The cloud customer is the controller and is primarily responsible for complying with the law and the Safe Harbour ruling is part of that.