From: The Guardian (UK)
Regulatory issues around data protection and security can be addressed to realise the potential of cloud computing
Cloud and EU regulation: the facts
Who can fail to have noticed the emergence of cloud as the current technology buzzword? Recent commentary has explained how the cloud can transform business and yet sceptics have been falling over themselves to highlight the barriers to its realisation. However, cloud computing entails many of the same considerations and controls as outsourcing to an offshore vendor and, as such, the issues can be addressed and the advantages of cloud computing realised.
Under a traditional outsourcing, a customer may outsource a process to a vendor but the obligation of compliance concerning that process remains with the customer. In exactly the same way, when a European company signs up to a cloud service, although the cloud vendor is handling the company’s data, it is the company that retains responsibility for how the cloud vendor does so. The key issue to appreciate is the treatment of data in the cloud. In many ways, cloud computing is already regulated, at least insofar as data is concerned.
Data protection and security
European data protection law stipulates tight controls on the processing of personal data and its transfer outside the European Economic Area (EEA). As a result of the uncertainties over how and where a cloud vendor will store data, there is the potential to put customers in breach of such law. Therefore, much of the regulation affecting cloud computing is associated with data protection and security. How data is processed, and where the data is processed is critical.
Data processing
European law requires “appropriate technical and organisational measures” to be taken against unauthorised or unlawful processing of personal data (ie: any information relating to an identified or identifiable natural person) and against accidental loss destruction of, or damage to, such data. As a result, data controllers (customers) should have a written agreement in place with the cloud vendor requiring that vendor to only process personal data in accordance with the data controller’s instructions and to have in place appropriate technical and organisational measures. Conversely, the standard approach of many cloud vendors is to include provisions specifically excluding liability for security of any data.
Data location
One of the benefits of cloud computing is that data is abstracted; data is held somewhere else – typically in a cheaper jurisdiction. The technology means the data can be accessed quickly and easily such that the user is not aware of the physical location.
Personal data can only be transferred (ie: handled in some way) outside the EEA if it is being handled in a country that is on the European Commission’s (EC) list of countries or territories that provide adequate protection for personal data. The US is not on this list but data can be transferred to US companies that have signed the Safe Harbor agreement, which requires them to follow certain principles of information handling under the oversight of the Federal Trade Commission.
If a country is not on the EC list, there are additional means of safeguard, including using EC-approved model contractual clauses for the transfer of data. The UK Data Protection Act 1998 allows companies to transfer data to a non-EEA country if they have conducted their own adequacy assessment of the relevant country or get their Binding Corporate Rules approved by the Information Commissioner.
So if you do want to put personal data in the cloud, ask yourself, and your vendor, the following:
• assess the nature of your data and its sensitivity, consider public perception – how would the storage of medical data in the cloud be perceived?
• would the cloud vendor’s security meet European law requirements?
• where would the data be stored?
• do you have rights to audit the services?
• will the cloud vendor provide back-ups, disaster recovery and business continuity procedures?
• how will you secure the return of your data at the end of the contract?
The future
Pending revision to European data protection legislation which is likely to become more restrictive than its current counterpart and of wider application, moves are afoot to ensure that Europe becomes a more attractive market for global cloud vendors, as well as potential consumers (businesses and individuals) of cloud services. Neelie Kroes has established the EuroCloud Partnership with the aim that barriers to the conclusion of deals are ironed out. This may include standard terms, guidance, checklists and other tools to help demystify cloud computing and to enable its adoption.
As such, the data aspects of cloud computing are regulated, will continue to be regulated, and that regulatory environment will evolve over time. It seems unlikely that cloud computing itself will attract regulation, instead normal contracting and sector considerations will continue to apply and businesses will remain free to contract for technology in the way that best suits them.
Mark O’Conor is a partner, Patrick van Eecke is a partner and Jessica Turner is a solicitor at DLA Piper.
Leave a Reply