Keeping Up with the Clouds - Revealing the Discrepancy between the Realities of Cloud Technology and European Data Protection Law

Abstract

Data protection concerns have been identified as one of the most serious barriers for the deployment and development of cloud computing. There is a general lack of regulation and policy on a European (EU) level. The Data Protection Directive (DPD) is currently under revision and will be replaced with a regulation in the near future.

The European Commission (the Commission) has acknowledged the importance of cloud computing and it is continuously working on its strategy to “unleash the potential of cloud computing in Europe.” The current European legal framework and the differences in the data protection legislation in the EU Member States have a stifling effect on the deployment of cloud computing by companies worldwide. There is a high level on uncertainly in regard to the legal obligations imposed on the various players in the cloud environment.

This paper aims to provide the reader with an overview of the most important problems in regard to protecting personal data in the cloud environment.

It begins with a brief explanation of cloud technology and its most important characteristics. Next, the scope of the DPD and the most important players in the cloud environment will be reviewed. It will go on to address the most important issues in respect of protecting personal data in the cloud. By the end of the paper the reader will have an understanding of the discrepancy between the reality of the current state of technology and the content and intentions of the DPD, and of why further policy and legislative proposals initiatives are needed to adequately regulate cloud services.

Keywords: Cloud computing, data protection law, privacy, ecommerce, data retention, European law, data fragmentation, territorial scope

JEL Classification: K10, K00, K30, K12, K22, K23, K33, K39