Issues in regards of Cloud Computing : Data Protection (Part II)

Many cloud based services provide services to each other, so cloud-based products may have to share our information with third parties if they are involved in processing or transferring of our information. When using cloud-based services, one is entrusting their data to a third-party for storage and security. They may share our information with advertisers as well, as many do to help cover the costs.

Of course each cloud-based service has its own terms and conditions, that the user agrees to (often without reading). Terms and conditions between user and company cannot alone protect the privacy and security of the users’ information. Security can be breached, and infrastructure can be damaged.

Moreover, terms and conditions or service level agreements, may be unfair, as well as illegal in some countries, and can of course easily be broken. Some countries have regulations about the protection of private information but in many countries the storing of personal information by companies is not regulated.

What legislative, judicial, regulatory and policy environments are cloud-based information subject to. This question is hard to answer due to the global structure of the internet, as well as of cloud computing.

The information stored by cloud services is subject to the legal, regulatory and policy environments of the country of domicile of the cloud service, as well as the country in which the server infrastructure is based. Privacy sensitive information, in general, is a serious concern.

Cloud computing also raises significant human rights questions, answers to which may pose obstacles for some wanting to take up this new opportunity. For example, how do cloud computing companies keep information secure and protect rights to freedom of expression and freedom of association? What human rights and law enforcement policies will cloud computing services have and how can civil society groups be involved if these are not determined in local contexts?

Cloud computing present specific challenges to privacy and security. In systems of law with extended data protection as in the case for EU and Switzerland, it is permissible to enlist the support of third parties for data processing. However, the data controller is still the one who is responsible for the processing of data, even if it is performed by other third parties on his behalf.

According to Swiss data protection law, the data controller must ensure that an appointed third party (data processor) only processes data in such a way as the data controller himself would be permitted to.

Furthermore, the data controller has to make sure that the data processor meets the same requirements for data security that apply to the data collector.
Depending on the sector (utilities, retail) to which the data controller belongs, specific additional requirements may apply. For example, banks and stock traders have to conclude a written agreement with the data processor in which they oblige the data processor to observe Swiss banking confidentiality. In the contract with the data processor, the bank has to therefore agree on corresponding rights to inspection, rights of command and rights of control.

Under Swiss law, as under EU law, special rules apply when sending personal data abroad.

According to these, exporting data abroad is permissible if legislation that ensures adequate data protection in accordance with Swiss standards exists in the country in which the recipient of the data is located.

Nevertheless, if no adequate data protection legislation exists in the recipient country, the transmission of data from Switzerland is only permissible in special circumstances. In connection with the processing of personal data for business purposes, mention must be made of the following cases, in particular: conclusion of a contract with the data recipient in which they are obliged to observe adequate data protection; consent by the person(s) concerned; and transmission of data that concerns the contracting party in connection with the conclusion or implementation of a contract.

EU national laws require that data security is safeguarded when processing personal data. Confidentiality, availability and integrity of data must be ensured by means of appropriate organisational and technical measures. These also include the protection of systems and data from the risks of unauthorised, arbitrary loss, technical faults, forgery, theft and unlawful use, as well as from unauthorised modification, copying, access or other unauthorised processing. The data collector remains legally responsible for the observance of data security, even if he assigns data processing to a third party.

Sources:

1. http://www.cloudcomputingworld.org 

2. http://www.anassutzi.com

3. Cloud Hooks: Security and Privacy Issues in Cloud Computing  by Wayne A. Jansen, NIST 

    (Proceedings of the 44th Hawaii International Conference on System Sciences - 2011).

4. Aspen Publishers: The Computer and Internet Lawyer ( Cloud computing: Claims).

5. Cloud Computing Legal Issues by Patrick Van Eecke.

6. Legal Issues Associated With Cloud Computing by Laurin H. Mills.

Cloud Computing: Recent Cases (US)

1. Craiglist, Inc. v Naturemarket, Inc. 694 F. Supp. 2d 1039

Overview

In a recently decided case, Craigslist, Inc. v. Naturemarket, Inc. ,  Craigslist won a $1.3 million judgment against a seller of software that enabled automatic posting of listings to Craigslist and scraped email addresses from the Craigslist Web site on a variety of causes of action. 

Read the full case here (under U.S. Cases);

Craiglist, Inc v Naturemarket, Inc. ( 694 F. Supp. 2d 1039 )

2. Party City Corp. v Superior Court of San Diego County, 86 Cal. Rptr. 3d 721

Overview

In Party City Corp. v. Superior Court of San Diego County ,  the California Court of Appeal held that zip codes are not protected personal identification information, rejecting a class action suit that relied on California’s Song-Beverly Credit Card Act of 1971. The court, referring to the terms of the Health Information Technology for Economic and Clinical Health (HITECH) Act, found that five-digit zip codes are group, not individual, identifiers because thousands of people have the same zip code. Courts have split on the question of what is necessary to have standing to pursue claims in database security breach cases. Many courts have held that a mere risk of future identity theft is not enough to confer standing. Others have found that standing to pursue claims did exist in such cases. 

Read the full case here (under U.S. Cases);

Party City Corp. v. Superior Court of San Diego County (  86 Cal. Rptr. 3d 721  )

3. Re Hannaford Bros. Co. Customer Data Breach Sec. Litig. 613 F. Supp. 2d 108

Overview

In Re Hannaford Bros. Co. Customer Data Breach Sec. Litig. , the court dismissed all but one of the class action lawsuits filed by victims of a data breach. The court allowed claims from consumers who had suffered a direct loss to the consumers’ account and dismissed claims by consumers who had the fraudulent charges reversed or had no fraudulent charges.

Read the full case here (under U.S. Cases);

Re Hannaford Bros. Co. Customer Data Breach Sec. Litig.  (   613 F. Supp. 2d 108   )