The law applicable to cloud computing contracts

The subject of this study, which is prepared as a master's thesis, is determining the law applicable to cloud computing contracts. Cloud computing is a business model in which the computing capacity and computer functions that are put into operation through data centers located in distributed locations around the world are offered to customers who request it over the internet. The term cloud computing contract is used to express all of the contracts concluded for the purpose of acquiring digital services that cloud computing technology constitutes its infrastructure. Cloud computing service providers mostly provide services on the internet globally and enter into legal relations with customers of various nationalities living in different countries through the standard contracts they unilaterally prepare. In our study, the technical aspects of cloud computing technology, the characteristics of cloud computing contracts and the law applicable to cloud computing contracts are examined. The story of cloud computing is started simultaneously with the emergence of the internet as a phenomenon. It is stated that the ultimate goal of the researchers leading the development of the Internet was the idea of providing information resources as a public utility over a global network connection. On the way to this goal, model technologies called cluster computing and grid computing were the first generation internet technologies. To put it briefly, in cluster computing, computer equipment located in the same place is connected to each other via a network connection and a larger information resource is created, while in grid computing, computer equipment located in different locations is connected to each other over the network connection, creating a distributed computing resource pool. The most important features of the aforementioned first generation information technologies are that they are put into operation mostly for scientific and professional purposes, and the point where the purpose of use starts to turn into commercial purposes represents the emergence of cloud computing technologies. In cloud computing, unlike cluster computing, computing resources are created through distributed data centers around the world, while the most important point that distinguishes cloud computing from grid computing is that each computing resource is independent in grid computing, whereas in cloud computing, there is only one owner of distributed data centers. Cloud computing is the name given to the business model in which the pool of information resources, which are formed globally through data centers located in different parts of the world, are offered as a service for commercial purposes and with the motive of obtaining economic benefits, to the customers who request it. Today, the most important cloud computing service providers are American companies such as Amazon, Microsoft, Google and Chinese companies such as Alibaba and Tencent. These companies offer cloud computing services in many different types and forms. In the doctrine, cloud computing service models are examined under three headings as Infrastructure as a Service, Platform as a Service and Software as a Service. Infrastructure service consists of the provision of a raw computing infrastructure and, in this sense, basic computer functions to customers who request it over the internet. Unlike the infrastructure service, in platform service, instead of a raw computing infrastructure, a more structured service is offered by offering various programming and software tools to customers in addition to basic computer functions. Finally, in the software service, various digital services developed over the cloud computing infrastructure are offered to end-users. In this triple structure of cloud computing service models, there is the infrastructure service model at the bottom layer and the software service model at the top layer. While the intensity of the service offered increases as you move from the lowest layer to the upper layers, the authority of the customers to make changes on the infrastructure increases as they descend from the upper layers to the lower layers. Since cloud computing services are offered on the internet, contracts for these services are also concluded by clicking on the internet (clickwrap) or by giving the opportunity to browse the contract (browsewrap). Cloud computing contracts are standard contracts with general transaction terms. In practice, these agreements consist of texts such as Terms of Service, Service Level Agreements, Acceptable Use Policy Agreements and Privacy Policy. Cloud computing contracts are offered to users unilaterally at the beginning of service provision, take it or leave it style, and users are not given the opportunity to negotiate the terms of the contract. Infrastructure provider, platform provider or software provider may constitute one of the parties of cloud computing contracts as service providers. Customers, on the other hand, may be software service providers that receive cloud computing services from infrastructure or platform service providers, as well as individual or corporate users who are end users and use cloud computing services for their own personal needs or for their commercial or professional activities. The main obligation of the service providers in cloud computing contracts is to provide the cloud computing service, which is the subject of the contract, in an uninterrupted manner. The debt of the users is to pay the fee determined in the cloud computing contracts concluded for a fee, and to consent to the use of their personal data for commercial purposes in the contracts concluded in return for the use of personal data. Apart from these basic obligations, both parties of the contract may have various obligations in the nature of primary or secondary performance obligations. Cloud computing contracts are not regulated as a special contract type in Turkish law and other national laws. This leads us to the conclusion that cloud computing contracts are innominate contracts. Since the debts of the service provider in cloud computing contracts mainly consist of acts of service, it is possible to qualify these contracts as innominate service contracts. Since in the system of Turkish Code of Obligations (TCO), the rules regarding the contracts of mandate are recognized as general provisions for anonymous innominate contracts, the provisions of the TCO regarding the contracts of mandate can be applied to cloud computing contracts to the extent that they are suitable to the concrete case. Cloud computing contracts are in the category of synallagmatic contracts, imposing debts on both parties in terms of performance relationship, and in the group of indefinite contracts in terms of duration. Since cloud computing contracts mostly appear as standard contracts containing general transaction terms, these contracts may be subjected to judicial review regulated in the TCO and the unfair terms review regulated in the Consumer Protection Law. In terms of the enforcement of general transaction terms, it has been evaluated that cloud computing contracts concluded with consumers can be subject to sanction in cases where they are not written in the consumer's mother tongue. Apart from this, it is also important that the provisions of the contract are brought to the attention of the consumer at the beginning of the service provision in an easily accessible way. In terms of interpretation control, it has been pointed out that the terms of the cloud computing contracts, the meaning of which cannot be determined, can be interpreted against the service provider and in favor of the customers. A distinction has been made between cloud computing contracts concluded between traders and cloud computing contracts concluded with consumers in terms of content review of general transaction terms. It was emphasized that the threshold for breach of the good faith will be kept high in content control in terms of cloud computing contracts concluded between traders. In terms of cloud computing contracts concluded with consumers, the application of unfair terms control in the Consumer Protection Law and provisions of the Regulation on Unfair Terms in Consumer Contracts have been examined. However, it should not be forgotten that in order for the general transaction terms and unfair terms review to be applied to cloud computing contracts as in Turkish law, the law appicable to the contract must be determined as Turkish law or special conflict rules must authorize individual substantive law rules of Turkish law. In the second chapter, the law applicable to cloud computing contracts has been tried to be explained in the light of Turkish conflict of laws and by making use of EU private international law instruments. First of all, it has been pointed out that cloud computing contracts are structurally international contracts, and it is underlined that the law applicable to these contracts, which will be considered as contracts containing foreign elements in Turkish courts, will be determined by the conflict of laws method. Since the starting point of the conflict of laws analysis is to qualify the legal relationship subject to the dispute, it has been explained how cloud computing contracts can be qualified in terms of subject and parties. Accordingly, since they are innominate debt contracts in terms of cloud computing contracts, they fall within the scope of the general and special provisions regarding the law applicable to debt relations arising from the contract regulated in the Code on International Private and Procedural Law (CIPPL). It has been concluded that cloud computing contracts can be characterized as contracts concluded for commercial or professional activities and contracts concluded for personal or family needs, according to the parties' desire for transaction. Each of the cloud computing contracts concluded for infrastructure services, platform services and software services are contracts that can be concluded as part of commercial or professional activities. Therefore, the law applicable to these contracts can be determined in accordance with Article 24, which is the general rule regarding the law applicable to the debt relations arising from the contract. On the other hand, cloud computing contracts, which can be said to be concluded for personal or family needs and can be characterized as consumer contracts in this sense, are cloud computing contracts concluded for software services. Since it is possible to conclude cloud computing contracts for software services both as part of commercial or professional activities and for personal or family needs, the qualification of these contracts will be made according to the elements of the legal relationship in the concrete case. Due to the fact that cloud computing contracts are indefinite contracts, it is possible that customers desire for the transaction may change over time in these contracts, which can continue for a long time. Therefore, the qualification of cloud computing contracts should be made according to the form of the legal relationship between the parties at the time of the dispute. After the existence and validity of cloud computing contracts are discussed in detail in the first chapter, the question of the applicable law to the existence and validity of these contracts, which contain a foreign element, is discussed in the second sub-title of the second chapter. Legal issues related to the existence of cloud computing contracts are related to issues such as when the acts of the parties will mean offer and acceptance, and the enforcement of general transaction conditions. Legal issues related to the validity of cloud computing contracts, on the other hand, correspond to legal issues such as disability of will, content control of general transaction terms. The conflict of laws rule regarding the subject is located at Article 32 of the CIPPL. Accordingly, the law applicable to the substance of the contract will also be applied to the issues related to the existence and material validity of the contract. However, effect may be given to the law of habitual residence of the relevant party, limited to the objections that one of the parties may raise regarding the existence of the contract, regarding the fact that its own act does not mean acceptance. The special conditions regarding the said exceptional situation are discussed with examples in this sub-title. In the third sub-title of the second chapter, the subject of applicable law to the cloud computing contracts concluded as a result of commercial or professional activities has been examined. Since applicable conflict of laws rule is Article 24 of the CIPPL, the subject has been discussed pursuant to this rule. In this context, the situations in which a choice of law is made by the parties and which is not done are explained under separate headings. In terms of cloud computing contracts which the applicable law is chosen, the conditions of choice of law in terms of Turkish conflict of laws and the subject of law applicable to the existence and validity of choice of law agreements, which are a separate conflict of laws contract, are discussed separately. In determining the applicable law to the cloud computing contracts with objective method, implementation of Article 24/IV of the CIPPL is explored in detail. In this context, it has been concluded that the debtor of the characteristic performance in cloud computing contracts is the service provider. The issue of how to determine the law of place of business and the law of the place of residence of the service provider has been examined depending on the possibility of the service provider being a natural person or a legal person. As a secondary connecting factor, the problems that domicile as a connecting factor could pose are indicated. Finally, it has been evaluated in which cases the more closely related law may come to the fore in cloud computing contracts where no choice of law is made. The possible effects of the overriding mandatory rules, which are the set of rules that may prevent the application of the applicable law to the cloud computing contracts concluded as a result of commercial or professional activities examined under a separate title. In this framework, it has been concluded that the amendments made in the Code on The Regulation Of Electronic Commerce on 1 July 2022, which will enter into force on 1 January 2023, can be applied as overriding mandatory rules of Turkish law, specifically for cloud computing contracts concluded as part of commercial or professional activities. As for overriding mandatory rules of third countries, the possible effects of economic sanctions on cloud computing contracts are emphasized. In the fourth sub-title of the second chapter, the subject of applicable law to the cloud computing contracts concluded with consumers has been examined. First of all, it has been discussed that in what circumstances cloud computing contracts concluded with consumers will fall within the scope of the special conflict rule, Article 26 of the CIPPL, on the basis of the conditions stipulated in the second paragraph of the said article. It has been evaluated that the cloud computing contracts concluded with consumers can be included within the scope of the article on the basis of the condition located at the Article 26/II-a of the CIPPL, which can be summarized as involving in commercial activities directed towards the country of habitual residence of the consumer. In this context, it was concluded that in most cases, cloud computing service providers that provide services globally in the virtual environment will meet the requirement of involving in commercial activities directed towards the country of habitual residence of the consumers, and it has been argued that service providers who want to prevent this situation should be obliged to territorialy restrict access to the digital service they offer. The validity of the choice of law agreements in cloud computing contracts concluded with consumers and how to limit the effect of chosen law by the law of the consumer's habitual residence are discussed under separate headings. It has been demonstrated with evidence that the choice of law agreements in cloud computing contracts concluded with consumers cannot be invalidated as unfair terms, provided that they are written in a way that clearly and unambiguously shows the chosen law. It is underlined that if a valid choice of law is made in cloud computing contracts concluded with consumers, the applicable law to the said contract will be the chosen law, and it is emphasised that the law of the habitual residence of the consumer will not be applied as a complete legal system, but it's provisions will only have an individual effect, provided that it gives better legal protection to the consumer in the concrete case. It has been stated that the consumer-protective provisions of the law of the habitual residence of the consumer do not consist of the rules established solely for the specific purpose of protecting the consumer, and it has been stated that all mandatory regulations that create legal consequences in favor of the consumer may limit the effect of the law chosen as the protective rules of the law of the habitual residence of the consumer. In determining the applicable law to the cloud computing contracts concluded with consumers in objective method, the characteristics and application of the consumer's habitual residence law are explained in a seperate title. It has been pointed out that taking the date of the lawsuit as the basis for determining the consumer's habitual residence, while being the general rule, may create some problems. Instead, it was argued that the date of the conclusion of the contract should be taken as the basis. It has been stated that in consumer contracts where the applicable law is chosen, the court will ex officio grant a protective effect to the consumer's habitual residence law, and that in contracts where no choice of law is made, contrary to the general rule, the court may ex officio investigate the law of the consumer's habitual residence. The effect of the overriding mandatory rules in cloud computing contracts concluded with consumers constitutes the last issue of the fourth sub-title of the second chapter. However, since cloud computing contracts concluded with consumers fall within the scope of Article 26, which is a protective special conflicts rule, the discussion of the application of overriding mandatory rules loses its value to a large extent. Because the mandatory provisions in favor of the consumers under the law of the habitual residence of the consumer will already be implemented in accordance with the special conflicts rule, the need for the institution of overriding mandatory rules, which is exceptional in nature, decreases. However, there is no obstacle to the application of traditional overriding mandatory rules, governing the organization and general policy of the state to the cloud computing contracts concluded with consumers. In this context, it has been emphasized that the decisions regarding blocking of access to websites, as an overriding mandatory rule of Turkish law, may have an impact on the performance of cloud computing contracts concluded with consumers.