Lots of clouds: a stormy weather for information privacy?

Transcription

1 Lots of clouds: a stormy weather for information privacy? Michel Jaccard Sylvain Métille Web idest.pro

2 Introduction Purpose: know what you do, why you do it, the risks and the best practices Assumption: you all know what cloud computing means from a technical / organisational point of view. What about legal pitfalls? Scope: Analysis limited to privacy issues, and to major legal concepts 2

3 Cloud computing Specific Risks Loss of control over data? Not entirely specific, but reinforced Non compliance with the law? Not entirely specific, but reinforced Vendor lock in? Not entirely specific, but reinforced Access requests by law enforcement authorities? Not entirely specific, but reinforced 3

4 Information privacy (legal) Data Protection Act ok Directive/regulation apply to data treated in EU or related to residents One statute state laws + sectorial 4

5 Information privacy (global) Data all information relating to an identified or identifiable natural (or legal) person Consent Voluntarily given Based on adequate information 5

6 Cloud based locally Cloud = data transmitted to a third party 6

7 Cloud based locally 10a DPA Data processing by third parties Processing assigned by agreement or by law Data is processed in the manner permitted to the instructing party itself Not prohibited by law or duty of confidentiality Third party guarantees data security Informed consent 7

8 Cloud based far away Cloud = data transmitted abroad (adequate protection) 8

9 Cloud based far away 6 DPA Cross-border disclosure Requires legislation that guarantees an adequate protection Ok for the contracting parties to Convention 108 (OECD minus Russia, Turkey, Armenia and San Marino) Only data related to private persons 9

10 Cloud based far far away Cloud = data transmitted abroad (no adequate protection) 10

11 Cloud based far far away Instead of a legislation that guarantees an adequate protection Safeguards can be granted in a contract (models) Safe Harbor Framework (USA) only data of private persons Consent in the specific case 11

12 Risks depending on the local law USA: third-party doctrine the one who knowingly reveals information to a third party relinquishes the Fourth Amendment protection in that information. 12

13 Sample provisions We may disclose your information to members of our company group for the purposes listed above. We will not disclose your information to any third party outside of our company group except under the following limited circumstances. We may disclose your personal information to carefully selected service providers and agents who operate elements of our web site service and process data on our behalf. These may include businesses who provide technology services such as hosting for our servers and distribution and business partners who provide delivery fulfilment services. From time to time we may also provide your information to carefully selected customer service agencies for research and analysis purposes, on our behalf, so that we can monitor and improve the services we provide. If you consent, we or our agents, acting on our behalf, may contact you by post, or telephone to ask you for your feedback and comments on our services. 13

14 Sample provisions Where such disclosures are made, this will be under contractual arrangements with us and carried out in accordance with the requirements of the Act. We may also use aggregate information and statistics for the purposes of monitoring website usage in order to help us develop the website and our services and may provide such aggregate information to third parties. These statistics will not include information that can be used to identify any individual. In assessing your request for goods or services, we may use your information for the purposes of the prevention and detection of fraud. We may also disclose your personal information to our subsidiaries and affiliated companies and any successors in title to our business. 14

15 Best practices 15

16 Conclusions Anything new under the sun? Legal analysis (compliance) PLUS risk assessment (best practices) are REQUIRED to develop a comprehensive strategy (in other words: do not let the lawyers alone / among them!) The cheaper pricing not (always) the best solution. Internal due diligence frequently a prerequisite. Always have a plan B. 16

17 Any questions or comments? Michel Jaccard Sylvain Métille Web idest.pro 17