Lookout Canada and the U.S.: European regulators are working to give Europe a head-start as a safe jurisdiction for cloud computing.
European Commission Supports Cloud Computing
The European Commission has announced that it will draft model contract terms that organizations could use in cloud computing contracts and service level agreements. In a document entitled "Unleashing the Potential of Cloud Computing in Europe", the European Commission stated that it "aims at enabling and facilitating faster adoption of cloud computing throughout all sectors of the economy". The Commission wishes to address the "perception" that cloud computing may bring additional risks by making it easier to signal and verify compliance (though standards and certification) and by developing legal frameworks, such as an initiative on cyber security. The Commission summarized the business case for devoting Commission resources to cloud computing as follows:
Addressing the specific challenges of cloud computing would mean a faster and more harmonised adoption of the technology by Europe's businesses, organisations and public authorities, resulting, on the demand side, in accelerated productivity growth and increased competitiveness across the whole economy as well as, on the supply-side, in a larger market in which Europe becomes a key global player. Here, the European ICT sector stands to benefit from important new opportunities; given the right context, Europe's traditional strengths in telecommunications equipment, networks and services could be deployed very effectively for cloud infrastructures. Beyond that, European application developers large and small could benefit from rising demand.
The Commission identified several barriers to an accelerated adoption for cloud computing, including:
- Contractual standards regarding data access, portability, change of control, ownership of data and dispute resolution processes.
- Regulatory fragmentation due to differing national legal frameworks and uncertainties over applicable laws, given that cloud services may span multiple jurisdictions.
- Proliferation of security standards and uncertainty by organizations regarding the security of those standards and the interoperability of data formats to permit portability.
Among the Commission's activities for 2013:
- The Commission has challenged itself to develop model terms for cloud computing service level agreements for professional cloud users by the end of 2013. The Commission will also review clauses that could be used in contracts involving the transfer of personal data to countries outside of the EU.
- The Commission will also develop standardized contract terms for consumer agreements for cloud computing.
- The Commission supports the development of uniform standards and the certification of organizations providing cloud computing services. The Commission will be tasking the European Telecommunications Standards Institute with developing a set of necessary standards for security, interoperability, data portability and reversibility. The Commission will also assist in the development of an EU-wide voluntary certification scheme.
UK Information Commissioner Provides Constructive Guidance
In other developments, the U.K. Information Commissioner's Office (ICO) has issued "Guidance on Cloud Computing", which should prove to be a useful resource for privacy professionals and counsel who are beginning to grapple with cloud computing technologies and mandatory reading for Canadian companies operating in the U.K. Although there are significant differences between Canadian and U.K. privacy laws, this ICO resource is a useful starting point because of the clear and practical approach to decoding the "lingo" of cloud computing and describing the privacy issues. In-house counsel may especially appreciate the use of specific short examples to illustrate concepts.
Among the points covered in the ICO booklet are:
- Assess the risk of processing highly sensitive data in the cloud. The ICO does not, however, put any types of data off-limits. The ICO states: "Often, the question may not be whether the personal data should be put into the cloud but what the data protection risks are and whether those risks can be mitigated."
- Consider that moving data to the cloud may create additional types of data. Metadata regarding usage statistics or transaction histories of users may be recorded and should be covered by the organization's privacy policy.
- Privacy impact assessments should be considered before engaging in large or complex cloud services.
- Assessment of the administrative, technical and physical controls of the cloud service provider is not a "one-time" event. Organizations should engage in a "continual cycle of monitoring, review and assessment". Furthermore, organizations should ensure that they are notified of any changes to subcontractors and those subcontractors are approved.
- Use third-party audits and certifications. The ICO supports the use of third party audits and industry certifications to assist organizations assessing the physical, technical and administrative security measures of the cloud service provider. Responsibility remains, however, with the organization to satisfy itself that the cloud service provider has adequate security measures in place to maintain data security.
The ICO states that technical security measures of a cloud computing program should include:
- Access control through the use of a robust authentication program involving individual username and strong passwords and an administrative program to create, update, suspend and delete user accounts.
- Encryption of data while in transit and, if possible, at rest (i.e. when stored) should be considered. It is important, however, to ensure that the encryption process also contains a "robust key management arrangement". This is because access to the decryption key means access to the data and, in addition, inadvertent loss of the key would result in the loss of data.
- Data retention and destruction procedures to provide for the overwriting and destruction of data consistent with the organization's document retention protocol and following a transfer to another cloud service provider or discontinuance of the use of the cloud service provider's services.
- Limits on the cloud service provider's access to the organization's data and controls on whether and how the cloud service provider may use the organization's data. There should be "an audit process that will alert the cloud customer if unauthorised access, deletion or modification occurs."
On the thorny subject of international transfers of data becoming subject to the laws of the organization to which the data transfer is made, the ICO joined the trend towards international comity by stating as follows:
If a cloud provider is required to comply with a request for information from a foreign law enforcement agency, and did comply, the ICO would be likely to take the view that, provided the cloud customer had taken appropriate steps to ensure that the use of the cloud services would ensure an appropriate level of protection for the rights of data subjects whose personal data would be processed in the cloud, regulatory action against the cloud customer (in respect of the disclosure of personal data to the foreign law enforcement agency) would not be appropriate as the cloud provider, rather than the cloud customer, had made the disclosure.
Movement to cloud computing appears inexorable. Jurisdictions that are first movers to develop standards and to facilitate the advantages of the cloud computing industry may have the advantage in the long-run. Digital strategy, anyone?
About Fraser Milner Casgrain LLP (FMC)
FMC is one of Canada's leading business and litigation law firms with more than 500 lawyers in six full-service offices located in the country's key business centres. We focus on providing outstanding service and value to our clients, and we strive to excel as a workplace of choice for our people. Regardless of where you choose to do business in Canada, our strong team of professionals possess knowledge and expertise on regional, national and cross-border matters. FMC's well-earned reputation for consistently delivering the highest quality legal services and counsel to our clients is complemented by an ongoing commitment to diversity and inclusion to broaden our insight and perspective on our clients' needs. Visit: www.fmc-law.com
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
