Source: https://www.jipitec.eu/issues/jipitec-5-1-2014/3905
Timestamp: 2019-04-25 20:33:18+00:00

Document:
Applying location-focused data protection law within the context of a location-agnostic cloud computing framework is fraught with difficulties. While the Proposed EU Data Protection Regulation has introduced a lot of changes to the current data protection framework, the complexities of data processing in the cloud involve various layers and intermediaries of actors that have not been properly addressed. This leaves some gaps in the regulation when analyzed in cloud scenarios. This paper gives a brief overview of the relevant provisions of the regulation that will have an impact on cloud transactions and addresses the missing links. It is hoped that these loopholes will be reconsidered before the final version of the law is passed in order to avoid unintended consequences.
Although the concept of “cloud” is metaphorical, cloud computing currently represents another big innovation in the IT industry that tends to maximize the use of the Internet. This is not only seen in its concentration of large computing power in a single space, but also in its functionality as an always available, unlimited tool to store and access data no matter the location. 1 However, like some other technical innovations before it, it has not been easy to determine how to append a precise legal definition to the concept as well as to bring its uses within a legal framework. This conundrum is easily appreciated when analyzing data protection laws within the context of cloud computing, for instance, because data represents the main raw material upon which cloud technology thrives. The fact that more data is constantly linking to individual persons, of course, plausibly triggers debates concerning data protection requirements in cloud transactions (requirements relating to privacy, security, transparency, accessibility, and rights and freedoms of data subjects). Such requirements could, for example, restrict personal data from being transferred from one country to another for jurisdictional purposes. 2 Cloud computing, on the other hand, depends on automated data movement around several data centers located in different parts of the world, and relies on the Internet for access to such data. This location-agnostic feature of cloud computing potentially has several data protection implications because of the multiple jurisdictions that may be involved.
European data protection law, for instance, is location-focused, assuming physical movement of data from one place to another. 3 This fact is reflected in the current Data Protection Directive 95/46/EC (“DPD”) which predates the Internet boom, making it difficult to reconcile some of its provisions with the operations of Internet-enabled technologies such as cloud computing. 4 However, in a bid to reflect the traditional reasoning in a cloud framework, the Article 29 Working Party (WP29) has opined that mirroring personal data from a server in the EU to a US-located server constitutes a data transfer. 5 While this may appear convenient for the WP29, it fails to solve the complexities in applying the data export rules in cloud transactions.
Having recognized this state of affairs, the European Commission has published a draft proposal for a Data Protection Regulation (“draft regulation”) that will replace the DPD. 6 Though the draft regulation is still undergoing parliamentary amendments, this paper seeks to examine some of its salient provisions as applicable to cloud computing models. In particular, it will focus on the controller-processor roles and data export provisions in the draft regulation that may potentially impact cloud transactions. At the end, it will show some of the missing links in the proposal that need to be addressed before the final version is passed.
Community cloud where the cloud infrastructure is provisioned for exclusive use by a specific community of consumers (organizations that have shared concerns due to their mission, security requirements, policy, compliance considerations, among others). It may be owned, managed and operated by one or more of the organizations in the community, a third party, or some combination of them, and the data centre may be hosted on or off premises of the cloud consumer.
Public cloud where the cloud infrastructure is provisioned for open use by the general public. It may be owned, managed and operated by a business, academic, or government organization, among others, and the data centers exist on the premises of the cloud provider.
The cloud supply chain could be a combination of many components or services from different suppliers or providers. Multiple services are involved in the layers of the stack of the cloud ecosystem, each of which could be managed by a different party. These could range from third parties who are involved in the provisioning of physical space for the data centers to those who maintain the data centers and even cloud brokers. A good illustration has been provided by Hon and Millard (2013), 15 and diagrammatically represented in Kate’s blog. 16 It is significant to note, however, that cloud end users see the services they are using as an integrated service, and do not bother with the underlying components. Regrettably, this has the tendency of depriving the legally defined data controller the actual control of the data in factual understanding. 17 As we will see below, this state of affairs is yet to be addressed in the draft regulation.
What the effect of these parliamentary amendments will be for cloud services is yet to be fully understood, except to say that obtaining new approvals after the transition period will have cost implications to data controllers and processors. Second, where no mutual assistance treaty or international agreement exists between the countries involved, there is a potential risk that this may put the cloud provider in an awkward position as to which rule to follow. In essence, because of the lack of clarity about jurisdictional boundaries, this provision would prohibit organizations from complying with governmental orders, and this makes them vulnerable to criminal penalties.
While this stand may appear extreme, it goes to show the frustration at reconciling the inadequate nature of the binary division of actors in the data processing chain, where collaborating but autonomous entities are involved, and whose mutual relationships can no longer be characterized as a simple ‘relationship of command’ or ‘principal-delegate’ relationship. 42 Not clarifying these relationships in the draft regulation may have unintended consequences, such as creating legal uncertainty as to the status of actors and the allocation of responsibility in the data processing chain. 43 A number of opinions have called for a rethinking in the classification of actors in view of modern data processing possibilities, of which cloud computing is a ready example. 44 The draft regulation, as well as the various parliamentary amendments, has not devoted significant attention to this issue.
Second, the regulation has retained the use of the model contractual clauses. However, in their present form these clauses do not adequately cover all the constellations of cloud transactions. For instance, there are no model contractual clauses for an EU processor to transfer data to a controller in a third country, or for an EU processor to transfer data to a sub-processor in a third country. 45 These cases are possible as more data processors in the EU are transacting with many data controllers and sub-processors who are outside the EU. 46 Furthermore, certain clauses in the model do not reflect and may not fit into the technical and organizational frameworks of cloud services. For instance, the assumption that the data controller is the strong, controlling party that has the actual ability to instruct and control the processor (cloud providers, for example) may be illusory. 47 Provisions requiring the processor to submit its facilities for audit by the controller and supervisory authorities are less feasible in the cloud, in view of the millions of customers a cloud provider may have. 48 It is also less likely that a cloud service provider will first obtain prior written consent from all of its customers before engaging in every support service, where those are regarded as sub-processing. 49 As Svantesson (2012) rightly observes, “the power-balance in cloud computing agreements is typically different to the power-balance between data controllers and data processors anticipated in the data protection regulation.” 50 This calls for an amendment of these clauses in view of emerging structures in modern data processing realities.
Fourth, although the draft regulation has recognized the use of BCRs, its application only within the same group of companies or organization will still limit its potential impact. The inability to transfer data between two different processors or controllers, who both have duly approved BCRs but not belonging to the same group, is not logical. This appears to be contrary to the case where two third countries that have adequacy status are allowed to transfer EU data between them on that basis. A similar facility should be accorded to BCR-approved entities since it represents a binding obligation.
It is encouraging that the draft regulation will bring a level of harmonization in the data protection regime within the EU. However, cloud realities show that much still needs to be done in order to reap the full potential of cloud computing in Europe. There is a need for legislators to understand cloud architecture, features and business models. Hon, et al (2012) argue that some of the current difficulties in the legal aspects of the cloud arise not necessarily because contract terms are poor, but because data protection laws assume certain things which are not true in the cloud. 55 If the present reform is not holistic, it may lead to unintended consequences. Reflecting privacy in a pragmatic way without disproportionately interfering with technological advancements is essential in this e-age. 56 It is hoped that the outlined missing links in the draft regulation will be addressed while the proposal is still debated.
 E. Ustaran, The Future of Privacy, (DataGuidance, UK, 2013) p.10.
 E. Yoran, “Cloud Computing and Data Residency Laws”, Sys-con Media, (available at: http://www.sys-con.com/node/2660874 ).
 D. Svantesson, “Data Protection in Cloud Computing – The Swedish Perspective”, Computer Law & Security Review, Vol. 28, Issue 4, 2012, pp. 476-480.
 P. De Hert and V. Papakonstantinou, “The Proposed Data Protection Regulation Replacing Directive 95/46/EC: A Sound System for the Protection of Individuals”, Computer Law & Security Review, Vol. 28, Issue 4, 2012, pp. 130 -142.
 See Article 29 Working Party Opinion 10/2006 on the processing of personal data by the Society for Worldwide Interbank Financial Telecommunication (SWIFT), WP128 (2006).
 European Commission, A proposal on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), COM (2012) 11 final. This paper will take into account some of the amendments to the original draft such as the EU Parliament’s Committee on Civil Liberties, Justice and Home Affairs (“LIBE”) report of January 2013 (available at: https://www.huntonprivacyblog.com/wp-content/files/2013/01/Albrecht-Report-LIBE.pdf ), and European Parliament Compromise Text published on October 21, 2013: (available at: https://www.huntonprivacyblog.com/files/2013/12/EUCompromise-Text.pdf).
 Article 29 Working Party, Opinion 05/2012 on Cloud Computing, p. 4.
 NIST defines it thus: “Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.” P. Mell and T. Grance, The NIST Definition of Cloud Computing, 2011 (available at: http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf).
 This is the case in public clouds but may vary in other deployment models.
 Mell and Grance, op. cit., note 8.
 N. Metha, “The 4 Primary Cloud Deployment Models”, 2012 (available at: http://www.cloudtweaks.com/2012/07/the-4-primary-cloud-deployment-models/).
 Mell and Grance, op. cit, note 8.
 W. Hon and C. Millard, “Cloud Technologies and Services” in C. Millard (ed), Cloud Computing Law, (Oxford University Press, United Kingdom, 2013) pp. 13-16.
 See the Article 29 Working Party, Opinion 05/2012, op cit, note 7.
 For instance, a Regulation will also abolish certain flexible approaches by DPAs such as the ability of a data controller to make a self-assessment of the adequacy level for data export in the UK. See “The New EU Data Protection Regulation - Revolution or Evolution?”, (available at: http://www.slaughterandmay.com/media/1844766/the-new-eu-data-protection-regulation-revolution-or-evolution.pdf) p. 6.
 See Art. 3 of the Proposed Regulation. See also W. Hon and C. Millard, “How Do Restrictions on International Data Transfer Work in Clouds?” in C. Millard (ed), Cloud Computing Law, (Oxford University Press, United Kingdom, 2013) p. 255.
 See L. de Souza, “CNIL Simplifies Formalities for Non-EU Companies Using Data Processors in France”, (available at: http://www.hldataprotection.com/2011/03/articles/international-eu-privacy/cnil-simplifies-formalities-for-noneu-companies-using-data-processors-in-france/ ).
 Art. 3(2) of the Draft Regulation.
 “How Proposed EU-Wide Data Protection Regulation Will Affect U.S. Based Businesses”, (available at: http://www.cooley.com/showalert.aspx?Show=66023 ).
 Art. 39 of the Draft Regulation.
 The compromise parliamentary text has provided more detail on the mechanism for certification.
 See also the new Art. 32a of the compromise parliamentary text.
 Art. 31 of the Draft Regulation.
 Art. 41 of the Draft Regulation.
 Art. 42 of the Draft Regulation.
 Art. 42(2)(aa) of the Draft Regulation as amended in the compromise parliamentary text. See also N. McBride, L. Sotto and B. Treacy, “Privacy and Data Security: The Future of the US-EU Safe Harbor”, Practical Law, (available at: https://www.huntonprivacyblog.com/files/2013/12/Privacy-Data-Security-The-Future-of-the-US-EU-Safe-Harbor.pdf).
 Art. 42 (3) of the Draft Regulation.
 See Arts. 42 and 43 of the Draft Regulation.
 See Art. 44 of the Draft Regulation.
 “Impact of the draft EC data protection Regulation on data transfers,” (available at: http://www.taylorwessing.com/globaldatahub/article_impact_draft_regulation_data_transfers.html ).
 See Art. 79 of the Draft Regulation. Note however that the compromise parliamentary text has increased the figure to 5% of annual worldwide turnover of an enterprise or €100 m.
 European Parliament, Committee on Civil Liberties, Justice and Home Affairs, 2012/2011 (COD).
 Note that the compromise parliamentary text extended the transition period to five years. See Art. 41(8) of the Draft Regulation as amended in the compromise parliamentary text.
 See the amendment of Art. 77 in the compromise parliamentary text. See also Hunton & William Executive briefing paper update 3 on the proposed General Data Protection Regulation, December 2013.
 P. Blume, “Controller and Processor: Is There a Risk of Confusion?”, International Data Privacy Law, Vol. 3, No 2, 2013, pp.140-145. See also B. Alsenoy, “Allocating Responsibility Among Controllers, Processor, and ‘Everything in Between’: The Definition of Actors and Roles in Directive 95/46/EC”, Computer Law and Security Review, Vol. 28, Issue 1, 2012, pp. 25-43.
 'Producer' means a natural or legal person, public authority, agency or any other body which creates automated data processing or filing systems designed for the processing of personal data by data controllers and data processors. See Art. 4 – (point 6 a (new)) of the LIBE Report. Similarly, the compromise parliamentary text has included a definition for “third parties”, but this appears not to cover cloud intermediaries. See Art. 4(7a) of the compromise parliamentary text.
 Hert and Papakonstantinou, op cit, note 4, p. 134.
 B. Alsenoy, op. cit, p. 39.
 P. Blume, op. cit, note 39.
See J. Hartung, “Germany’s New Rules on Processor Agreement,” (available at. http://wn.com/Germany%27s_new_rules_on_international_processor_agreements ).
 W. Hon and C. Millard, “Data Export in Cloud Computing – How Can Personal Data Be Transferred Outside the EEA? The Cloud of Unknowing, Part 4”, 2011, (available at: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2034286 ).
 W. Hon, C. Millard and I. Walden, “Who is Responsible for Personal Data in the Clouds?” in C. Millard (ed), Cloud Computing Law, (Oxford University Press, United Kingdom, 2013) pp. 193 -219.
 See clauses 5(f), 8(2), 12(2) of the controller to processor standard clauses 2010.
 See clauses 5(h) and 11, ibid.
 D. Svantesson, op. cit., note 3.
 See, for instance, C. Kuner, “The European Commission’s Proposed Data Protection Regulation: A Copernican Revolution in European Data Protection Law”, Bloomberg BNA Privacy and Security Law Report, 2012, p. 9.
 Art. 40 of the Draft Regulation.
 N. McBride, op. cit, note 29.
 See C. Kuner, “Onward Transfer of Personal Data under the U.S. Safe Harbor Framework”, Privacy and Security Law Report, 2009, pp.1-2.
 W. Hon, C. Millard and I. Walden, “Negotiating Cloud Contracts - Looking at Clouds from Both Sides Now,” 2012, (available at: http://ssrn.com/abstract=2055199 ), p. 40.
 E. Pyykko, “Data Protection at the Cost of Economic Growth?” ECRI Commentary, No. 11, November 2012, p. 2.
Iheanyi Samuel Nwankwo, Missing Links in the Proposed EU Data Protection Regulation and Cloud Computing Scenarios: A Brief Overview, 5 (2014) JIPITEC 32 para 1.
Privacy in the Post-NSA Era: Time for a Fundamental Revision?
UsedSoft and the Big Bang Theory: Is the e-Exhaustion Meteor about to Strike?
Open Innovation: Legal Hurdles in the Creation of Contractual Arrangements Governing Idea Competitions?
Google Books and Fair Use: A Tale of Two Copyrights?

References: V. 
 Art. 3
 Art. 3
 Art. 39
 Art. 32
 Art. 31
 Art. 41
 Art. 42
 Art. 42
 Art. 42
 Art. 44
 Art. 79
 Art. 41
 Art. 77
 Art. 4
 Art. 4
 Art. 40