Högskolan i Skövde

Technological progress poses unique challenges for the public sector. New technology should be adopted, but it must always be done within the framework of good administration. It follows laws governing public administration must be continuously adapted. Sweden recently amended its secrecy legislation to facilitate the use of third-party cloud solutions by public authorities. When the amendment was enacted, most public sector organisations had already been using external cloud solutions for a long time. Today, there is as much pressure on authorities to implement AI technology as there ever was to move administration into the cloud. This paper uses traditional legal methodology to investigate if the Swedish secrecy legislation adequately enables the use of cloud-based GenAI solutions. Findings indicate that the recent amendment is likely insufficient and that there are significant practical hurdles for the application of the law, particularly with services from global cloud providers. The paper contributes to the understanding of Swedish law, and of the difficulties that can occur anywhere when policy makers and legislators do not move in tandem.

With increased adoption and use of cloud-based software-as-a-service (SaaS) solutions from international providers many public sector organisations expose themselves to a dependency on specific providers and a range of different lock-in effects. The article reports from a case study which investigated how a large Swedish public sector organisation addressed licensing issues and lock-in effects during adoption and use of a SaaS solution (Microsoft 365). The study identifies problematic licensing issues and presents a legal analysis related to the organisational implementation of the SaaS solution in the specific organisation. Findings show that the organisation has failed to successfully obtain all necessary licences and all necessary rights which would allow for long-term maintenance of all its digital assets independently of the SaaS solution currently in use.

Implementation and use of an IT standard in software involves legal, technical and societal challenges. This paper addresses how an organisation can, and should, determine the conditions for implementation and use of the HEVC standard in software. The investigation considers the availability of the standard’s complete technical specification and the extent to which an organisation can access the information necessary to assess the licence conditions for standard essential patents impinging on the standard. Through an action case study approach the investigation analyses declarations in patent databases relevant to the standard and seeks to obtain patent licences from each declarant permitting implementation of the standard in software, where that software is to be provided under one (or several) of three specific open source software licences, and alternatively to be provided as an online service. Our analysis of legal and licensing conditions for use of the standard shows significant obstacles. We find that it is impossible to obtain licences from patent holders that would allow for implementation and use of the standard in open source software. The paper illuminates significant challenges related to conditions for use of the standard under (F)RAND terms and identifies that references to the standard in public procurement projects lead to anti-competitive effects.

Many public sector organisations (PSO) use SaaS solutions from dominant global providers. Implementation of these solutions may raise issues concerning both lawful data processing, and the obligations that those PSOs have to maintain their digital assets. One example is a large Swedish PSO which addressed these issues as part of the adoption and implementation of Microsoft 365. The study identifies challenges and presents an analysis of the organisational implementation of that SaaS solution, exposing legal issues that arose in that context. Findings show an absence of a documented risk analysis related to the PSO's use of that SaaS solution, covering data processing and maintenance of its digital assets. Recommendations are presented to facilitate a PSO's procurement and implementation of such a SaaS solution to address issues around data processing and the processing of digital assets.

Open source software (OSS) and open standards have become increasingly important for addressing challenges related to lock-in, interoperability and long-term maintenance of systems and associated digital assets. OSS projects operate under different conditions and many projects and organisations consider successful governance and strategic involvement with projects to constitute major challenges. Today, many companies seek to establish work practices which facilitate strategic engagement with OSS projects. Based on findings from collaborative research which draws from rich insights and extensive experiences from practice, the paper presents seven actionable strategies for organisations that seek to leverage long-term involvement with OSS projects. 

Lawful and appropriate use of cloud-based globally provided Software-as-a-Service (SaaS) solutions by a public sector organisation (PSO) for data processing and maintenance of digital assets presupposes an investigation of all relevant contract terms. Having obtained, analysed, and filed all relevant contract terms when using a SaaS solution is a prerequisite for good administration. Identifying and obtaining all relevant contract terms for a SaaS solution involves significant obstacles which in practice may be impossible to overcome for each PSO. This paper addresses how PSOs investigate contract terms prior to adoption, and why PSOs use a globally provided SaaS solution without having identified and obtained all relevant contract terms. Through a review of responses to questions and public documents from Swedish PSOs we analysed how each PSO had investigated contract terms and licences for the Microsoft 365 (M365) solution prior to adoption and use of the solution in each PSO. We find that no PSO had investigated all relevant contract terms prior to use of M365, which implies that each PSO uses M365 under unknown contract terms. Further, we find that all PSOs use M365 for data processing of its digital assets under unknown contract terms and that each PSO has significant dependence and trust in its supplier.

Over the years, the importance of open standards has been acknowledged in EU and national policies. Formal (e.g., ISO) standards are often referred to in software development and procurement. Use of formal (ISO) standards and to what extent ISO standards can be implemented in open source software is considered, with particular reference to patent licensing. It is shown that not all formal standards are open standards and that FRAND commitments may impose major challenges for use of such standards. Further policies and procedures set by standards setting organisations (SSOs) regarding the notification of standards-essential patents (SEPs) present challenges for organisations wishing to implement standards in software. This chapter elaborates implications and suggests ways of addressing the challenges identified. Use of formal standards may create barriers for implementation in open source software and inhibit an open and inclusive business-friendly ecosystem. 

When a public sector organisation (PSO) uses a software as a service (SaaS) solution from a global provider this imposes risks for different types of lock-in effects. In turn, use of such solutions by PSOs may prevent full control of digital assets that need to be created, processed, maintained, and archived for use and reuse over long life-cycles. This paper addresses perceived and actual lock-in effects related to use of SaaS solutions in the public sector. We review perceptions of lock-in amongst government agencies and investigate how 46 PSOs have addressed challenges related to obtaining licences and an effective exit plan related to use of the Microsoft Office 365 SaaS solution. Through a review of responses to a survey conducted by the Swedish Government Offices we find significant misconceptions concerning lock-in effects. We find that every one of the 46 PSOs investigated neither obtained necessary licences nor established an effective exit strategy to allow the PSO to independently access, process and maintain digital assets processed by the SaaS solution after decommissioning. We present recommendations for any PSO considering use of a SaaS solution.

As software as a service (SaaS) adoption increases in both the public and private sectors, so does dependency on specific providers and technologies and the consequent danger of lock-in. This paper reports on how public sector organisations (PSOs) can, and should, avoid lock-in throughout the lifecycle (commissioning, deployment and decommissioning) of their deployment of the Microsoft Office 365 SaaS product (O365). We investigate how 33 PSOs address different lock-in effects, focussing on the City of Gothenburg, and show that none of the PSOs determined possible lock-in effects prior to implementation or were able to provide documented evidence that they would be able to independently access, process and maintain the digital assets processed by the SaaS solution after decommissioning. We also report on jurisdictional and data processing issues, with consequent impact on digital sovereignty.

As with any other open source field, there are countless far-reaching advantages in open hardware licensing, as opposed to its proprietary counterpart. This paper takes the example of a low-cost portable mechanical ventilator design and considers the effect of the application of the three different variants of the newly-released CERN Open Hardware Licence Version 2. This paper considers the importance of licensing, and demonstrates how open hardware licensing can facilitate efficient further development of a project, improve its safety and reliability, and encourage collaboration. Most importantly, open hardware licensing allows anyone to freely use, study, modify and distribute improvements to project design, and make, sell or otherwise distribute products made to that design, making it a cost-effective means of developing and deploying the device throughout the world, from the most developed to the most vulnerable territories. Finally, this paper argues that open hardware licensing also encourages economic activity whilst it protects third-party intellectual property rights.