A featured contribution from Leadership Perspectives, a curated forum for enterprise technology leaders, nominated by our subscribers and vetted by the CIOApplications Editorial Board.
FIELDFISHER
Cloud Computing - More Regulation, Better Regulation?
I started researching cloud law over a decade ago. Laws have always affected cloud use indirectly, but increasingly target cloud directly. If more regulation is necessary for important policy objectives like improving security, that’s understandable. But cloud regulation must take account of cloud’s nature, particularly how cloud differs from classic outsourcing/sourcing: quick to access, cost-effective, flexible and scalable because it’s multi-tenant, standardised, commoditised, self-service and pre-built (subcontractors engaged in a reversed direction than with traditional outsourcing), often multi-layered (SaaS built on IaaS/PaaS). It must take also account of the differences between IaaS/PaaS and SaaS, the former involving use of technology infrastructure/equipment, the latter the online use of software applications which can vary hugely in their purposes and functions
Take data protection, although disregarding for now the political football of data location vs. intelligible access! IaaS/PaaS, and many SaaS, services are purpose-neutral. Customers decide what data to upload. Providers don’t necessarily know if that
includes personal data. Despite initial concerns, cloud providers squeezed their square-peg standard terms to match, albeit ill-fittingly, the GDPR’s round-hole requirements on contract terms between controller/processor-customers and processor/ subprocessor-providers, assuming that personal data would be hosted. However, inadequate awareness of and allowance for cloud’s characteristics still persists.
For instance, the UK G-Cloud framework(currently G12), intended to facilitate and encourage public sector cloud uptake, requires buyers’ prior consent to subprocessors -when they’re already in place under pre-built services. Also, buyers can dictate individualised security requirements, although cloud security is standardised. Indeed, cloud providers’ security expertise and measures often exceed customers’ – it’s well-known that most cloud breaches to date, ignoring outages, have been down to customers’ misconfiguration rather than providers’ security failings.
includes personal data. Despite initial concerns, cloud providers squeezed their square-peg standard terms to match, albeit ill-fittingly, the GDPR’s round-hole requirements on contract terms between controller/processor-customers and processor/ subprocessor-providers, assuming that personal data would be hosted. However, inadequate awareness of and allowance for cloud’s characteristics still persists.
For instance, the UK G-Cloud framework(currently G12), intended to facilitate and encourage public sector cloud uptake, requires buyers’ prior consent to subprocessors -when they’re already in place under pre-built services. Also, buyers can dictate individualised security requirements, although cloud security is standardised. Indeed, cloud providers’ security expertise and measures often exceed customers’ – it’s well-known that most cloud breaches to date, ignoring outages, have been down to customers’ misconfiguration rather than providers’ security failings.
Legal certainty is critical. How can you comply with laws if it’s unclear what laws require of you? Apart from the NIS SaaS uncertainty, there’s the EU P2B Regulation.IaaS/PaaS services hosting e-commerce websites selling to EU consumers could be “online intermediation services” under P2B, which requires changes to standard terms as well as policies/processes. It seems lawmakers didn’t intend cloud to be in scope. But they didn’t explicitly exclude cloud, resulting in uncertainties (generally, cloud providers assume it doesn’t apply).
As well as taking due account of cloud’s nature, regulation should be appropriate, proportionate and clear. Under the proposed NIS 2 Directive, cloud services will become “essential”, subject to tougher requirements than currently. For legal certainty and consistency, let’s hope lawmakers will consider specifically whether different types of cloud services should be regulated differently, and make any differences clear, before they finalise this and other future laws.
For instance, the UK G-Cloud framework(currently G12), intended to facilitate and encourage public sector cloud uptake, requires buyers’ prior consent to subprocessors -when they’re already in place under pre-built services. Also, buyers can dictate individualised security requirements, although cloud security is standardised. Indeed, cloud providers’ security expertise and measures often exceed customers’ – it’s well-known that most cloud breaches to date, ignoring outages, have been down to customers’ misconfiguration rather than providers’ security failings.
includes personal data. Despite initial concerns, cloud providers squeezed their square-peg standard terms to match, albeit ill-fittingly, the GDPR’s round-hole requirements on contract terms between controller/processor-customers and processor/ subprocessor-providers, assuming that personal data would be hosted. However, inadequate awareness of and allowance for cloud’s characteristics still persists.
For instance, the UK G-Cloud framework(currently G12), intended to facilitate and encourage public sector cloud uptake, requires buyers’ prior consent to subprocessors -when they’re already in place under pre-built services. Also, buyers can dictate individualised security requirements, although cloud security is standardised. Indeed, cloud providers’ security expertise and measures often exceed customers’ – it’s well-known that most cloud breaches to date, ignoring outages, have been down to customers’ misconfiguration rather than providers’ security failings.
Legal certainty is critical. How can you comply with laws if it’s unclear what laws require of you? Apart from the NIS SaaS uncertainty, there’s the EU P2B Regulation.IaaS/PaaS services hosting e-commerce websites selling to EU consumers could be “online intermediation services” under P2B, which requires changes to standard terms as well as policies/processes. It seems lawmakers didn’t intend cloud to be in scope. But they didn’t explicitly exclude cloud, resulting in uncertainties (generally, cloud providers assume it doesn’t apply).
“Digital services” are subject to security and incident reporting obligations, focusing mainly on service availability and business continuity for customers
As well as taking due account of cloud’s nature, regulation should be appropriate, proportionate and clear. Under the proposed NIS 2 Directive, cloud services will become “essential”, subject to tougher requirements than currently. For legal certainty and consistency, let’s hope lawmakers will consider specifically whether different types of cloud services should be regulated differently, and make any differences clear, before they finalise this and other future laws.
The articles from these contributors are based on their personal expertise and viewpoints, and do not necessarily reflect the opinions of their employers or affiliated organizations.
