Source: https://m.grin.com/document/309264
Timestamp: 2019-04-20 00:22:53+00:00

Document:
5 Personal Data Transmission to Unsecure Non-EU Countries Including Subcontractors .
The paper analyses the constraints of the current European directive on data protection regarding the free and active exercise of the right to informational self-determination in cloud computing with subcontractor chains.
The analysis focuses in particular on the personal and geographical scope of the protection of personal data, on the legitimation of data processing under the aspect of data transmission into secure and unsecure third countries with subcontractor involvement. Herein it will be critically analysed whether the options under which it is possible to process personal data, will deliver sufficient privacy security in cloud computing. Furthermore, the paper examines the effectiveness and the consequences of possible legitimation of processing personal data in cloud computing. Also, will be regarded the legitimation options to include subcontractors in complex cloud computing landscapes in secure and unsecure third countries. The data subject and the cloud user position and chances to execute their rights of informational self-determination in distributed cloud computing landscapes will be critical looked at.
Based on the multiple challenges that the personal data faces in complex cloud computing landscapes, various improvement potentials addressed to different actors emphasis the neces- sity to reduce the risk to the data subject´s informational self-determination in cloud compu- ting.
Finally, the recent regulation on general data protection that was published by the Council on 11th June 2015 will be cross-checked against the identified gaps of the currently existing data protection directive, with an emphasis on the requirements to achieve informational self - de- termination.
In the introduction, the paper starts with a description of the challenges that privacy on the Internet faces, and emphasises the economic power of data. Herein, an overview is given about the major technical developments regarding collecting private data from citizens.
The first chapter describes the economic importance of cloud computing, where mostly citizens´ private data is stored and then processed. Thereby, the paper explains how cloud computing represent an economic advantage, and explain how data is distributed. Subsequently citizens´ trustful behaviour on the Internet is considered. Following, it moves to an examination of how the European data protection law has developed.
Afterwards, the basis and development of the German data protection law is contemplated as European Union member state example.
In the second chapter, the current legal data protection directive EC/95/46 is taken as basis to prove that the application of directive EC/95/46 is against cloud computing with subcontrac- tors. The focus then is shifted towards personal and geographical scope, to emphasise on per- sonal data and the geographical dimension in cloud computing. The difficulty of effectively applying anonymizing and pseudonyms techniques in cloud computing is highlighted.
The third chapter scrutinize the legitimation criteria of the directive, in particular the consents and the contract data processing vis-a-vis the practical effectiveness of cloud computing. The German federal data protection law is used as an example of a European member state when it comes to the transposition of the relevant provisions. In chapter three, the first case of four different cloud scenario landscapes is discussed, where the legitimation of data transfers with subcontractors are conceived. In reference to Germany as an example of member state the da- ta subject and the cloud user are assumed to be located in Germany as a starting point. Chap- ter 3 discusses scenario A where the cloud provider and the subcontractor are located in the EU.
The fourth chapter examines the transfer of personal data outside the EU, based on the EU directive EC/95/46 and the German federal data protection law. Initially, options are conceived awarding third countries an EU comparable security status.
Furthermore, different methods are presented for cloud computing scenarios with subcontractors securing a lawful data transmission to unsecure third countries.
The fifth chapter shows different cloud computing landscapes, explaining the requirements of data protection when it comes to lawfully process personal data in unsecure third countries with subcontractors.
The scenarios look at different constellations, where the cloud provider and the subcontractor are located whether within the EU or in unsecure third countries.
The sixth chapter proposes technical, economic, political, educational measures to support the legal effectiveness of data protection. The examples of measures are wishful to be considered and implemented, in case there are interests to protect the informational self-determined so- ciety.
The seventh chapter analysis the latest official published and amended data protection regulation version by the Council from 11th June 2015. The Council version is reflected against the personal data protection in cloud computing with subcontractor chains. It looks in particular to the application area, the data processing legitimation and the data transmission into third countries including subcontractor chains. In the 7th chapter, the critics and proposals stipulated in chapter 6 are linked to the examined Council provisions and an attempt is being made to evaluate the provisions effectiveness regarding the protection of informational selfdetermination in cloud computing with subcontractor chains.
Finally, the conclusion summarizes the difficulties and challenges of the informational self- determination in cloud computing with subcontractor chains within the current directive EC/95/46 and confronts it to the provisions of the current approved Council version from 11th June 2015.
Due to the complexity of the topic, the presented paper could not cover special data protection regulations for sensitive data, special data protection regulations for children, detailed aspects for concerns and employees, or new provisions like the right to be forgotten.
The DP-R would lead to several inventions relevant for cloud computing, and affecting the data transfer into third countries, which might threaten the informational self- determination.
The quasi-muddled situation came almost to a standstill, until the Italian EU Council Pres- idency progressed in the agreement process and issued in January 2015 a confidential, al- beit published version37, of a new and progressed stage of council position38 regarding the DP-R. It still contains more than 490 open topics, but shows an impressive progress, in comparison to the DP-R and the LIBE version. In March 2015, an unofficial European Council comparison39 containing a revision of the three regulations was published, it was a consolidated version of the EU-Data protection regulation, and it included comments and compromise proposals.40 Under the Latvian EU Council Presidency, the agreement process continued and was followed by the Luxembourg EU Council Presidency.41 On June 11th, 2015, the Council published the general approach for the general data protection regula- tion42 that was prepared to be discussed in the first trilogue on June 24th of the same year. In chapter 7, the latest official published Council43 version of 11th June this year will be used to analyse the level of personal data protection and the level of informational self- determination that was achieved under the critical aspects, and currently existing in the da- ta protection directive.
The decision reason is seen in the multiple sources to gather non-intimidate data, which re- sults in the decision that insignificant data does not exist.47 Referring to Art. 2 (1) GG, the BVerfG took in the census of population judgement a decision to manifest the right to pri- vacy with the right of informational self-determination, by focusing on the principle of purpose limitation.48 Automated data processing threatens privacy and freedom, because the possibility to store an unlimited amount of data allows data combination and the build- ing of personal profiles. The missing control in automated data processing is seen as a dan- ger for citizens. It could lead to the fear that the state could draw sanctions out of it, there- fore citizens’ political activity might be reduced. Exercising informational self- determination means that the individual person would keep the decision freedom and freely decide to act on his decision. It can be considered as threat to the individual’s freedom not having the overview and the security about one´s own information existing in his social environment. The individual might be inhibited to act and decide freely if there is uncer- tainty on the existing information on the communication partner side.49 The uncertainty which information exists where and might be used to someone’s disadvantage is a chal- lenge to the personal freedom with potential chilling effects to the free expression of opin- ion.
The strict data protection law in Germany is considered two folded. On one side, it is con- sidered as an advantage since it creates customer confidence and is used as positive differ- entiation criteria towards international competition offering data security and privacy. On the other side, it increases costs for controls and might hamper innovations in international competition to gain additional market shares.54 German SMEs and Start-up-companies re- quest the consideration of regulations not to be restricted only to European Companies, but to be applied on data security and control measures to “companies operating in the EU re- gion”, which gives European Start Ups and SMEs a chance to compete with big American social media companies.55 The ECJ Google judgement C-131/12 of 13th May 2014 already recognizes this request, albeit under a different leading question.56 In the course of the pa- per, especially in chapter 7, the relevant provisions in the current data protection regulation proposal will be discussed.
The relevant application area to secure informational self-determination is not anymore purely faced vertically against the state to secure unprejudiced political activity. The pro- tection of informational self-determination should be extended on horizontal perspective between private persons and private companies. Informational imbalances between private and business actors might lead to economic exploitation. The data subjects concern regard- ing the unlimited data gathering and collection is feed by the uncertainty about its own data caused by the cluelessness who might know something about him, where else and for what kind of purposes is the data processed.
Art. 3 and 4 DP-D define the scope of data protection. It is define by Art. 2b as “any set of operation performed upon personal data”, like data elicitation, usage, processing, storage, deletion or transmission of data.
The personal scope of the DP-D is opened, if Art. 3 in connection with Art. 4 DP-D find application regarding automated or non-automated personal data processing, stored data or data stored in a file. The DP-D needs to be applied by the member states to grant personal data protection, based on the fundamental freedoms and the constitutional rights. Art. 1 (1), Art. 2 (a, 2nd HS.) DP-D specifies personal data as the information related to an identifiable natural person. The person might be identifiable directly or indirectly by a reference num- ber, whereas one or more factors may specify the person’s identity in physical, physiologi- cal, mental, economic, cultural, or social way. Legally only that information is relevant where a personal reference exists, or where the personal reference can be constructed.61 In relation to these articles, recital 26 DP-D specifies protection principles applicable to all possible identifiable information used by controllers or any other persons for the identifica- tion of persons. Recital 26 DP-D excludes the data protection for sufficiently anonymized personal data.
Art. 1(1) and Art. 2(a) DP-D in connection with recital 26 legitimize data processing with anonymous data. Anonymous data relates, at least with one criterion to a person, but the knowledge to assign the reference to personal data is removed. Anonymous data contain information related to persons, but the direct personal assignment is removed.
26 DP-D into the §§ 3 (6 + 6a), 3(a) BDSG, and differentiates in detail the two processes of pseudonymising and anonymising measures, in order to follow the principle of data economy and avoidance.
The jurisdictional clarification is very relevant. Directives do not have direct effect on the member states and need to be transposed into national law within the defined timeframe.94 Thus, directives leave to the member states to interpret and implement freedom and it might be transposed in different ways.
The intention of the Art. 1 (2) DP-D is to enable cross-border personal data processing within the EU. In the cross-border data transfer situations, the DP-D should guarantee data subjects the same data protection as in the homeland.95 Art. 4 (1) DP-D determines that the member states need to apply national measures issued based on the directive for all person- al data processing operations. In comparison to the unimportance of geographical locations for clouds, the directive differentiates the applicable law based on the data processing loca- tion. Art. 4 (1a, b) DP-D foresees that the national law is applicable where the data pro- cessing takes place.96 In Art. 4 (1a) DP-D the domicile principle is defined where the con- troller’s subsidiaries national law is applicable. Data processing needs to be carried out in connection with activities of the subsidiary. In Art. 4 (1c) DP-D the jurisdiction moves to the territorial principle.97 The territorial principle foresees that the location where the data processing takes place is relevant.
12 Software-as-a-Service (SaaS): The cloud provider offers “software-on-demand” in its own infrastructure. The cloud user rents the software from the cloud provider and uses its infrastructure. Platform-as-a-Service (PaaS): The service model “Platform-as-a-Service” comprises the option of the service user developing his own software on the service provider’s software and applications. The software provider offers the software application as a basis. Infrastructure-as-a-Service (IaaS): Cloud computing could be offered as an infrastructure service model where the hardware, e.g. the data storage, the processor, is provided as a service. The users are responsible for the selection, installation, and maintenance of their software.
25 In the following chapters, references to the directive EC/95/46 are referred to as DP-D.
28 In the following chapters, references to the European Commission data protection regulation draft are referred to as DP-R.
32 In the following chapters, references to the amended European Commission data protection regulation draft of the LIBE committee are referred to as LIBE.
38 In the following chapters, references to the general approach of the general data protection regulation are referred to as Council.
43 In the following chapters, references to the general approach of the general data protection regulation are referred to as Council.
44 In this paper, the German Federal Data Protection Law (BDSG) is used as member state example.
61 Art. 2 (a, 2nd HS.) DP-D Art. 8 (1) DP-D prohibits the processing of special (sensitive) personal data. Data of this category are out of which it is possible to fol- low racialist or ethnic origin, political opinion, religious or philosophical belief or labour union membership, as well as health data or sexual orientation. In this work a further specification regarding sensitive data will not be considered. The presented work is based on regular data only.
80 Deduplication enables to save large amount of storage space.

References: Art. 2

Art. 3
 Art. 2
 Art. 3
 Art. 4
 Art. 1
 Art. 2

Art. 1
 Art. 2
 Art. 1
 Art. 4
 Art. 4
 Art. 4
 Art. 4
 Art. 2
 Art. 8