Court is currently hearing arguments in a cloud computing case that could have implications for the BC higher education sector interested in using cloud services.

For years, FIPPA legislation in British Columbia has been both a hurdle and a blessing (depending on your perspective. Mine changes almost daily) for post-secondary institutions wishing to utilize cloud based services that store data outside of Canada. Section 30.1  of BC's privacy legislation states that, “A public body must ensure that personal information in its custody or under its control is stored only in Canada and accessed only in Canada,” unless prior consent is received or another section of FIPPA supersedes this requirement.

Recently, we have seen moves from companies like Microsoft and Amazon to set up data centres here in Canada, in part to help meet the data sovereignty requirements of legislation like BC's. The belief being that local data centres can help contain the data within Canadian legislative boundaries. It is the same strategy/belief that led Microsoft to set up data centres in Ireland.

Which is the crux of this US Supreme Court case currently underway. The US Department of Justice is trying to get Microsoft to turn over emails that are stored in their Ireland data centre.

If Microsoft loses this case and are forced to hand over emails to the US government that are stored on their servers in Ireland, then they could conceivably be forced to hand over data stored on their data servers in Canada at some point in the future. Meaning that having data stored in an Amazon or Microsoft data centre in Canada would be a moot point as it would not be able to provide the level of data sovereignty protection FIPPA needs.

When the most recent review of BC's FIPPA legislation occurred,  post-secondary organizations like BCNET and thr Research Universities Council of BC made the case to the BC privacy commission that section 301. is a barrier to the use of cloud based systems in higher ed in this province. At that time, the commission noted that, with Microsoft, Adobe and Amazon setting up data centres in Canada, that should provide adequate services to Canadians and satisfy the FIPPA legislation. However, should Microsoft lose this case and be forced to turn over data stored in Ireland, it could be a moot point.

On the other side, it could be a real opportunity for Canadian organizations who do provide cloud service, like BCNET through their EduCloud service, and spur a greater demand for self hosted applications and Canadian based companies to emerge with made in Canada education technology solutions .

Sources:

• What’s at stake in the Microsoft Supreme Court case, The Verge, Feb 26/18
• Analysis of Microsoft-Ireland Supreme Court Oral Argument, Lawfare, Feb 27/18
  
• 3 Bad Signs for the Tech Industry at the Supreme Court, Axios, Feb 27/18