Many Canadian businesses are using cloud computing services without knowing it, a survey has found, pointing to a knowledge gap amid widespread privacy and security concerns.

Cloud computing services include hardware, software or data storage services maintained offsite, often by a third party, and accessed over the internet.

Just 29 per cent of 705 senior leaders at Canadian businesses and government organizations said they were using some cloud computing services, according to a survey released by Microsoft Canada Thursday.

However, among the rest, one in five indicated that they used services like Microsoft Web Apps, Microsoft Office 365 and Windows Azure, which are, in fact, cloud computing services.

"One of the things that really stuck out in our eyes was that 19 per cent of those respondents are using the cloud and didn't realize it," John Weigelt, national technology officer for Microsoft Canada, said while releasing the results at an event in Toronto.

A lot of businesses moving into the cloud are doing so without a full comprehension or understanding of what's happening, said John Weigelt, national technology officer for Microsoft Canada. iStock

A lot of businesses moving into the cloud, he added, "are doing so without a full comprehension [or] understanding of what's happening."

Almost half of respondents said the cloud was a "high interest topic" but were hesitant about it because of security or privacy concerns. Organizations that said they were already in the cloud were more likely to express those concerns (52 per cent versus 44 per cent overall).

Of those not in the cloud, only 10 per cent said they had a plan to look at how their business could use cloud computing solutions.

The survey was conducted online in October by Leger Marketing. Respondents were members of the company's online panel, which includes businesses and organizations across all sectors and industries that run at least five computers. Microsoft released only selected results of the survey.

A group of expert panellists who discussed the results following their release made it clear that businesses must do a significant amount of legwork to implement cloud services while ensuring privacy and security.

Businesses using cloud services to manage their data remain accountable for it, noted Ann Cavoukian, Ontario's information and privacy commissioner.

However, she said taking advantage of the flexibility, reliability, much lower costs and enhanced collaboration offered by cloud services while maintaining privacy and security is "eminently doable" if services are designed with privacy and security in mind.

Legal obligations

Toronto privacy lawyer Michael Power suggested said businesses need legal advice to ensure they comply with Canadian laws, which limit the disclosure of private information, require the private sector to provide notice of data storage outside Canada, govern confidentiality of health records and in some provinces restrict the storage of public information outside the country.

He added that laws in both Canada and the United States., including the U.S. Patriot Act, provide for access to data by law enforcement.

Businesses need to ask their cloud providers how they will receive notice if law enforcement wants access to their data and what restrictions there are on the use and disclosure of the data. They should also get details about how data breaches will be dealt with.

He recommended talking to a security consultant as part of the process.

"At the end of the day, I think you need to know who is holding your data, you have to have some measure of oversight, and you have to understand their security policies, procedures and practices," he said. "If you do that, then in a large part, you've met your accountability obligations."

Robert Cook, chief information officer for the University of Toronto, said security and privacy were top concerns cited by the university community when it was polled about the possibility of delivering university email services via the cloud.

Meeting obligations

The university was looking into that option, he said, because it was no longer able to provide a level of email service itself that satisfied the community and believed that cloud services could deliver higher quality service at a lower price.

He said his organization ensured it was meeting its obligations by conducting a risk analysis and privacy impact assessment in partnership with Microsoft, which was contracted to deliver the email services.

Weigelt said Microsoft undergoes third-party audits of its privacy and security measures and ensures it is aware of privacy obligations in different countries. But he warned that other cloud providers may mainly do work in a particular country and may not necessarily know the obligations in Canada.

He acknowledged that companies have to do a lot of legwork to ensure privacy and security in the cloud, but he argued that similar work would need to be done to ensure privacy requirements are met by data services kept in-house.

"It's the same legwork in the cloud," he said. "There's no added effort."

By Emily Chung, CBC News

Posted: Nov 25, 2011 12:15 PM ET