New Working Party Opinion Relevant to Cloud and Social Network Providers
On 16 December 2010, the collective of EU data protection authorities, the Article 29 Data Protection Working Party, adopted “Opinion 8/2010 on applicable law”. The Opinion (which while not legally binding is important guidance on how to apply EU data protection law) seeks to clarify the scope of application of the EU Data Protection Directive 95/46/EC.
Recent developments in technology solutions are presenting challenges to the existing data protection framework. This Opinion is therefore timely and it contains numerous references to cloud computing and social networking. There are clear signs that legislative change (in the mid to longer term) to deal with these developments is inevitable.
The Opinion gives useful case examples for multinational businesses of how data protection law should be applied and in doing so acknowledges the, sometimes significant, practical burden that the application of current data protection law can present for multinational businesses.
There is some confusion amongst cloud providers and customers alike about what data protection laws will apply. This Opinion clarifies that the place where data are sent or located (and the nationality or place of residence of data subjects) does not determine applicability of data protection law. What is required is an analysis of the corporate context in which the processing is carried out.
As the market for cloud solutions develop, the sophistication of cloud provider contracts will increase. Knowing where the data protection ‘buck stops’ is key. Similar considerations apply in the social networking sphere where increasingly companies are using social media as a customer facing business tool. This Opinion highlights that in the cloud, both the user and the provider of the cloud service can be a data controller. Cloud computing contracts should reflect this and allocate responsibility accordingly.
