Session III on 22nd November 2002, Tokyo, Japan[Short Speech]
Protection of Privacy and Information Security facing Catastrophe – The Collapseof the Global Economy will lead to the Break-down of Fundamental Models

Takato NATSUI
Meiji University, faculty of Law
Hayabusa Asuka Law Office
In general, models of management systems for information security, personal data protection
and internal control have been based on a premise that every organization can exist to make aplan, to perform that plan, to check the results and to assess the management system. When abusiness entity is facing bankruptcy or was bankrupt, another stronger business entity may beable to merge with such a bankrupted business entity, to access information assets and personal
data from the bankrupt business entity, and to protect them normally and lawfully.
However, world economic conditions have changed completely. They have been and will befailing. The change has brought a flood of bankruptcy of numerous business entities, many local
governments and other public organizations. Due to such a terrible change, no business entity
can rescue or merge with any other bankrupted business entity. As a result, the cycle ofmanagement of the information assets and personal data collected by such bankrupt
organizations will stop suddenly and will be left alone without any adequate protection.
Also, in such an economic environment, personal data protection laws and information security
laws may have no substantial ability to protect personal data and information assets. This is dueto the fact that current laws have been composed and enacted without any thought given to thepremise of such dangerous fundamental changes to the world’s economic condition.
We have to rebuild a new protection scheme for personal data and information assets as soon aspossible.
[Introduction of Speakers](Omitted)1

Session III on 22nd November 2002, Tokyo, Japan[Discussions]Natsui: Introduction to Session III
I mentioned that ‘the world will be unified’ in my “Culture and Law in Networked Society” which
was published in 1997. Such a ‘unification’ phenomenon can be observed in several social categories.
For instance, some major methods of information security have become common all over the world.
Also, world nations have been seeking a common resolution to manage privacy protection
independently of differences between Common Law and Continental Law. Standardization oftechnology used in conjunction with the Internet has increased broadly and today, there is a very
interesting piece of technology known as cloud computing.
Much kind of business services based on this new technology have been provided already. Today,
numerous different nationalities and various types of business entities have used a common
computer system and shared the same information resources using cloud computing on the Internet. I
want you to understand that cloud computing is a symbol of ‘unification’ for a networked society.
Now, cloud computing has brought various legal issues in the context of privacy protection. Mainissues might be in relation to jurisdiction, application of laws and certification.
In the discussion in Session III, as a test model of existing complete international spheres, I would
like to choose cloud computing to make our discussions easier to understand both for us and for allaudiences.
We will discuss some issues relating to privacy protection in the course of operation of the assumed
cloud computer during half of our discussion. We will discuss privacy protection as a response to thecrisis of cloud computing after the recent worldwide financial catastrophe. Also, at the end of session
III, I would like to sum up our discussions and provide my opinion on these issues.

Natsui: Question 1 to Mr. Gellman
Let’s assume that there is an imaginary cloud computer. Its name is ‘CX’. Also, let’s assume that its
server is located inside the United States and CX is under the jurisdiction of the United States andthe laws of the United States apply and are enforceable.
Mr. Gellman, I have some questions. Please tell us your ideas in regards to a contract withinternational jurisdiction and the application of laws between the CX owner as cloud computing
provider and its user business entities.
In this case, in the context of privacy protection:1-1)

Who is subject to the applied laws of the United States – the owner of CX or each of theuser business entities of CX?

1-2)

When user business entities of CX consist of hospitals, medicine production companies, life
insurance institutes, investment companies and other different types of business entities, and2

Session III on 22nd November 2002, Tokyo, Japan

if the United States’ law should be CX but not each user business entity, what kind of laws
should apply?

Mr. Gellman

AnswerNatsui: Question 2 to Mr. Komukai
Using the same example, I also have some questions for Mr. Komukai.
Let’s assume that there are many CX user business entities that are located in APEC nations. If only
the United States’ laws can apply to CX and APEC laws have to be excluded, then the privacy
protection laws of APEC can not apply.
In this case:2-1)

Are APEC nations unable to apply their own APEC laws to business entities who arelocated in APEC nations and the protection of private data managed by such businessentities?

2-2)

Even if APEC laws can apply to APEC business entities themselves, if only the UnitedStates’ laws can be applied to data privacy protection, then the integrity of law enforcementin APEC nations may be destroyed. Did APEC examine or research such important issues?

Mr. Komukai

AnswerNatsui: Question 3 to Madame Sawada
Trust Marks can be given to each business entity. It might be assumed that the reliability of thesystem should be assessed as being at the same level for every user business entity because every
user business entity uses the same computer system or database system of within CX.
I have some questions for Madame Sawada.
In this case:3-1)

When a CX user business entity is certificated and entitled as a Trust Marked Company,
does every other CX user business entity have reliability at the same level as said Trust
Marked Company?

3Session III on 22nd November 2002, Tokyo, Japan

3-2)

When the question can be limited to the matter of the reliability of the computer system,
what do you think?

Madame SawadaAnswer

Natsui: Question 4 to Mr. Araki
By previous discussions, I believe that there have been many legal issues in the case of theconcurrence of laws and control systems (for instance, cloud computing), even if the world
economic environment and financial conditions may be functioning normally.
Also I am assuming that there have been some important issues dealing with the construction andoperation of management systems for cloud computing.
I have some questions for Mr. Araki.
In this context:4-3)

What are the important points of the construction of the management system for cloudcomputing?

4-4)

What are the important points of the operation of the management system for cloudcomputing?

Mr. Araki

Answer4Session III on 22nd November 2002, Tokyo, Japan

Natsui:I mentioned that ‘bankruptcy law is powerless to control any intangible properties’ in my article‘Bankruptcy and Computers’, published in 1989. Today’s conditions may still be the same as they
relate to bankruptcy. The Bankruptcy Act of Japan has especially had little to no interest in theprotection of personal data.
When legitimate management and control procedures under the Bankruptcy Act or the CivilRehabilitation Act can be enacted, the property of a bankrupt company may be protected andreserved for use at a later date. Through such reasonable procedures, personal data collected by abankrupt company may be protected and reserved for second-hand use. However, in the case when acompany simply stops and ends its business activity, personal data collected and managed by said
company may scrapped or sold to anyone without any adequate protection under relevant laws andpolicies. This is due to the fact that there is no organization with the company designated with theresponsibility of managing personal data assets should such a situation arise. Once the company goes
belly up, no one is left to take such a responsibility.
A cloud computer has hundreds of user business entities whose business activities rely on the manysystems and services of said cloud computer. Database systems located in the cloud computer should
be one of the most important business bases for its user business entities. If a cloud computer isbankrupted, its user business entities become unable to use any such systems and services. Theseeffects can be compared to those of a dangerous natural disaster such as an earthquake.
In such a case, even if only the cloud computer is bankrupted and its user business entities are stillrunning successfully, every user business entity of the cloud computer will become unable tocontinue their business activities. As such, the user business entities of the cloud computer will also
go out of business. Moreover, every user business entity has no way to protect and manage its
business information as well as the personal data stored on the database systems of the cloudcomputer once said cloud computer has been shut down.

Natsui: Question 5 for Mr. Gellman
Let’s assume that the imaginary cloud computer CX has become bankrupt. The United States’ laws
should apply to CX.
In this case:5-1)

Is the Bankruptcy Act of the United States enough to protect information assets?

5-2)

Under the United States’ laws, are there any legal methods to protect any personal datastored on database systems in CX when the managers and employees of CX have alreadyleft the company?

Mr. Gellman

5Session III on 22nd November 2002, Tokyo, JapanAnswer

Natsui: Question 6 for Mr. Komukai
Assuming the same situation as the previous set of questions, I also have some questions for Mr.
Komukai.
In this case:6-1)

Are there any discussions or examinations regarding the case of the bankruptcy of a cloudcomputer in an APEC nation?

6-2)

If a user business entity of CX is a Japanese company, are there any means to protect its
information which stored on CX?

Mr. Komukai

AnswerNatsui: Question 7 for Madame Sawada
I have some questions for Madame Sawada.
In this case:
7-1)

Let’s say a CX user business entity is certificated and entitled as a Trust Marked Company,
and said CX user business entity becomes unable to perform its business after bankruptcy ofCX. In such a case, how is the Trust Mark given to the CX user business entity consideredeffective?

7-2)

In general, are there any ways to inform the public that the Trust Mark is not functioning
effectively?

Madame Sawada

AnswerNatsui: Question 8 for Mr. Araki
I have some questions for Mr. Araki.
To avoid a chain bankruptcy for the user business entities of CX, I think that reconstruction of its
Risk Management Systems may be necessary.
In this context:6Session III on 22nd November 2002, Tokyo, Japan

8-1)

What are the important points of risk management for a user of cloud computing?

8-2)

To avoid a chain bankruptcy of the user business entities of a cloud computer, what efforts
are needed in the management of the cloud computer?

Mr. Araki

AnswerNatsui: Summing up and Recommendations

See. PPT File7

Session III on 22nd November 2002, Tokyo, Japan[Reference]

Gartner, Assessing the Security Risks of Cloud Computing
3 June 2008
http://www.gartner.com/DisplayDocument?id=685308

EFF, Bankruptcy, Public Records and Privacy - Comments of the Privacy Rights Clearinghouse andthe Electronic Frontier Foundation presented to the U.S. Department of Justice
September 18, 2000
http://www.privacyrights.org/ar/bankruptcy091800.htm

Bankrupt lenders throwing away your privacy
msnbc：March 7, 2008
http://www.msnbc.msn.com/id/23505497/8