Abstract

http://ssrn.com/abstract=1794130
 
 

Footnotes (107)



 


 



Who is Responsible for 'Personal Data' in Cloud Computing? The Cloud of Unknowing, Part 2


W. Kuan Hon


Queen Mary University of London, School of Law - Centre for Commercial Law Studies

Christopher Millard


Queen Mary University of London, School of Law - Centre for Commercial Law Studies; Oxford Internet Institute

Ian Walden


Queen Mary University of London, School of Law

March 21, 2011

International Data Privacy Law (2012) 2 (1): 3-18
Queen Mary School of Law Legal Studies Research Paper No. 77/2011

Abstract:     
In part one of this series, we considered what information is regulated as 'personal data' in the cloud. In this part two, we develop further the argument made in part one that it is not appropriate for infrastructure cloud providers, many of which are based outside Europe, to become subject arbitrarily to obligations under the EU Data Protection Directive due to choices made by their users.

EU data protection responsibilities and liabilities are imposed primarily on the 'controller,' who may employ 'processors' to process data for it. We suggest, as with the concept of 'personal data,' the binary nature of the controller/processor distinction is no longer tenable. In today's environment of complex chains of actors, end to end accountability should replace the binary distinction. While cloud computing service providers are commonly considered processors or controllers, this paper further argues that many infrastructure cloud computing providers are not even 'processors,' but simply provide facilities and/or tools for use by the controller/cloud user. Infrastructure as a Service and Platform as a Service providers, and certain Software as a Service providers, who offer no more than utility infrastructure services, will often not know whether information stored or processed through their services is 'personal data' or not – hence, the 'cloud of unknowing.' Infrastructure cloud providers are qualitatively distinct from services such as social networking websites.

We suggest that infrastructure cloud computing providers should be considered mere neutral intermediaries. Existing liability defences for certain service providers under the EU Electronic Commerce Directive, to help foster electronic commerce, are lost upon the provider having knowledge and control. Similarly, our proposed intermediary immunity from data protection obligations would be lost if the provider gains the requisite knowledge and/or the requisite access to such data. It may also behove cloud computing providers to develop appropriate common industry standards and best practices measures in order to help provide a clear boundary between this intermediary status and 'processor' (or even 'controller') status.

Number of Pages in PDF File: 31

Keywords: Cloud Computing, Data Privacy, Data Protection, EU, European Union, Internet, Legal Issues, Liability, Outsourcing, Personal Data, Personal Identifying Information, Privacy

JEL Classification: K2

Accepted Paper Series





Download This Paper

Date posted: March 26, 2011 ; Last revised: June 19, 2014

Suggested Citation

Hon, W. Kuan and Millard, Christopher and Walden, Ian, Who is Responsible for 'Personal Data' in Cloud Computing? The Cloud of Unknowing, Part 2 (March 21, 2011). International Data Privacy Law (2012) 2 (1): 3-18; Queen Mary School of Law Legal Studies Research Paper No. 77/2011. Available at SSRN: http://ssrn.com/abstract=1794130

Contact Information

W. Kuan Hon (Contact Author)
Queen Mary University of London, School of Law - Centre for Commercial Law Studies ( email )
London
United Kingdom
HOME PAGE: http://www.law.qmul.ac.uk/people/academic/hon.html
Christopher Millard
Queen Mary University of London, School of Law - Centre for Commercial Law Studies ( email )
67-69 Lincoln's Inn Fields
London, EC2A 3JB
United Kingdom
HOME PAGE: http://www.law.qmul.ac.uk/staff/millard.html
Oxford Internet Institute
1 St Giles
Oxford, OX1 3JS
United Kingdom
HOME PAGE: http://www.oii.ox.ac.uk/
Ian Walden
Queen Mary University of London, School of Law ( email )
Mile End Road
London, London E1 4NS
United Kingdom
Feedback to SSRN


Paper statistics
Abstract Views: 6,602
Downloads: 1,789
Download Rank: 4,421
Footnotes:  107

© 2014 Social Science Electronic Publishing, Inc. All Rights Reserved.  FAQ   Terms of Use   Privacy Policy   Copyright   Contact Us
This page was processed by apollo1 in 0.312 seconds