Cloud computing

Cloud computing, whose whole point is to be independent of geography, does not fit comfortably into current data protection law. The Commission’s new proposal at least shows signs that clouds were a use case that was considered during drafting, so it is more obvious which provisions apply to them. These seem to offer a mixture of carrots and sticks to try to bring clouds within the European data protection regime.

The JISC Legal Information Service have published a toolkit on the legal issues that should be considered by universities and colleges when planning to use external cloud computing providers, including Data Security, Jurisdiction, Confidentiality, Freedom of Information, Intellectual Property Rights, Equality and Accessibility, and Contracts.

Cambridge University gave a report at Networkshop on their work with Google to make outsourcing of staff and student calendars compliant with UK data protection law. This was achieved through a combination of individual contract terms, obtaining assurances about Google’s security processes, and design of the local Cambridge infrastructure.

Interesting to see an awareness of developments in European privacy law in a presentation from Google at the UCISA Management Conference.