Commercialization of Customer Data

This issue concerns cloud providers’ use of customer metadata and other anonymized usage data for commercial purposes. Many cloud providers offer free services to individual users in exchange for data, which they then retain, analyze, and otherwise monetize for a range of business-related purposes.1 A somewhat similar dynamic might exist or emerge between enterprise customers and cloud providers. While enterprise customers do typically pay for the cloud services they consume, they nevertheless worry that their cloud service providers gain and may leverage unprecedented insight into their business.2 For example, some enterprise customers have expressed concerns about their providers using their data to compete with them in other lines of business.3 As is the case with broader concerns about the commercialization of user data, the main question may not be whether providers’ can, or should, collect and utilize some user-generated data for non-service-related business purposes. Rather, it is whether customers have actual knowledge of, and meaningful influence over, how cloud providers use their data.

Key Considerations

  • Misuse of confidential customer data. Market concentration presents opportunities for providers to use their know-how, acquired through service provision, to expand the range of their services and compete in other lines of business more effectively.
  • Different standards on how to handle data. Standards for how cloud providers and enterprise customers should treat different types of data (for example, metadata, personal information, sensitive enterprise data, and derived data) vary across countries, regions, and industry. The global reach of the cloud means providers must simultaneously comply with regulations in different jurisdictions and, as applicable, different security standards from a variety of sources.
  • Burdensome transparency requirements. Disclosure standards on commercializing customer metadata and other anonymized data may impose onerous compliance costs on providers, particularly as third-party vendors take on additional roles in data processing.
  • Consumers lack adequate bargaining power with cloud providers. The natural asymmetry in power between cloud providers and customers decreases the customers’ ability to remain informed about and influence cloud providers’ data commercialization practices and policies. Mitigating the adverse effects of this asymmetry may require government support (for example, through laws, regulations, enforcement actions, requiring providers to disclose relevant information on business practices, or otherwise placing limits on the commercialization of customer metadata and other anonymized data).

Stakeholder Perspectives

  • Seek to ensure providers of consumer and enterprise cloud services are transparent about their commercialization of customer metadata and other anonymized usage data.4
  • May consider compelling providers to compensate customers for the commercialization of their data.5
  • Seek to use customer metadata and other anonymized usage data in ways that support their business objectives and better serve customer needs. For consumer cloud services, which are often provided free of charge, providers may seek to commercialize consumer behavior data to recuperate the costs of the service or to improve their service offerings.
  • Likely to oppose, seek to avoid, or otherwise narrowly tailor any mandatory disclosure and compensation requirements for customer data commercialization.6
  • Wish to be informed about and compensated for commercialization of their metadata and other anonymized usage data.
  • Want to prevent providers from using their data for unknown purposes.
  • Want to be able to verify that their data is not being used by providers in violation of their agreements and terms of service.

Potential Ways Ahead

  • Establish rules requiring cloud providers and enterprise customers to publish their standard policies and practices for commercializing metadata and other anonymized usage data.
  • May condition commercialization of customer data on the data subjects’ consent or other bases consistent with prevailing law.7
  • Commission studies on best practices for assessing the value of consumer and enterprise-derived data to guide policies on commercial usage and financial compensation (in consultation with providers and customers).
  • Voluntarily disclose more information about data-processing practices, including with respect to data sharing, the sale of data, and the categories of data collected and used. (This may be a competitive advantage as it can improve customer confidence in their cloud providers.)
  • Provide transparency into the internal decision-making process regarding what consumer and enterprise-derived data will be used and for what purposes.
  • Insist on fair and transparent arrangements on use of consumer/enterprise-derived data hosted on the cloud by CSPs.
  • Industry associations: Develop and publish model contracts that expand customer choice and bargaining power and restrict the purposes for which customer data may be used by providers.

Recent Examples

Notes

1 Rani Molla, “Why your free software is never free,” Recode by Vox, January 29, 2020, https://www.vox.com/recode/2020/1/29/21111848/free-software-privacy-alternative-data.

2 Jerrold Nadler and David N. Cicilline, Investigation of Competition in Digital Markets, (Washington, DC: U.S. House of Representatives, 2020), https://judiciary.house.gov/uploadedfiles/competition_in_digital_markets.pdf?utm_campaign=4493-519#page316.

3 Lauren Thomas, “Wal-Mart is reportedly telling its tech vendors to leave Amazon’s cloud,” CNBC, June 21, 2017, https://www.cnbc.com/2017/06/21/wal-mart-is-reportedly-telling-its-tech-vendors-to-leave-amazons-cloud.html; Sebastian Moss, “Does AWS use customers’ confidential information to build competing products? Bezos offers vague answers,” Data Center Dynamics, July 30, 2020, https://www.datacenterdynamics.com/en/news/does-aws-use-customers-confidential-information-build-competing-products-bezos-offers-vague-answers/; and Christina Farr and Ari Levy, “Target is plotting a big move away from AWS as Amazon takes over retail,” CNBC, August 29, 2017, https://www.cnbc.com/2017/08/29/target-is-moving-away-from-aws-after-amazon-bought-whole-foods.html.

4 Lauren Thomas, “Wal-Mart is reportedly telling its tech vendors to leave Amazon’s cloud,” CNBC, June 21, 2017, https://www.cnbc.com/2017/06/21/wal-mart-is-reportedly-telling-its-tech-vendors-to-leave-amazons-cloud.html; and Sebastian Moss, “Does AWS use customers’ confidential information to build competing products? Bezos offers vague answers,” Data Center Dynamics, July 30, 2020, https://www.datacenterdynamics.com/en/news/does-aws-use-customers-confidential-information-build-competing-products-bezos-offers-vague-answers/.

5 The State of California announced in 2019 that it was considering a “data dividend.” See: Marco della Cava, “Get paid for your data? California governor wants tech companies to show you the money,” USA Today, March 10, 2019, https://www.usatoday.com/story/news/2019/03/03/get-paid-your-data-californias-governor-says-yes-but-critics-wonder-if-penalizes-poor-and-alienates/3022249002/.

6 This hesitance may be born not from categorical opposition to disclosure and transparency, and instead from the practical challenges associated with disclosing what data is shared with which vendors, as many companies have numerous vendors and partners who change frequently. Thus, providers may be more partial to disclosing the categories of vendors and what types of data are shared with them.

7 This may include incidental uses of data and other reasonable uses, for example, such as those stipulated under “legitimate interests” in the GDPR: General Data Protection Regulation (GDPR), “GDPR Legitimate Interests,” GDPR, n.d., https://www.gdpreu.org/the-regulation/key-concepts/legitimate-interest/.