Keeping on top of the Cloud - Compliance from a Regulator’s Perspective Henry Chang, IT Advisor Office of the Privacy Commissioner for Personal Data, Hong Kong 6 July 2013 Up in the Cloud: Conference on Legal and Privacy Challenges in Cloud Computing

2 Bottom lines 1.Data users are responsible for the protection of personal data entrusted to them; 2.Outsourcing of data processing does not mean outsourcing of legal liability.

3 Guiding principles of data protection 1.Informed Consent 2.Protection 3.Transparency

4 Data flow and data protection principles (DPPs) Personal Data Flow Collection Retention/ Erasure DPP 6 – Rights of access and correction DPP 5 – Transparency DPP 1 – Collection DPP 3 – Use DPP 2 – Accuracy and retention DPP 4 – Security Storage, Use or Processing IT System

5 The heat map of cloud Private Cloud (dedicated) Public Cloud (shared) Consumers Enterprises Types of Cloud Types of Users SMEs Most vulnerable

6 For Consumers

7 Attractive/free consumer solutions… 1.Uncertainty on whether data protection laws apply 2.Terms often favour service providers 3.There is no free lunch – where is the hidden cost? 4.Ultimate victims of any data breach are consumers 5.Assess risks before using cloud services 6.Consider encrypting data before uploading

8 For Businesses

9 Important issues that are not specific to clouds 1.Technical safeguards - Identity management and authentication 2.Proper exit plan, data erasure and data portability 3.Use by contractors that does not match with original purposes 4.Formal data breach notification arrangement

10 Cloud characteristics 1.Rapid transborder data flow 2.Loose outsourcing arrangements 3.Standard services and contracts

11 Rapid transborder data flow 1.Does the law allow? 2.Comparable data protection laws –Who can tell where the data are? –How could data user obligations be fulfilled? –Can data flow be limited to a few ‘white list’ jurisdictions? 3.Potential access by foreign LEAs

1.Lack of controls/relationship –No guarantee of controls downstream –No contractual remedies 2.Uncertain privacy rules, culture and training –Are outsourcers subject to privacy law in their jurisdictions? –Are they accustomed to privacy laws? –Can they be sanctioned? 3.Where does the loyalty lie? 12 Loose outsourcing arrangement

13 Standard services and contracts 1.If standard services do not meet the data protection requirements, can cloud provider customise? 2.If customisation is offered, how can cloud customers be sure that the extra measures are in place?

14 Views from data protection authorities 1.Hong Kong PCPD – 2.The Article 29 Working Party – 3.Office of the Privacy Commissioner, Canada – 4.Dutch DPA – 5.French DPA (CNIL) – vices.pdf 6.Office of the Privacy Commissioner, New Zealand – pdf 7.UK Information Commissioner’s Office – _computing_guidance_for_organisations.ashx 8.International working group on data protection in telecommunications –

Thank You