Cloud computing is a technology that is rapidly developing due to its benefits like minimizing the costs of operations while eliminating the burden of managing hardware and software. As cloud computing spreads to a wider range of users, cloud computing contracts -contracts that are regarding the performance of the services offered by cloud computing service providers- are starting to draw more attention in the legal field. It is essential to determine the qualification of cloud computing contracts within the legal framework since this shall affect the legal provisions to be applied to the disputes arising from such contracts. This article focuses on the classification of cloud computing contracts in the Turkish and European legal frameworks.
1. Cloud computing and cloud computing service models
Prior to classifying cloud computing contracts, it is important to understand what kind of services are provided pursuant to such contracts and who the parties to the contracts are.
The term "cloud computing" does not have a common legal definition, and various jurisdictions have different definitions regarding said term. According to Information Commissioner's Office, cloud computing is internet-based computing that "involves an organization using services - for example, data storage - provided through the internet."1 The Communication European Council has published statements that cloud computing is defined as storing, processing, and using data on remotely located computers accessed over the internet.2 Based upon these definitions, cloud computing can be understood as everything relating to distributing, managing, serving; and storing applications, services, and data relating to these activities.3
The main services cloud computing can provide under these service system types are virtualization, service-oriented architecture, and network services.
Virtualization is when software mimics the physical computers to optimize energy consumption, economize on the physical space that computers carrying servers will take, and maximize the capacity.4
Service-oriented architecture is a way to make software components reusable and interoperable via common interface standards, rapidly incorporating them into new applications and making it easier for the user to use different and incompatible systems together.5
Network services can be defined as applications at the network application layer that connects users working in offices, branches, or remote locations to applications and data in a network.6
If a company is using cloud computing, it is regarded that the data is kept in a data center reserved by a cloud computing service provider with infrastructures outside the company. The data centers may have different cloud service models depending on the type of services they offer. The Turkish Data Protection Authority, in its decision dated 23.12.2021, specifically mentioned three main models as services of cloud computing contracts: Software as a Service ("SaaS"), Platform as a Service ("PaaS"), and Infrastructure as a Service ("IaaS"). 7
The most common cloud computing service model is SaaS, which allows the user to use an application through the web, and mainly aims at developing hardware and software while decreasing the total cost of maintenance and operations.8
On the other hand, PaaS provides services aimed at developers while decreasing the cost of managing, controlling, and purchasing hardware and software components while minimizing the complications. This model allows its user to develop software and program without the burden of managing a server.
IaaS mostly used in services such as data processing, storing, and forming a network while it offers its user software and storage opportunity.9
2. Contractual Status of Cloud Computing Contracts in Turkish Law
Cloud computing contracts are not regulated as special contracts under Turkish Law. As seen from the service models and types mentioned above, the services offered under a cloud computing contract can expand to a large scope that might fall under various contract types. Therefore, the type of the agreement may change depending on who the parties are and what services are offered. To decide on the characteristics of these contracts, parties and the nature of the services provided must be considered.
In cloud computing contracts, there is mostly the obligation of performing duties since the service provider undertakes the responsibility of processing, securing, and backing up data, as well as ensuring the safety and maintenance of the hardware and equipment that is used to keep the data. Some of these obligations can be undertaken by the cloud computing service provider as performance obligations under a contract of mandate. These services include but are not limited to the obligation to process data, maintain the software, and increase the bandwidth if requested by the user and the user receiving financial consultancy through cloud computing.10
On the other hand, users' data being processed after being digitalized, and cloud computing users downloading software into their devices to use cloud computing services are considered as performances of a work contract by some scholars.11 However, as a counterargument, some indicate that this cannot be the case since there is no work created specifically for the cloud computing service users, rather, it is a general service and must be considered as an obligation under a service agreement.12
The dominant view in the Turkish doctrine is that cloud computing contracts mostly have the characteristics of lease agreements.13 The basis for this view is the decision of the German Federal Court, in which the Court concluded that application service provider ("ASP") contracts that allow the provider to temporarily transfer the online usage of software to the users are considered lease agreements.14
Some scholars argue that cloud computing contracts are lease agreements as well, since the cloud computing service provider leaves the use of the software or the right to benefit from it to the user, even if it is virtually, same as the ASP contracts.15 However, according to Turkish Law of Obligations Article 299, only goods can be subject to lease agreements. In cloud computing services, computer programs are subject to transfer of use, and there is serious debate on whether computer programs can be considered goods. It can be seen that in some of its decisions, the German Federal Court decided that computer programs can be classified as goods, yet there is serious criticism of these decisions amongst scholars.16
Whether computer programs can be considered goods is a subject of debate, when there is little doubt that computer programs can be considered as work that can be subject to license agreements under Article 2 of the Law on Intellectual and Artistic Works.17 Therefore, it is more likely a safer ground to consider cloud computing contracts license agreements rather than lease agreements when "transfer of use" is the service provided under these agreements.
As explained above, cloud computing contracts consist of characteristics of different types of agreements and do not fit into just one type of contract. The fact that separate services can be set as the performance obligation in cloud computing contracts prevents these from being considered under a single type of contract and makes them sui generis agreements.18
3. Contractual Status of Cloud Computing Contracts in European Union Law
In the European Union, there is no specific regulation applied to cloud computing contracts as well, and the contractual status of these agreements depends on the classification of the services provided.
In a comparative study conducted by the European Commission on cloud computing contracts, evaluations similar to Turkish scholars' have been made. This study firstly rules out the possibility that cloud computing contracts are sales agreements since only "goods" that are tangible and moveable objects can be subject to these agreements, and cloud computing contracts do not fulfil this requirement.19
In this study, different named agreements' characteristics have been attributed to cloud computing contracts depending on the service provided. For example, in a cloud computing contract made for storage capacity, infrastructure, or third-party applications, rules applying to service contracts are most likely to apply in countries such as England, France, Italy, and the Netherlands.20
On the other hand, work contract regulations apply where the cloud provider has agreed to perform customized services for the users; and lease contracts may be applicable where the provider offers hosting services.21
Since several types of classification based on the subject matter of the contract may be applied to cloud contracts, it is concluded in the Commission's report that cloud computing contracts are "sui generis" contracts, as is also regarded in the Turkish legal doctrine.
Both in Turkish Law and European Union Law, cloud computing contracts are not classified as a special type of contract. Rather, they are considered sui generis contracts that carry the characteristics of different types of agreements, such as lease, employment, and service contracts, depending on the service provided and the parties of the contract. Therefore, it is important to understand the functioning of cloud computing contracts to decide whether the courts will separately apply provisions of the legal agreements that cloud computing contracts carry the characteristics of; or whether a judicial law-making will be required each time a cloud computing contract is subject to a dispute.
1. Information Commissioner's Office, "Personal Information Online Code of Practice," accessed September 29, 2022, https://ico.org.uk/media/for-organisations/documents/1591/personal_information_online_cop.pdf.
2. European Commission, "Communication from The Commission to The European Parliament, The Council, The European Economic and Social Committee and The Committee of The Regions," 2.
3. Aybike Tunç, "Bulut Bilisim Sözlesmelerinin Hukuki Yapisi" (Doktora tezi, Ankara Haci Bayram Veli Üniversitesi, 2020), 5-6.
4. Tunç, "Bulut Bilisim,"35-36.
5. IBM Cloud Education, "SOA (Service-Oriented Architecture)," accessed 29 September 2022, https://www.ibm.com/cloud/learn/soa.
6. CISCO, "What are network services?" accessed 29 September 2022, https://www.cisco.com/c/en/us/solutions/enterprise-networks/what-are-network-services.html.
7. Resolution of the Personal Data Protection Board dated 23/12/2021 and numbered 2021/1304 on blacklisting practices in the car rental sector, https://kvkk.gov.tr/Icerik/7414/2021-1304
8. Tunç, "Bulut Bilisim,"13.
9. Hesham Elmasry, "Cloud computing: A study of infrastructure as a service (IAAS)," accessed 31 October 2022, 62.
10. Tunç, "Bulut Bilisim," 45.
11. Tunç, "Bulut Bilisim," 45.
13. Ibid., 46.
14. BGH, Urt. V. 15.11.2006 - XII ZR 120/04.
15. Tunç, "Bulut Bilisim,"46.
16. Ibid., 49.
17. Basak Erdem, "Bulut Bilisim Uygulama Maliyetlerinin, Müsteri Isletmeler Tarafindan Muhasebelestirilmesi," (Istanbul Ticaret Üniversitesi, Muhasebe ve Denetime Bakis Dergisi, 2020), 238.
18. Tunç, "Bulut Bilisim,"27.
19. European Commission, "Comparative Study on Cloud Computing Contracts," accessed 1 September 2022, https://data.europa.eu/doi/10.2838/16333.
21. European Commission, "Comparative Study on Cloud Computing Contracts," accessed 1 September 2022, https://data.europa.eu/doi/10.2838/16333.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.