Privacy in the cloud

Australian Journal of Telecommunications and the Digital Economy, 2014

Co-convenor, Cyberspace Law and Policy Community, UNSW Faculty of Law The Snowden revelations have renewed interest in questions surrounding jurisdictional issues about where data is kept (location) and who claims the capacity to direct access to it be given by the entity hosting it (control). While early attitudes to the cluster of technologies marketed as The Cloud generally played down this aspect, and unilateral contracts offered by many major providers declined to specify these parameters for the technical provision of a Cloud service, growing appreciation that assurances of security and confidentiality are no barrier to certain forms of access being granted to third parties in other jurisdictions has rekindled interest. This paper explores the technical and legal issues involved from the perspective of an Australian business interested in both customer and government attitudes, and discusses how moves to implement jurisdiction location and control preferences have been characterised as Data Sovereignty and Digital Protectionism by differing interests. 31.5 Foreign litigants and governments have a much easier time getting access to your data if it is within their jurisdiction While there are international or inter-country arrangements which enable access in or from other countries, most countries favour access requests made in relation to local documents, or documents under the control of entities over whom they have jurisdiction. Laws in other countries may be quite different from those in your own country. Third party legal access options, including detailed comparisons of mechanisms for such access under Australian jurisdiction and under that of the main cloud hosting forum, the US, are complex, so we discuss some examples in section 4 below. Cloud data storage contracts may be on terms unfavourable to users, or silent on key issues Particularly for Web-grade IaaS (Infrastructure as a Service; see below for cloud acronyms), service provider business models may rely on excluding liability for matters which may be within their control. Typical SaaS (Software as a Service) host models may also depend escaping liability for such matters.

2013

Cloud Computing a leading and getting widely adopted technology in industry, unveils some unprecedented challenges to security of company’s resources such as capital and knowledge based assets. Hither to no much attention has been paid by the governments and there is neither any universal standard adopted, nor any breakthrough to take up these challenges. Traditional contracts and licensing agreements may not provide adequate legal resources and remedies normally associated with the layers of protection for corporations. Intellectual Property, Foreign Direct Investments (FDI) and corporate governance issues have to be fully explored and practiced in domestic and international markets. So this paper discusses the need of establishment of Law and judicial framework of policies to the services embedding cloud computing technology, besides this it also addresses legal issues and existing policies adopted by different countries.

homepage.tudelft.nl

Considerable amount of cloud computing technology is already being used and developed in various flavors. Cloud Computing affects people, process and technology of the enterprise. In spite of having benefits with Cloud computing paradigm such as efficiency, flexibility, easy set up and overall reduction in IT cost , cloud computing paradigm could raise privacy and confidentiality risks. "Not all types of cloud computing raise the same privacy and confidentiality risks. Some believe that much of the computing activity occurring today entirely on computers owned and controlled locally by users will shift to the cloud in the future" . In Cloud computing, users connect to the CLOUD, which appears as a single entity as opposed to the traditional way of connecting to multiple servers located on company premises. Public Private Partnership these days is a usually adopted pattern of governance to meet the diverse needs of their citizens with confidence and providing quality of these services. Cloud Computing Technology can also act as a facilitator between public and private partnership. In such cases there is a possibility that an external party can be involved in providing Cloud Services having partial control over the data storage, processing and transmission of data and privacy regulations become relevant . Cloud computing has significant implications for the privacy of personal information as well as for the confidentiality of business and governmental information. A survey by EDUCAUSE involving 372 of its member institutions revealed that a great proportion of the respondents with use cases that involved cloud-based services reported that data privacy risks and data security risks were among their top barriers to overcome . A principal goal of this paper is to identify privacy and confidentiality issue that may be of interest and concern to cloud computing participants and users . Thus this paper explores to elicit possible issues and regulations in the area of privacy that affect the implementation of Cloud Computing Technologies.

Computers, Privacy and Data Protection: an Element of Choice, 2011

Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of five essential characteristics, three delivery models, and four deployment models. economic utility model with existing computing technologies including the distributed services, applications and information infrastructure. However, without appropriate security and privacy solutions designed for clouds, this potentially revolutionizing computing paradigm could become a huge failure, as in this field cloud computing include activities such as the use of social networking sites and other forms of personal computing. And that's why, the privacy issues and concerns are arising among it.so cloud must ensure that customers continue to have the same level of security and privacy control over their applications and services.

A popular bumper sticker states: " There is no cloud. It's just someone else's computer. " Despite the loss of control that comes with its use, critical records are increasingly being entrusted to the cloud, generating ever-growing concern about the privacy and security of those records. Ultimately, privacy and security constitute an attempt to balance competing needs: privacy balances the need to use information against the need to protect personal data, while security balances the need to provide access to records against the need to stop unauthorized access. The importance of these issues has led to a multitude of legal and regulatory efforts to find a balance and, ultimately, to ensure trust in both digital records and their storage in the cloud. Adding a particular challenge is the fact that distinct jurisdictions approach privacy differently and an in-depth understanding of what a jurisdiction's laws may be, or even under what jurisdiction particular data might be, requires a Herculean effort. And yet, in order to protect privacy and enhance security, this effort is required. This article examines two legal tools for ensuring the privacy and security of records in the cloud, data protection laws, and data localization laws, through the framework of " trust " as understood in archival science. This framework of trust provides new directions for algorithmic research, identifying those areas of digital record creation and preservation most in need of novel solutions.

2021 IEEE International Conference on Service-Oriented System Engineering (SOSE), 2021

The General Data Protection Regulation (GDPR) remains an important requirement for many electronic services which utilise user data. GDPR compliance verification for a cloud provider is aimed to confirm that personal data provided by a user is shared in-line with the requirements of this legislation, so that any subsequent audit carried out on the provider does not lead to a financial penalty. This verification involves two aspects: (i) ensuring that user consent has been obtained; (ii) sharing of data with external cloud providers is undertaken in a transparent way, so that the user is aware of which providers the information was shared with and for what purpose. Using a survey we describe why users are still ambivalent about the use of GDPRand how its adoption can be improved using a Blockchain-based architecture that can provide greater transparency on how GDPR compliance is supported by cloud providers.

law.harvard.edu

IFIP Advances in Information and Communication Technology, 2011

The use of cloud computing services has developed into a new method for deploying software and services and hosting data. The model has provided enormous social and economic benefits but at the same time it has also created potential privacy and security challenges for businesses, individuals and the governments. For example, the use of shared compute environment, data storage and access via internet has made information vulnerable to misuse, and thus, has made privacy a major concern for organisations adopting cloud services for storage and computation purpose. Generally, each country maintains their own laws and regulations to prevent frauds and protect their citizens from harm, including the potential dangers of data privacy, essential when internet and related technologies are involved. The European Union, for example, follows the overarching governmental regulations while the United States prefers the Sectoral Approach to Data Protection legislation, which relies on the combination of legislation, regulation and self regulation. This report discusses data protection issues related to cloud computing and identifies privacy laws enforced in the EU that can be applied to this model. Moreover, it also provides recommendations that cloud service providers can consider to implement in order to provide enhancements to their services and to demonstrate that they have taken all necessary measures to comply with the data protection principals in place.