standards for transfer of data to other countries.

Transcription

1

2

3

4

5 comes to Cloud Computing, the situation is not different in Brazil. ln spite of the security devices and tolls made available by the Cloud Computing suppliers, the most significant obstacles and discussions about privacy relate to how easy it is to access and monitor lhe data stored by the users, whether they belong to individuais or companies. The alleged vulnerability results especially from the insecurity concerning the data storage place and, consequently, the security and protection parameters and standards established by the local law. lnformation that was stored in physical and determinable places until recently is now transferred to data centers in unknown locations, generating some insecurity about the legal requirements and measures applicable to safeguard rights. As already mentioned above, as a consequence of the Brazilian case law, the aforementioned bills already acknowledge the extra-territoriality of the Brazilian law to the services of storage of personal data, including those stored abroad.' 'º 1 nternational transfer of data Just like with data protection and security, our legal system does not have any specific law establishing any minimum security rules and standards for transfer of data to other countries. The major issue of data transfer and processing lies in the law applicable to data in traffic, whether the law of the country of origin is still applicable alter the transfer or the law of the country of destination is applicable, whether or not it is more advantageous. The member countries of the European Union, for example, under the rules of European Directive 95/46/ EC11'', are solely authorized to transmit and transfer their personal data to another countries that adopt identical or greater prolection leveis. The European Commission in charge of data protection did not expressly state that Brazil does not have an appropriate data protection system. However, the Brazilian system deemed general would not be enough to meet the rules established by the community law. As stated above, Brazil is about to approve a consolidated body of laws introducing an updated system of data protection which may also involve lhe regulation of international transfer of data. Conclusion ln relation to the legal aspects, in spite of the recent legislative developments for regulation of lnformation Technology services, situations in which the technology prescinds from legal focus for reaching the ideal legal security for the parties involved are not unusual at all. When it The relationships of engagement of Cloud Computing in Brazil are currently subject to general rules of agreements and liability, rules of consumer protection and defense - when applicable, and the constitutional and legal guarantees concerning data security and privacy. The matter of data export to data centers and other important aspects relating to Cloud Computing are currently under discussion at legal and political leveis. ln spite of the challenges explored herein and other challenges that the model of Cloud Computing services tend to face, the system is undeniably a worldwide trend. li is important to bear in mind that there are no international treaties or self-regulation about the matter to which Brazil is a party. The local legislations play a relevant role in that scenario and, when analyzing the data processing and transfer, it is valid to obtain a general view of lhe different jurisdictions involved in the business. Furthermore, in a scenario of relative uncertainty, lhe wording of contractual sections is extremely important, especially in cross border transactions, and the arbitration may be a more interesting way than the ordinary courts for resolution of litigations. By Camila Gurgel Fasano de Guglielmo Douglas Cohen Moreira BKBG Special thanks to Fernanda Gonçalves Rodrigues ' lnternational Telecommunication Union - ITU. Privacy in Cloud Computing. Technology Watch Report; March, Internet page retrieved on November 13, 2013 through the link PDFE.pdf 8 PL No. 2126/2011. Article 11. ln any operation of collection, storage, safeguard and treatment of registrations, personal data ar communications data by internet connection and applications providers where ai least one of these acts takes place in the Brazilian territory, the Brazilian law, the rights to privacy, confidentiality of personal data, private communications and registrations shall be complied with. ' PL No. 3558/12. Article 3. Every person with domicile in Brazil, whether an individual or a private or public legal entity, is entitled to protection of their personal data generated in lhe Brazilian territory, even if stored abroad. 'º However, it should be mentioned that the Brazilian law orders the processing of certain pieces of information in the Brazilian territory, such as health data of the social security, data of consumers of public utilities and of users of telephony services and financial system. " Directive 95/46/EC of the European Parliament and Council dated October 24, t 995 on protection of individuais as regards processing of personal data and free movement of said data. Internet page retrieved on November 13, 2013 through the link society/data_protection/ _en.htm Lawyer Monthly Global Expert lntellectual Property 99