In the February 2009 issue of Campus Counsel, we published an article exploring the growth of cloud computing, and considering some of the many issues related to the adoption and use of cloud computing technologies by higher learning institutions.
The article noted that Lakehead University was an early adopter of cloud technologies in the educational setting. In late 2006, Lakehead decided to move its staff and students from an internally-managed Microsoft Exchange platform to a cloud-based email, calendar and communications platform managed by Google, Inc.
In response, the Lakehead University Faculty Association grieved the decision, claiming that the move to an externally managed service operated by a U.S.-based company impugned the faculty’s right to privacy in their personal and professional communications, which right was protected by the faculty’s collective agreement with the institution.
In a decision released a few weeks ago, the arbitrator who heard the grievance concluded that the outsourcing of the communications service did result in a somewhat increased risk to the privacy of the faculty association members’ communications. However the arbitrator also noted that, from the privacy and confidentiality perspectives, all email systems–whether internally managed or externally hosted–are an inherently weak method of communication, fraught with insecurities, and that email should be considered “as confidential as are postcards.” In this light, and in light of the specific language of the collective agreement’s provisions, the arbitrator concluded that the right to privacy provided in the agreement could not be an absolute one. On this analysis, the arbitrator dismissed the faculty association’s grievance.
This is an interesting decision, and some might construe it as removing a potential hurdle to the adoption of cloud computing systems in higher learning institutions. However, we view the value of the decision as being much more limited: the arbitrator’s conclusions weighed heavily upon both the specific wording of the collective agreement, and the faculty association’s involvement in the development of email policies that acknowledged–even prior to Lakehead’s migration to Google’s cloud services–that email was an inherently insecure method of communication.
What the decision does illustrate, however, is one of the points made in our original article: that the adoption of a cloud service model is a significant endeavour with wide reaching implications which often arise in a number of unexpected areas. As such, it is important to gather the right personnel–including an experienced legal team–comfortable in tackling the complex issues that commonly arise in such service acquisitions.
