Terms of Service: Do you have the right to agree?
April 29th, 2012With the release of Google Drive (Google’s online storage locker, similar to services Dropbox, Microsoft’s Skydrive, Apple’s iCloud, and others), terms of service (ToS), the agreements that govern the use of the service, have gotten increased scrutiny. Ars Technica and others note that Google’s ToS give Google broad power, including the right to display user content for the purposes of promotion of the service. Website The Verge, however, compares various cloud storage services and finds little difference in the ToS. But as of yet unexplored in the coverage of these often opaque legal documents is one key phrase. In Google’s ToS, it reads as follows: “Make sure you have the necessary rights to grant us this license for any content that you submit to our Services.” Dropbox includes a similar phrase: “it’s your responsibility to ensure that you have the rights or permission needed to comply with these Terms.”
This is actually the key legal statement in the use of these services, primarily because ToS change all the time. Companies are under no compulsion to stick with the Terms they originally ran by. Indeed, companies like Facebook and Google have come under intense scrutiny when their ToS changed to grant the company more power over users’ content. This means that users must consider carefully both the rights they are able to grant under the current ToS and any potential changes to the ToS that would nullify their ability to grant the new rights to the company.
For most consumers, this is likely not a big deal. First, most users do not depend on services like Dropbox to a degree that a change in ToS would require the user to disrupt her whole life because she is now forced to stop using the service. Second, most users are able to grant a wide variety of rights to the service provider; for example, a user can grant Google or Facebook the right to use her content for advertising, even if she would prefer it not be used in this way.
But for some users, this power to grant rights is actually a big deal. I am thinking of people in academics who use services like Dropbox for research purposes; that is, they store files being used for research projects, including data from research participants, on free cloud services. The benefits to doing so are obvious. The websites are easy to use, free, and allow for remote collaboration. But can the academic user grant the company the right to use their files for all the purposes required? In the case of Google’s ToS, the answer is absolutely not. Under no circumstances can the academic user allow research data, which the researcher has promised to store securely, be used for purposes of advertising. And thus, it is irresponsible, and even a violation of the Institutional Review Board agreement granting the user the right to perform the research, to use free services such as Google Drive (because of current ToS) and Dropbox (because of potential changes to ToS).
A reasonable researcher might respond that services like Dropbox do not currently mention anything about using the data for advertising, and furthermore, that he could remove the data in a timely fashion should the ToS change. To this well-reasoned point, I have four rejoinders. First, it is important to recognize that services like Dropbox are free only as a strategy to make money; companies offering free services are only hoping that by doing so, they are able to turn a profit faster. They can make a profit by offering premium services that cost extra, by selling data about their users, or both. If strategy one doesn’t work, and if strategy two requires a change in ToS, which is more likely: bankruptcy or a simple change to the legalese governing use of the site? Dropbox, as an example, is still a company hoping to become very profitable. Given all the competition, this is something that will require the company to find new sources of revenue; as such, a change in ToS is not out of the question.
Second, given the wide array of options that exist that do not require granting extensive rights to the service provider, why bother with the free service? Most academic departments should have some sort of networked storage option that functions similarly to Dropbox. Though perhaps accessing these networked drives is a bit more complicated than accessing Dropbox, it is still far less complicated than having to change an entire research workflow when ToS change.
Third, the ToS issue has less to do with what the company might or could do, and more to do with the understanding of what rights the researcher has to grant. In the case of sensitive data, the researcher’s hands are tied. No matter how much she promises to be careful and keep access to the files limited, the fact remains that she may not have the rights to grant; in these cases, her agreement to the ToS is fraudulent. That does not mean she will get in trouble with the content provider, but it does mean she has few legal rights should something happen to the data. The content provider may not be liable because the ToS protect them in cases where hackers gain access to the data (or other possibilities, including the use of the data for advertising purposes). The University is not liable because the researcher did not properly store the data and agreed to ToS that she had no right to do so. Instead, the only one liable is the irresponsible researcher who chose convenience over properly protecting the data.
Fourth, there is no guarantee that services like Dropbox will remain open and running in the future. The data storage site Megaupload was recently shut down, not because it was unprofitable but because it was raided by the Department of Justice for storing, among many legal files, some copyrighted material. Megaupload had 180 million registered users and was at one time the 13th most visited website in the world. If it can be shut down, then how can a service like Dropbox be guaranteed to avoid the same fate?
The issue in question here is a complicated one. Companies have no interest in radically altering their ToS to give them rights that would make it blatantly illegal for researchers to store their data with the service; such a change would make the service instantly unpopular and hence unprofitable. And companies, generally, have no interest in using user data in ways that would fit with the existing ToS but would be unpalatable to the user. And all servers networked to the world wide web can be hacked, whether university-hosted or run by a private company.
While these things may be true, it does not change the fact that there is risk involved in agreeing to ToS without having the necessary rights to do so. There is also risk in dependence upon a third-party, for-profit service to conduct research. I would urge all researchers currently using services like Dropbox and other private cloud storage providers to consider switching to safer services. These services may cost more money, but the protections they offer are truly invaluable.
