Hiding Behind the Cloud: SaaS Companies Shift Liability to Customers
In the evolution of many business-focused technologies, early adopters are often larger corporations and governmental bodies that can afford both the technology and the risks associated with its use. As technology becomes more affordable, small- and medium-sized businesses (SMBs), local associations such as homeowners associations (HOAs), and even individuals begin adopting these new tools.
While the users of technology may morph over time, the underlying contracts governing its use may remain static. Which company–the vendor or purchaser–is responsible if something goes wrong, who owns any data collected, etc., has already been determined by the time smaller businesses sign contracts. Smaller businesses may also lack the leverage to negotiate master service agreements or fully understand the legal obligations they are accepting (along with their financial implications). As a result, they may assume unanticipated operational and legal burdens.
Flock Safety: Illustrating the Point
Crime prevention and security are among the many industries incorporating artificial intelligence, expanding beyond simple CCTV to AI-driven Automated License Plate Readers (ALPRs). Companies like Flock Safety have rapidly expanded into the private sector, with retailers such as Lowes and Home Depot as well as community organizations such as HOAs purchasing the technology. Similar to CCTV, ALPRs capture data including license plate information. Among the distinctions is where the data resides, who owns it, who can access it and at what cost.
Flock Safety is one of many Software-as-a-Service (SaaS) companies whose underlying contractual framework fundamentally alters legal liability. By utilizing a SaaS model, Flock ensures that the customer is the legal custodian of all data even though the information is stored in Flock’s cloud.
This model raises a critical question for civil litigation: when third parties subpoena Flock Safety data such as surveillance footage or car type (e.g., make and model), who bears the operational and financial burden of compliance? As civil litigants increasingly target ALPR networks for evidence, the legal system will have to examine how SaaS agreements trap private buyers with unforeseen legal responsibility while freeing providers from the costs of civil discovery.
An Overview of SaaS Contracts
Traditionally, when a private entity installed security cameras, the physical hard drives remained on-site, making the customer the obvious data custodian. Modern ALPR networks, however, operate entirely through the cloud. By structuring its deployments through a SaaS framework, Flock Safety positions itself as a vendor that processes data.
This distinction is reflected in Flock’s Customer Terms and Conditions. Under Section 4.1, the agreement provides, “As between Flock and Customer, all right, title, and interest in and to Customer Data belong to and are retained by Customer.” The customer grants Flock a limited, non-exclusive license to use and disclose the data to provide the service. In the realm of contract law, this is strategic risk allocation. It establishes that Flock does not legally own the intelligence its hardware gathers, insulating the corporate entity from the costs associated with handing it over. Requiring customers to grant Flock license to use the data gives it an on-going, free source of data with which to feed its AI model.
Flock has also emphasized customer ownership publicly. Flock representative Kerry McCormack stated during city council privacy hearings, “One hundred per cent of data… is owned by our customers.”
Rather than disclose data or respond on behalf of its customers, Flock will systematically re-direct any legal request to the affected private buyer. Through these interconnected contractual clauses, Flock scales its physical and digital footprint while comprehensively offloading the legal responsibilities of data management to the end user. This distinction between data ownership and data usage is a key component in many SaaS business master service agreements irrespective of industry.
Using Federal Statute as a Shield
Some SaaS-based companies may use federal telecommunications law as a foundation for their contractual position. Specifically, Flock categorizes itself as a provider of an Electronic Communication Service (ECS) under the Stored Communications Act (SCA).
An ECS is “any service which provides…the ability to send or receive wire or electronic communications.” Because the license plate images and vehicle information captured by Flock’s cameras are transmitted as digital signals over cloud networks, the system functions as a channel for electronic communications.
Under 18 U.S.C. § 2702, the SCA strictly prohibits ECS providers from knowingly divulging the contents of stored data or communications to private third parties without the explicit consent of the subscriber. This statutory definition asserts that Flock is legally forbidden from handing over surveillance footage to private litigants, effectively transforming a data privacy statute into a shield against civil discovery.
This statutory defense is fortified by well-established legal precedent. Courts have consistently ruled that civil litigants cannot circumvent the SCA by subpoenaing service providers directly. In landmark cases such as In re Subpoena Duces Tecum to AOL, LLC, 550 F. Supp. 2d 606 (E.D. Va. 2008), the judiciary confirmed that an internet service provider cannot be compelled to produce user data for third-party civil litigation. Flock could apply similar legal logic to its operations, arguing that it is the equivalent of an email provider storing data (in the form of email) for an HOA. Consequently, if a lawyer representing a plaintiff in a personal injury or divorce case attempts to subpoena Flock directly for license plate footage, the company relies on the SCA to quickly quash the request, successfully ending any further legal actions.
The Hidden Cost
When an SaaS company such as Flock successfully quashes or redirects a civil subpoena using the Stored Communications Act or other applicable law, the legal demand does not vanish; it simply pivots. It is redirected to the customer. Once served, a small business or HOA is suddenly thrust into the role of a sophisticated evidence custodian. The customer must retain legal counsel for litigation holds and e-discovery management, and technical support to carefully redact ALPR footage to avoid state privacy violations. Because Flock’s contract disclaims any duty to process these third-party demands, the buyer may initially bear significant attorney and e-discovery costs associated with responding. California law provides some protection against those costs: CCP § 1985.8(l) requires a court ordering a nonparty to comply with an electronic discovery subpoena to protect that nonparty from undue burden or expense. But seeking that protection may itself require the customer to raise the issue before the court, adding another layer of legal expense to the discovery process.
Conclusion
Flock Safety and products like it are becoming more and more common in the private security industry. Using a SaaS framework to scale its network while systematically shedding liability allows Flock to shift legal burdens onto customers who can ill afford them. By design, it divests data ownership and leverages the law to create an impenetrable statutory shield and isolate itself from third-party litigation. The true price of their service is never represented on the initial purchase invoice, but in the attorney and other secondary fees necessary to combat civil complaints.
Until courts or legislatures choose to address this contractual workaround, we can expect surveillance services as well as other industries reliant on SaaS to be able to put SMBs in the position of unpaid, legally exposed data custodians; or, in the case of Flock Safety, of a sprawling and increasingly controversial, surveillance grid.
*The views expressed in this article do not represent the views of Santa Clara University.
Comments