European Commission Details Concerns with Cloud Computing

Cloud computing is one of the fastest growing services in the technology sector. Rather than saving documents, photos, and calendars to a personal computer, cloud computing enables a user to save these files online, ready to be accessed at any location. Businesses that need comprehensive back-up and powerful computing services can use computing services “in the cloud” (in a remote location), and avoid direct capital costs entirely. Cloud computing has enjoyed a 24% annual growth rate over the past few years, led by major players such as Amazon, Salesforce.com, and Savvis. These companies own datacentres all over the world, and distribute databases and processing requirements as needed. On July 1, 2012 the European Commission’s panel on privacy (Article 29 Data Protection Working Party) published its 27-page Opinion 05/2012 on Cloud Computing (Report). Although non-binding, the Report is likely to be influential in giving greater insight into the benefits and risks that cloud computing entails. While the UK and the Scandinavian countries allow greater freedom in the storage, transfer, and processing of personal information, other countries such as Spain and France impose strict requirements that require knowledge of the physical location of data at all times. Some risks can be significant, such as a potential lack of control over the country in which personal data is stored and which subcontractors have access to it. There is further uncertainty over the legality of the transfer of personal data to data centres located outside the European Economic Area (EEA). The Report acknowledges the clear benefits of cloud computing, while noting several concerns. It recommends that clients select a cloud provider that guarantees compliance with EU data protection legislation, especially the legality of cross-border international data transfers, and that any contract should guarantee technical and organizational measures to safeguard security of data. A key first step for any prospective user should be to conduct a comprehensive and thorough risk analysis for using a cloud-base service. For a relevant article on the topic from The New York Times, click here. Summary by: Ramin Wright