Cloud Security under Forthcoming Laws
|
|
|
- Moris Atkins
- 8 years ago
- Views:
Transcription
1 SecureCloud May 2016 Cloud Security under Forthcoming Laws Kuan Hon
2 The laws, they are a-changin Cloud security under General Data Protection Regulation Proposed Network & Information Systems Security Directive
3 GDPR
4 GDPR - recap Aim: modernise & harmonise EU DP laws Now law; applies from 25 May 2018 Accountability focus, big fines Security changes for both cloud customers & providers Regulation, not Directive directly effective 2 year lead / transition time
5 GDPR s key changes affecting cloud New processor ( cloud provider ) Obligations, and Expanded requirements when a controller ( cloud customer ) uses a processor ( cloud provider ) Liabilities - Due diligence - Contract terms - Ensuring compliance
6 Processor issues New obligations on processors ( cloud providers ) - security, international transfers, record-keeping, DPO Processor ( cloud provider ) liability ( >> security breach ) Damage incl. non-financial compensation if any contributory breach Exempt if prove not in any way responsible for event giving rise to the damage Recourse against others involved in same processing if paid full compensation N.B. contractual allocation, indemnities! SCL article older version of GDPR
7 GDPR s contract requirements Many prescriptive provisions, including Subject-matter, duration, nature, purpose, type, categories Security & employee confidentiality obligations Information / audit rights for controller Assist re. controller obligations ( nature of processing, info. ) Security, breach notification, DPIA, prior consultation Sub-processors prior consent, notify changes; flow down impossible except for biggest cloud providers? Problem for commoditised, standardised public cloud!
8 Cloud many sub-processors SaaS Provider IaaS / PaaS Provider Data Centre Provider(s) Cloud Customers ( or with IaaS / PaaS Provider direct ) [ Not just cloud! ] Connectivity Provider(s) ( carriers etc )
9 GDPR contracts fine! Fine 2% / 10m for both controller & processor if contract is noncompliant No grandfathering
10 Contracts - practical steps Providers - change standard terms, from 25 May 2018 More detailed allocation of obligations, liability; indemnities Increase pricing; extra charges for providing assistance etc. ( Unlikely to agree to GDPR terms before 25 May more onerous ) Customers - contracts expiring after 25 May 2018 ( if negotiable ) Add change of law / change control term re.: Comply with GDPR requirements, who bears costs of change Responsibility & liability allocation, indemnities; pricing / charges Start considering changes / negotiating position NB. existing ( even noncloud ) contracts too Commission / supervisory authority may adopt standard terms CSA leadership role draft & put forward cloud-appropriate terms?
11 GDPR s security requirements Controllers & processors ( incl. cloud ) C I A, incl. encryption + resilience / bus. continuity + regularly test & evaluate effectiveness Risk-based incl. state of art, costs + steps to prevent persons with authorised access from processing except on controller s instructions ( or EU / Member State law ) Practical impact apply security best practices NB. organisational measures people, processes NB. accountability focus records / logs
12 Processors security obligations How to ensure security appropriate to individual customers, in public cloud? Tiered services / rates + warranties / indemnities?
13 Other GDPR changes re. cloud security Fine for breach of security requirements Controller: 4% / 20m Processor: 2% / 10m ( + Compliance may help mitigate fines ) Approved codes / certifications help show compliance CSA leadership role propose CCM etc? Personal data breach notification obligations Controller To authority; individuals ( encryption ) Processor to controller
14 Largest ICO Fine v. Large UK FS co. s revenues m m 20m = 15.3m 10m = 7.6m 4% m 2% 80.0 m Fine 60.0 m 40.0 m 20.0 m 0.0 m Revenues 2015 (%) 10m 20m
15 Implications for cloud Guaranteed security & strict liability vs price? Costs to customise etc., vs public cloud Risks infrastructure providers Raise prices; refuse services; close EEA ops, free services; not use EEA DCs? Impact on innovation / services to EEA citizens Or will laws be ignored? Enforceable, fines.. Favouring large incumbents over small startups? Control / influence supply / contract chain, afford certifications
16 Killing cloud quickly with DP? The GDPR's coming, soon to be law they say Middle of will be the fateful day! What will this mean for clo-ud? Will cloud be here to sta-ay? Don't want to be pessimistic, not sure how we'll find a way Killing cloud quickly with DP, killing cloud quickly, with DP Tearing up SaaS, PaaS and I-aaS Killing cloud quickly, with DP? Full article Photo of Roberta Flack by Roland Godefroy CC BY 2.5
17 Summary Start now! Fines will get boardroom attention Processors new obligations / liability Controllers & ( sub- ) processors Re-engineer systems / processes to comply, incl. Contracts for both inventory, changes; liability allocation, indemnities, seek faultbased Cloud solutions? CSA standard clauses? Controllers - DP by design & default, incl. security; DPIAs, incl. security Codes & certifications etc. - increased role CSA certifications etc?
18 NETWORK & INFORMATION SYSTEMS SECURITY DIRECTIVE
19 Security & incident notification obligations Operators of essential services + Digital service providers All data, not just personal data Overview Supervision Regulatory powers - info, audits, remediation, notify other MS, ( after consulting ) public MS rules on penalties for infringement Other points Minimum harmonisation, Directive To improve MS cyber-capabilities, co-op / info sharing ( CSIRTs etc. )
20 Timetable Politically agreed, Council adopted in 1 st reading on 17 May 2016 Parliament adoption - expected July 2016; in force Aug 2016? 21 months for MS to implement nationally + 6 months to identify operators So probably 2018
21 Operators MSs to identify operators ( list / objective criteria ) & determine national regulator(s) Banks, financial market infrastucture, energy, water, transport, health, digital infrastructure ( IXPs, DNS providers, TLD name registries ) Exceptions - Framework Directive, EIDAS TSPs, equivalent sectoral obligations Requirements!= GDPR? Security - appropriate and proportionate technical & organisational measures to manage risks to NIS security ( vs individuals; processing ) state of the art ( costs? ) Notification - incident ( event actual adverse effect on NIS security ) vs personal data breach
22 DSPs Lighter requirements, light-touch ex post supervision Risk-appropriate No extra MS requirements ( unless national security, law enforcement ) Online marketplace, online search engine, cloud provider offering services in EU Even SaaS, but excluding SMEs More from Commission on security elements etc. By 1 year after Directive in force
23 Incident notification Operators of essential services Without undue delay to competent authority / CSIRT If significant impact on essential service s continuity Incl. incident affecting DSP relied on for essential service DSPs Without undue delay If substantial impact on provision of service in EU Guidance? Commission & national authorities - TBA
24 Possible problems Operators multiple Member States Essential in some only? Slightly different security & notification requirements under NISD / GDPR Eg notify different authorities?
25 Technology issues Technologyneutrality Understanding of technology End to end? Not Why cloud cf non-cloud, eg web hosting? Why SaaS too? Why not hardware, software? Cf US FTC
26 Practical steps Start preparing now! And monitor Operators essential services relying on cloud Cloud services ( & more ) Operators national law, guidance DSPs + Commission acts Compliance with security & notification obligations in cloud? Contracts security, incident notification requirements; negotiation with providers! Cloud sub-processors? Systems, processes, etc. as well as contracts
27 Overall summary of practical steps Start now! GDPR fines board Contracts inventory, change control etc. Systems / processes change; best practices Both security & detection / notification measures NB. differences between GDPR / NIS Rehearsals etc. Consider insurance Will the new laws boost cyber-insurance market?
28 Further info Data security developments under the General Data Protection Regulation ( older GDPR draft ) GDPR contract issues, impact on service providers ( on older GDPR draft ) GDPR impact on cloud generally ( shorter version ) Policy problems affecting cloud GDPR s application to non-eu organisations See also and
29 Thank you! Kuan Hon Half lawyer half geek mostly harmless Twitter: my domain below; also kuan.hon@pinsentmasons.com blog.kuan.com
Cloud Data Protection Fitness - A Workout
Cloudscape 2016 8 March 2016 Cloud Data Protection Fitness - A Workout Dr Kuan Hon k@kuan0.com kuan.hon@pinsentmasons.com General Data Protection Regulation Adoption 2016? Jurists / linguists to finalise
GDPR & Service Providers ( Cloud Focus )
OASIS / EEMA Digital Enterprise Europe 2015 Building Trust in the Hyperconnected World 8 July 2015 GDPR & Service Providers ( Cloud Focus ) Kuan Hon Senior Researcher, Cloud Legal Project & Microsoft Cloud
GDPR & Cloud Providers Keynote Presentation
Cloudscape VII 9 March 2015 GDPR & Cloud Providers Keynote Presentation Kuan Hon Research Consultant, Cloud Legal Project & MCCRC Centre for Commercial Law Studies Queen Mary, University of London w.k.hon@qmul.ac.uk
Cloud Security under the EU Data Protection Directive and draft General Data Protection Regulation
ENISA EU28 Cloud Security Conference 16 June 2015 Cloud Security under the EU Data Protection Directive and draft General Data Protection Regulation Kuan Hon Senior Researcher, Cloud Legal Project & Microsoft
The Data Protection Landscape. Before and after GDPR: General Data Protection Regulation
The Data Protection Landscape Before and after GDPR: General Data Protection Regulation Data Protection regulations across Europe Current regulations & guidance European Directives 95/46/EC (Data Protection)
Article 29 Working Party Issues Opinion on Cloud Computing
Client Alert Global Regulatory Enforcement If you have questions or would like additional information on the material covered in this Alert, please contact one of the authors: Cynthia O Donoghue Partner,
The potential legal consequences of a personal data breach
The potential legal consequences of a personal data breach Tue Goldschmieding, Partner 16 April 2015 The potential legal consequences of a personal data breach 15 April 2015 Contents 1. Definitions 2.
Cloud computing and personal data protection. Gwendal LE GRAND Director of technology and innovation CNIL
Cloud computing and personal data protection Gwendal LE GRAND Director of technology and innovation CNIL 1 Data protection in Europe Directive 95/46/EC Loi 78-17 du 6 janvier 1978 amended in 2004 (France)
EU Data Protection and Information Security for Banking & Financial Service sectors 4 th December 2014
EU Data Protection and Information Security for Banking & Financial Service sectors 4 th December 2014 Janine Regan, Associate George Willis, Associate charlesrussellspeechlys.com Janine Regan Associate
AN INSIDE VIEW FROM THE EU EXPERT GROUP ON CLOUD COMPUTING
AN INSIDE VIEW FROM THE EU EXPERT GROUP ON CLOUD COMPUTING 1. Overview and Background On 27 September 2012, the European Commission adopted a strategy for "Unleashing the potential of cloud computing in
New EU Data Protection legislation comes into force today. What does this mean for your business?
24 th May 2016 New EU Data Protection legislation comes into force today. What does this mean for your business? After years of discussion and proposals, the General Data Protection Regulation ( GDPR )
Data Protection Avoiding Information Commissioner Fines. Caroline Egan 5 June 2014
Data Protection Avoiding Information Commissioner Fines Caroline Egan 5 June 2014 Why is data protection a hot topic in pensions? Pension schemes hold large amounts of personal data Individuals more aware
Data Centres North Data Centre Security is the tail wagging the dog? May 11-12 2015
Data Centres North Data Centre Security is the tail wagging the dog? May 11-12 2015 Mark Bailey - Partner charlesrussellspeechlys.com Introduction Why do data centres exist? process data? protect data?
14 December 2006 GUIDELINES ON OUTSOURCING
14 December 2006 GUIDELINES ON OUTSOURCING CEBS presents its Guidelines on Outsourcing. The proposed guidelines are based on current practices and also take into account international, such as the Joint
Privacy and Electronic Communications Regulations
ICO lo Notification of PECR security breaches Privacy and Electronic Communications Regulations Contents Introduction... 2 Overview... 2 Relevant security breaches... 3 What is a service provider?... 3
Recommendations for companies planning to use Cloud computing services
Recommendations for companies planning to use Cloud computing services From a legal standpoint, CNIL finds that Cloud computing raises a number of difficulties with regard to compliance with the legislation
Comments and proposals on the Chapter IV of the General Data Protection Regulation
Comments and proposals on the Chapter IV of the General Data Protection Regulation Ahead of the trialogue negotiations later this month, EDRi, Access, Panoptykon Bits of Freedom, FIPR and Privacy International
Data Protection Act 1998. Guidance on the use of cloud computing
Data Protection Act 1998 Guidance on the use of cloud computing Contents Overview... 2 Introduction... 2 What is cloud computing?... 3 Definitions... 3 Deployment models... 4 Service models... 5 Layered
How To Understand The Legal Background Of Cloud Computing
BCS Advanced Programming SG 8 November 2012 Cloud Computing The Legal Background Kuan Hon Consultant, Cloud Legal Project Centre for Commercial Law Studies Queen Mary, University of London http://cloudlegalproject.org
The European General Data Protection Regulation. A guide for the insurance industry
The European General Data Protection Regulation A guide for the insurance industry IMPORTANT NOTE: This guide is based on the politically agreed compromise text agreed by the European Commission, EU Parliament
Proposed guidance for firms outsourcing to the cloud and other third-party IT services
Guidance consultation 15/6 Proposed guidance for firms outsourcing to the cloud and other third-party IT services November 2015 1. Introduction and consultation 1.1 The purpose of this draft guidance is
Security breaches: A regulatory overview. Jonathan Bamford Head of Strategic Liaison
Security breaches: A regulatory overview Jonathan Bamford Head of Strategic Liaison Security breaches and the DPA Data controllers security obligation - principle 7 of the DPA o Appropriate technical and
Security incidents affecting personal data: an exploratory travel from technology to law (*under Chatham House Rule)
Security incidents affecting personal data: an exploratory travel from technology to law (*under Chatham House Rule) DPO meeting 8 May 2015 Mario Guglielmetti Legal officer Unit Supervision and Enforcement
Impact of EU General Data Protection Regulation
Impact of EU General Data Protection Regulation A White Paper Thursday 15 October 2015 The law stated is correct as of this date. This does not constitute legal advice and it is highly recommended to seek
White paper. The Essential Guide to the EU Data Law Changes. your technology, expertly marketed
White paper The Essential Guide to the EU Data Law Changes This guide explains exactly what the EU Data Protection Regulation is and how it will change life as we know it when it comes into enforcement
August 2011. Report on Cloud Computing and the Law for UK FE and HE (An Overview)
August 2011 Report on Cloud Computing and the Law for UK FE and HE (An Overview) Please Note: This guidance is for information only and is not intended to replace legal advice when faced with a risk decision.
Cyber Security : preventing and mitigating incidents. Alexander Brown Robert Allen
Cyber Security : preventing and mitigating incidents Alexander Brown Robert Allen 07 & 08 October 2015 Cyber Security context of the threat The magnitude and tempo of [cyber security attacks], basic or
EU Data Protection Reforms Challenges for Business
www.pwc.com Contents EU Data Protection Reforms Challenges for Business July 2014 1. Introduction 2. The need for change 3. Changes and challenges 4. Recommendations 5. Conclusion 6. For a deeper conversation
Corporate Compliance: A Global Perspective
Corporate Compliance: A Global Perspective 6/27/2012 37 Offices in 18 Countries Current Compliance Environment Ever-intensifying regulatory burden new areas of regulation existing regulations becoming
CLOUD-BASED BIM AND SMART ASSET MANAGEMENT: ADOPTING A SECURITY-MINDED APPROACH
CLOUD-BASED BIM AND SMART ASSET MANAGEMENT: ADOPTING A SECURITY-MINDED APPROACH March 2016 Disclaimer Reference to any specific commercial product, process or service by trade name, trademark, manufacturer,
Outsourcing Risk Guidance Note for Banks
Outsourcing Risk Guidance Note for Banks Part 1: Definitions Guideline 1 For the purposes of these guidelines, the following is meant by: a) outsourcing: an authorised entity s use of a third party (the
Privacy Level Agreement Outline for the Sale of Cloud Services in the European Union
Privacy Level Agreement Working Group Privacy Level Agreement Outline for the Sale of Cloud Services in the European Union February 2013 The PLA Outline has been developed within CSA by an expert working
Mapping of outsourcing requirements
Mapping of outsourcing requirements Following comments received during the first round of consultation, CEBS and the Committee of European Securities Regulators (CESR) have worked closely together to ensure
Position of the retail and wholesale sector on the Draft Data Protection Regulation in view of the trilogue 2015
2 September 2015 Position of the retail and wholesale sector on the Draft Data Protection Regulation in view of the trilogue 2015 We support the efforts of EU legislators to create a harmonised data protection
Overview. Data protection in a swirl of change 28.03.2014. Cloud computing. Software as a service. Infrastructure as a service. Platform as a service
Data protection in a swirl of change Overview 1 Data protection issues in cloud computing 2 Consent for mobile applications Security Seminar 2014: Privacy Radboud University Nijmegen 3 The WhatsApp case
Align Technology. Data Protection Binding Corporate Rules Processor Policy. 2014 Align Technology, Inc. All rights reserved.
Align Technology Data Protection Binding Corporate Rules Processor Policy Confidential Contents INTRODUCTION TO THIS POLICY 3 PART I: BACKGROUND AND ACTIONS 4 PART II: PROCESSOR OBLIGATIONS 6 PART III:
15229/2/15 REV 2 KM/ek 1 DG E2B
Council of the European Union Brussels, 18 December 2015 (OR. en) Interinstitutional File: 2013/0027 (COD) 15229/2/15 REV 2 NOTE From: To: Presidency Permanent Representatives Committee TELECOM 232 DATAPROTECT
Inhouse Masterclass: Data Developments - Cyber Security & the Right to be Forgotten. MHC.ie
Inhouse Masterclass: Data Developments - Cyber Security & the Right to be Forgotten MHC.ie Rewriting the Past Oisin Tobin otobin@mhc.ie Agenda 1. Background 2. Findings and impact: a) Jurisdiction b) A
PCL2\13991300\1 CYBER RISKS: RISK MANAGEMENT STRATEGIES
PCL2\13991300\1 CYBER RISKS: RISK MANAGEMENT STRATEGIES Cyber Attacks: How prepared are you? With barely a day passing without a reported breach of corporate information security, the threat to financial
Data Processing Agreement for Oracle Cloud Services
Data Processing Agreement for Oracle Cloud Services Version December 1, 2013 1. Scope and order of precedence This is an agreement concerning the Processing of Personal Data as part of Oracle s Cloud Services
Response to Justice Select Committee's Call for Evidence on the EU Data Protection Framework Proposals. Cloud Legal Project 17 August 2012
Response to Justice Select Committee's Call for Evidence on the EU Data Protection Framework Proposals Cloud Legal Project 17 August 2012 1. This response is by Christopher Millard, Alan Cunningham and
Mitigating and managing cyber risk: ten issues to consider
Mitigating and managing cyber risk: ten issues to consider The board of directors is responsible for managing and mitigating risk exposure. A recent study conducted by the Ponemon Institute 1 revealed
(a) the kind of data and the harm that could result if any of those things should occur;
Cloud Computing This information leaflet aims to advise organisations on the factors they should take into account in considering engaging cloud computing. It explains the relevance of the Personal Data
Big Data for Mutuals. Marc Dautlich 25 November 2013
Big Data for Mutuals Marc Dautlich 25 November 2013 Agenda BIG DATA What is it? OPPORTUNITIES What are they? LEGAL CHALLENGES How do we overcome them? LEGAL REFORM What can we do now to minimise impact?
CONSULTATION PAPER ON HIGH LEVEL PRINCIPLES ON OUTSOURCING COVER NOTE
CEBS CP 02 April 2004 COMMITTEE OF EUROPEAN BANKING SUPERVISORS CONSULTATION PAPER ON HIGH LEVEL PRINCIPLES ON OUTSOURCING COVER NOTE Introduction 1. European banking supervisors began work in 2002 on
Insurance Europe key messages on the European Commission's proposed General Data Protection Regulation
Position Paper Insurance Europe key messages on the European Commission's proposed General Data Protection Regulation Our reference: SMC-DAT-12-064 Date: 3 September 2012 Related documents: Proposal for
FG 16/5 - Guidance for firms outsourcing to the cloud and other third-party IT services
Finalised guidance FG 16/5 - Guidance for firms outsourcing to the cloud and other third-party IT services July 2016 Background 1.1 1.2 1.3 The purpose of this guidance is to clarify the requirements on
Data and Cyber Laws Up-date 9 July 2015
Data and Cyber Laws Up-date 9 July 2015 Janine Regan Alexia Zuber Viktoria Protokova Simon Holdsworth charlesrussellspeechlys.com Topics Updates on the key aspects of, and commentary on, the proposed GDPR
Cloud Computing. Introduction
Cloud Computing Introduction This information leaflet aims to advise organisations which are considering engaging cloud computing on the factors they should consider. It explains the relationship between
The Impact of EU Data Protection Legislation. Thomas Rivera Hitachi Data Systems
Privacy PRESENTATION vs Data TITLE Protection: GOES HERE The Impact of EU Data Protection Legislation Thomas Rivera Hitachi Data Systems SNIA Legal Notice The material contained in this tutorial is copyrighted
Guidance on Personal Data Protection in Cross-border Data Transfer 1
Guidance on Personal Data Protection in Cross-border Data Transfer PART 1: INTRODUCTION Section 33 of the Personal Data (Privacy) Ordinance (the Ordinance ) prohibits the transfer of personal data to places
White Paper: Data Protection In The Cloud. Data Protection In The Cloud
White Paper: Data Protection In The Cloud Data Protection In The Cloud Introduction The rapid emergence of cloud computing has placed it at the forefront of IT decision making and business strategies.
Welcome & Introductions
Addressing Data Privacy and Security Compliance in Cloud Computing Benjamin Hayes, Director of Legal Services, Data Privacy Compliance North America Accenture Copyright 2011 Accenture All Rights Reserved.
Data Protection in Clinical Studies Implications of the New EU General Data Protection Regulation
June 19, 2012 Practice Group(s): Health Care Life Sciences Data Protection in Clinical Studies Implications of the New EU General Data Protection Regulation By Mathias Schulze Steinen and Daniela Bohn
5581/16 AD/NC/ra DGE 2
Council of the European Union Brussels, 21 April 2016 (OR. en) Interinstitutional File: 2013/0027 (COD) 5581/16 LEGISLATIVE ACTS AND OTHER INSTRUMTS Subject: TELECOM 7 DATAPROTECT 6 CYBER 4 MI 37 CSC 15
Cloud Security Standardisation & Certification. Arjan de Jong Policy Advisor Information Security
Cloud Security Standardisation & Certification Arjan de Jong Policy Advisor Information Security Overview Economics of standardization and certification (EU) Legal requirements for (cloud) security International
Data Protection and Cloud Computing: an Overview of the Legal Issues
Data Protection and Cloud Computing: an Overview of the Legal Issues Christopher Kuner Partner, Hunton & Williams, Brussels Research Assistant, University of Copenhagen Nordic IT Law Conference Copenhagen,
Standard conditions of purchase
Standard conditions of purchase 1 OFFER AND ACCEPTANCE 2 PROPERTY, RISK & DELIVERY 3 PRICES & RATES The Supplier shall provide all Goods and Services in accordance with the terms and conditions set out
FI and AM&IF CPD Day Asset Managers and Outsourcing key issues
FI and AM&IF CPD Day Asset Managers and Outsourcing key issues Tom Wheadon Lawrence Brown Nick Colston 9 October 2013 and 10 October 2013 Introduction Overall objectives: to help recognise and address
Data Protection, Software Licenses and other Legal Issues in the Cloud
Data Protection, Software Licenses and other Legal Issues in the Cloud Dr. Hendrik Schöttle Rechtsanwalt, Fachanwalt für IT-Recht OSDC 2012, Nuremberg 26. April 2012 Overview Introduction Data Protection
INFORMATION SECURITY GUIDE. Cloud Computing Outsourcing. Information Security Unit. Information Technology Services (ITS) July 2013
INFORMATION SECURITY GUIDE Cloud Computing Outsourcing Information Security Unit Information Technology Services (ITS) July 2013 CONTENTS 1. Background...2 2. Legislative and Policy Requirements...3 3.
CCBE RESPONSE REGARDING THE EUROPEAN COMMISSION PUBLIC CONSULTATION ON CLOUD COMPUTING
CCBE RESPONSE REGARDING THE EUROPEAN COMMISSION PUBLIC CONSULTATION ON CLOUD COMPUTING CCBE response regarding the European Commission Public Consultation on Cloud Computing The Council of Bars and Law
EBA s regulatory work on payments. Geoffroy Goffinet PAYMENT SYSTEMS MARKET EXPERT GROUP 03/12/2015
EBA s regulatory work on payments Geoffroy Goffinet PAYMENT SYSTEMS MARKET EXPERT GROUP 03/12/2015 The role of the EBA The EBA was established by Regulation (EC) No. 1093/2010 of the European Parliament
Demystifying Cyber Insurance. Jamie Monck-Mason & Andrew Hill. Introduction. What is cyber? Nomenclature
Demystifying Cyber Insurance Jamie Monck-Mason & Andrew Hill Introduction What is cyber? Nomenclature 1 What specific risks does cyber insurance cover? First party risks - losses arising from a data breach
Working Group on. First Working Group Meeting 29.5.2012
Working Group on Cloud Security and Privacy (WGCSP) First Working Group Meeting 29.5.2012 1 Review of fexisting i Standards d and Best Practices on Cloud Security Security Standards and Status List of
CPNI VIEWPOINT 01/2010 CLOUD COMPUTING
CPNI VIEWPOINT 01/2010 CLOUD COMPUTING MARCH 2010 Acknowledgements This viewpoint is based upon a research document compiled on behalf of CPNI by Deloitte. The findings presented here have been subjected
LIABILITY FOR NON-COMPLIANCE WITH DATA PROTECTION OBLIGATIONS
LIABILITY FOR NON-COMPLIANCE WITH DATA PROTECTION OBLIGATIONS This document is a rough draft aiming at presenting key provisions, current clauses used in Cloud computing contracts and first drafts on possible
Cloud Computing: The atmospheric jeopardy. Unique Approach Unique Solutions. Salmon Ltd 2014 Commercial in Confidence Page 1 of 5
Cloud Computing: The atmospheric jeopardy Unique Approach Unique Solutions Salmon Ltd 2014 Commercial in Confidence Page 1 of 5 Background Cloud computing has its place in company computing strategies,
How To Understand The Privacy Shield
The Privacy Shield and EU GDP Regulation- A Data Safekeeping Revolution? SCCE Webinar May 24, 2016 Presenter: Dan Cotter dcotter@butlerrubin.com 312-696-4497 Agenda - What is the Privacy Shield - What
Ofcom guidance on security requirements in sections 105A to D of the Communications Act 2003
Ofcom guidance on security requirements in sections 105A to D of the Communications Act 2003 Guidance Publication date: 08 August 2014 About this document The legislation that applies to telecoms providers
Financial Services Guidance Note Outsourcing
Financial Services Guidance Note Issued: April 2005 Revised: August 2007 Table of Contents 1. Introduction... 3 1.1 Background... 3 1.2 Definitions... 3 2. Guiding Principles... 5 3. Key Risks of... 14
Changes to Consumer Credit Regulation
A Guide for Motor Dealers Introduction Motor Dealers are invariably also credit brokers and are currently required to be licensed by the Office of Fair Trading (OFT) for (at least) their credit broking
1.1 An initial request to enter into a contractual arrangement may be initiated by either Massey University or another party (Other Party).
CONTRACT MANAGEMENT PROCEDURE Section Risk Management Contact Risk Manager Last Review February 2013 Next Review February 2016 Approval Not required Procedures Contract Initiation Request Mandatory Guidance
Questions for the Discussion on Subcontracting
EU Expert Group on Cloud Computing Contracts Questions for the Discussion on Subcontracting Current practices and risks 1. Do cloud providers subcontract to one subcontractor or rather to a whole chain
EUROPEAN COMMISSION Directorate-General for Research & Innovation. Guidance How to draw up your consortium agreement
EUROPEAN COMMISSION Directorate-General for Research & Innovation Guidance How to draw up your consortium agreement Version 2.0 23 February 2015 Guidance How to draw up your consortium agreement: V2.0
Clause 1. Definitions and Interpretation
[Standard data protection [agreement/clauses] for the transfer of Personal Data from the University of Edinburgh (as Data Controller) to a Data Processor within the European Economic Area ] In this Agreement:-
This Amendment consists of two parts. This is part 1 of 2 and must be accompanied by and signed with part 2 of 2 (Annex 1) to be valid.
Microsoft Online Subscription Agreement Amendment adding Office 365 Data Processing Agreement (with EU Standard Contractual Clauses) Amendment ID Proposal ID MOSA number Microsoft to complete This Amendment
A buyer can buy either the shares of the company that owns the target business or simply buy the assets which make up that business:
Buying a business This briefing highlights the main legal risks to consider when buying another business or enterprise. A buyer should always take legal advice at the outset of any acquisition. Structuring
A Flexible and Comprehensive Approach to a Cloud Compliance Program
A Flexible and Comprehensive Approach to a Cloud Compliance Program Stuart Aston Microsoft UK Session ID: SPO-201 Session Classification: General Interest Compliance in the cloud Transparency Responsibility
How To Protect Your Data In The Cloud
Cloud Computing Hot topics in relation to security, liability and privacy Steven De Schrijver Cloud Computing : who and what is involved? Data Cloud Service Provider (e.g. SaaS, PaaS, IaaS) Sub-contractor
Annex 1. Contract Checklist for Cloud-Based Genomic Research Version 1.0, 21 July 2015
Annex 1. Contract Checklist for Cloud-Based Genomic Research Version 1.0, 21 July 2015 The following comprises a checklist of areas that genomic research organizations or consortia (collectively referred
Data Privacy, Security, and Risk Management in the Cloud
Data Privacy, Security, and Risk Management in the Cloud Diana S. Hare, Associate General Counsel and Chief Privacy Counsel, Drexel University David W. Opderbeck, Counsel, Gibbons P.C. Robin Rosenberg,
Multi-Jurisdictional Study: Cloud Computing Legal Requirements. Julien Debussche Associate January 2015
Multi-Jurisdictional Study: Cloud Computing Legal Requirements Julien Debussche Associate January 2015 Content 1. General Legal Framework 2. Data Protection Legal Framework 3. Security Requirements 4.
Translation from German. GENERAL TERMS AND CONDITIONS of mangoart GmbH Bräuergasse 11, 4470 Enns, Austria +43 7223 / 912 78, office@mangoart.
Translation from German GENERAL TERMS AND CONDITIONS of mangoart GmbH Bräuergasse 11, 4470 Enns, Austria +43 7223 / 912 78, office@mangoart.at 1. Applicability; Conclusion of contract 1.1 mangoart GmbH
Risks in International Consultancy Appointments: The FIDIC White Book
Risks in International Consultancy Appointments: The FIDIC White Book An increasing number of UK based consultants are involved in international projects. Given the forecasted growth in global construction
Financial Regulation: An overview of the FCA s proposal of the new Consumer Credit regime October 2013
Financial Regulation: An overview of the FCA s proposal of the new Consumer Credit regime October 2013 Consultation Paper 13/10: Detailed Proposals for the FCA regime for Consumer Credit In early October
The eighth data protection principle and international data transfers
Data Protection Act 1998 The eighth data protection principle and international data transfers The Information Commissioner s recommended approach to assessing adequacy including consideration of the issue
Presentation by: Dr. Nathalie Moreno Partner. Cloud Computing and Data Protection: an Update 4 October 2012
Presentation by: Dr. Nathalie Moreno Partner Cloud Computing and Data Protection: an Update 4 October 2012 Our team Speechly Bircham is an ambitious, international mid-size fullservice law firm head-quartered
OUTSOURCING, HOSTING AND DATA PRIVACY ISSUES
OUTSOURCING, HOSTING AND DATA PRIVACY ISSUES 4 April 2013 James Castro-Edwards Solicitor Monica Salgado Advogada / Portuguese Lawyer OUR TEAM Speechly Bircham is an ambitious, full-service law firm with
Compliance Management, made easy
Compliance Management, made easy LOGPOINT SECURING BUSINESS ASSETS SECURING BUSINESS ASSETS LogPoint 5.1: Protecting your data, intellectual property and your company Log and Compliance Management in one
Invitation of expressions of interest for the provision of insurance cover
Invitation of expressions of interest for the provision of insurance cover 1. Context and Overview 1.1. The Authority The Irish Auditing and Accounting Supervisory Authority ( IAASA ) is the independent
COMMISSION REGULATION (EU) No /.. of XXX
EUROPEAN COMMISSION Brussels, XXX [ ](2013) XXX draft COMMISSION REGULATION (EU) No /.. of XXX on the measures applicable to the notification of personal data breaches under Directive 2002/58/EC on privacy
MODEL CONTRACTS FOR SMALL FIRMS LEGAL GUIDANCE FOR DOING INTERNATIONAL BUSINESS
MODEL CONTRACTS FOR SMALL FIRMS LEGAL GUIDANCE FOR DOING INTERNATIONAL BUSINESS International Trade Centre, August 2010 Contents Foreword Acknowledgements Introduction Chapter 1 International Contractual
Cloud Computing and Records Management
GPO Box 2343 Adelaide SA 5001 Tel (+61 8) 8204 8773 Fax (+61 8) 8204 8777 DX:336 srsarecordsmanagement@sa.gov.au www.archives.sa.gov.au Cloud Computing and Records Management June 2015 Version 1 Version
Isaac Willett April 5, 2011
Current Options for EHR Implementation: Cloud or No Cloud? Regina Sharrow Isaac Willett April 5, 2011 Introduction Health Information Technology for Economic and Clinical Health Act ( HITECH (HITECH Act
E-PRIVACY DIRECTIVE: Personal Data Breach Notification
E-PRIVACY DIRECTIVE: Personal Data Breach Notification PUBLIC CONSULTATION BEUC Response Contact: Kostas Rossoglou digital@beuc.eu Ref.: X/2011/092-13/09/11 EC register for interest representatives: identification
OPINION MAY 2012 ON CLOUD COMPUTING Article 29 Data Protection Working Party (July 1, 2012)
OPINION MAY 2012 ON CLOUD COMPUTING Article 29 Data Protection Working Party (July 1, 2012) ARTICLE 29 DATA PROTECTION WORKING PARTY 01037/12/EN WP 196 Opinion 05/2012 on Cloud Computing Adopted July 1
EU Regulatory Trends in Data Protection & Cybersecurity What should be on the industry s agenda?
EU Regulatory Trends in Data Protection & Cybersecurity What should be on the industry s agenda? Dr. Jörg Hladjk Counsel European Data Protection & Privacy Practice Hunton & Williams, Brussels Cyber Security
Sarbanes-Oxley Compliance for Cloud Applications
Sarbanes-Oxley Compliance for Cloud Applications What Is Sarbanes-Oxley? Sarbanes-Oxley Act (SOX) aims to protect investors and the general public from accounting errors and fraudulent practices. For this
Processor Binding Corporate Rules (BCRs), for intra-group transfers of personal data to non EEA countries
Processor Binding Corporate Rules (BCRs), for intra-group transfers of personal data to non EEA countries Sopra HR Software as a Data Processor Sopra HR Software, 2014 / Ref. : 20141120-101114-m 1/32 1.