Cloud Computing Law by Millard Christopher

Author:Millard, Christopher
Language: eng
Format: epub
Publisher: OUP Oxford
Published: 2013-04-15T04:00:00+00:00

6. Possible Solutions for Cloud Computing

Several possible solutions or workarounds may enable cloud computing to be used to store or otherwise process personal data, notwithstanding the data export restriction. Sometimes, a combination of these methods may be used for ‘belt and braces’ purposes, particularly in the not uncommon situation where the status of the provider as processor or controller is not entirely clear.

6.1 Anonymization or encryption

The data export restriction applies only to ‘personal data’ within the DPD’s definition. If information is not, or ceases to be, ‘personal data’, for example because it has been adequately anonymized or strongly encrypted, it may be exported and otherwise dealt with free of the DPD’s restrictions. Furthermore, data fragments stored in the cloud may not be ‘personal data’ in the provider’s hands if the provider is unable to read the fragments, although they would remain ‘personal data’ as regards the cloud user storing the data, who by logging into their account with the provider may reunite the fragments. It might seem, therefore, that a cloud user need not be concerned about the data export restriction provided personal data are strongly encrypted or anonymized before being stored in the cloud, even with a provider that uses data centres located outside the EEA. However, whether the data have truly become ‘anonymous’ depends on the effectiveness of the anonymization, which may change over time as re-identification techniques improve, and similarly the effectiveness of the encryption (including security of key management) affects whether the data remain ‘personal data’. It is also uncertain whether, even if anonymized or encrypted information is treated as anonymous data in a provider’s hands, it would still be considered ‘personal data’ as regards the cloud user uploading the data.83

Until these uncertainties are resolved in all Member States, it is unclear whether encryption or anonymization of data prior to transfer to a cloud provider would be sufficient to prevent a breach of the data export restriction.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.