Salo and Liyanage
404
“Controller”
1
but also on the “Processor”
2
. The facts that personal data can be rapidly
transferred by the Cloud Service Providers (CSPs) from one data centre to another and
that the customer usually has no control or knowledge over the exact location of the
provided resources (the “location independence” concept described in the article Cloud
Computing Legal Issues: An Overview (Part 1/2)), stimulate customers’ concerns on
data protection and data security compliance [19].
Article 4 of the Data Protection Directive [12] requires the Member States to
apply the data protection rules to controllers who process personal data in the
“context of the activities” of their EEA (European Economic Area) “establishment”,
or who are not “established” in the EEA but, for purposes of processing personal
data, “makes use of ’ equipment” (or “means”) situated in the EEA [20]. However,
the application of article 4 to Cloud Computing is complicated by the fact that
many cloud computing service providers do not own the data centres or equipment
they use, and may well use the resources of other clouds. Those other Cloud Service
Providers in turn may ultimately use data centres and servers rented by third
parties. This means that the cloud users do not necessarily know in which data
centres, or even countries, their data are stored or where their processing operations are run.
In addition, the data protection laws may differ between EU member states. There are
also practical issues relating to whether the Directive can be enforced in non‐EU countries. Clarification is therefore needed in the updated Directive on which country’s
security requirements and other rules apply to a Cloud Computing user or provider [21].
The Governance models and processes need also to take into account the specific
issues arising from the inherently global nature of the Clouds. Data is subject to specific
legislative requirements that may depend on the location where they are hosted, and for
what purposes they are processed. Different countries have different laws regarding
which kind of data may be hosted and where and how it is to be protected. Within the
Cloud, data/code may be hosted anywhere within the distributed infrastructure, that is,
potentially anywhere in the world [8].
Clarification of applicable law governing the flow, processing and protection of data
are desirable, so that both Cloud customers and Cloud Service Providers have a clear
understanding about which rules apply where and how. While there is no question
that the Privacy Directive, like other EU Directives, applies to Cloud services, questions do arise as to how and to what extent they apply (geographic and potential
subject‐matter limits), as well as how they should apply to maximize the potential
benefits of those services, while still providing the appropriate level of personal data
protection [8].
1 Controller means the natural or legal person, public authority, agency or any other body, which alone or
jointly with others determines the purposes and means of the processing of personal data. Processing of
personal data (Processing) means any operation or set of operations, which are performed upon personal
data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation
or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, blocking, erasure or destruction.
2 Processor means a natural or legal person, public authority, agency or any other body, which processes
personal data on behalf of the controller.
404
“Controller”
1
but also on the “Processor”
2
. The facts that personal data can be rapidly
transferred by the Cloud Service Providers (CSPs) from one data centre to another and
that the customer usually has no control or knowledge over the exact location of the
provided resources (the “location independence” concept described in the article Cloud
Computing Legal Issues: An Overview (Part 1/2)), stimulate customers’ concerns on
data protection and data security compliance [19].
Article 4 of the Data Protection Directive [12] requires the Member States to
apply the data protection rules to controllers who process personal data in the
“context of the activities” of their EEA (European Economic Area) “establishment”,
or who are not “established” in the EEA but, for purposes of processing personal
data, “makes use of ’ equipment” (or “means”) situated in the EEA [20]. However,
the application of article 4 to Cloud Computing is complicated by the fact that
many cloud computing service providers do not own the data centres or equipment
they use, and may well use the resources of other clouds. Those other Cloud Service
Providers in turn may ultimately use data centres and servers rented by third
parties. This means that the cloud users do not necessarily know in which data
centres, or even countries, their data are stored or where their processing operations are run.
In addition, the data protection laws may differ between EU member states. There are
also practical issues relating to whether the Directive can be enforced in non‐EU countries. Clarification is therefore needed in the updated Directive on which country’s
security requirements and other rules apply to a Cloud Computing user or provider [21].
The Governance models and processes need also to take into account the specific
issues arising from the inherently global nature of the Clouds. Data is subject to specific
legislative requirements that may depend on the location where they are hosted, and for
what purposes they are processed. Different countries have different laws regarding
which kind of data may be hosted and where and how it is to be protected. Within the
Cloud, data/code may be hosted anywhere within the distributed infrastructure, that is,
potentially anywhere in the world [8].
Clarification of applicable law governing the flow, processing and protection of data
are desirable, so that both Cloud customers and Cloud Service Providers have a clear
understanding about which rules apply where and how. While there is no question
that the Privacy Directive, like other EU Directives, applies to Cloud services, questions do arise as to how and to what extent they apply (geographic and potential
subject‐matter limits), as well as how they should apply to maximize the potential
benefits of those services, while still providing the appropriate level of personal data
protection [8].
1 Controller means the natural or legal person, public authority, agency or any other body, which alone or
jointly with others determines the purposes and means of the processing of personal data. Processing of
personal data (Processing) means any operation or set of operations, which are performed upon personal
data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation
or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, blocking, erasure or destruction.
2 Processor means a natural or legal person, public authority, agency or any other body, which processes
personal data on behalf of the controller.