3.9.2013   

EN

Official Journal of the European Union

C 253/3

1.

In view of the importance of cloud computing in the evolving information society and of the ongoing policy debate within the EU on cloud computing, the EDPS has decided to issue this Opinion on his own initiative.

2.

This Opinion responds to the Communication of the Commission ‘Unleashing the potential of cloud computing in Europe’ of 27 September 2012 (hereafter ‘the Communication’) (1), which sets forth key actions and policy steps to be taken to speed up the use of cloud computing services in Europe. The EDPS was consulted informally before the adoption of the Communication and provided informal comments. He welcomes that some of his comments have been taken into account in the Communication.

3.

However, given the scope and importance of the ongoing debate on the relationship between cloud computing and the data protection legal framework, this Opinion is not limited to the subjects addressed in the Communication.

4.

The Opinion focuses especially on the challenges that cloud computing poses for data protection and how the proposed data protection regulation (hereafter ‘the proposed regulation’) (2) would tackle them. It also comments on the areas for further action identified in the Communication.

5.

In the context of the general policy debate in the EU on cloud computing, the following activities and documents are of specific importance:

6.

The EDPS welcomes the Communication. It identifies three specific key actions required at EU level to accompany and promote the use of cloud computing in Europe, as follows:

7.

Additional policy steps are also foreseen such as measures to stimulate the use of cloud computing by fostering research and development or awareness-raising, as well as the need to address key themes related to cloud services — including amongst others data protection, access by law enforcement, security, liability of intermediary service providers — through a reinforced international dialogue.

8.

Data protection is mentioned in the Communication as an essential element for ensuring the success of cloud computing deployment in Europe. The Communication notes (9) that the proposed regulation addresses many of the concerns raised by cloud service providers and by cloud clients (10).

9.

This Opinion has three goals.

10.

The first goal is to highlight the relevance of privacy and data protection in the current discussions on cloud computing. More particularly, it underlines that the level of data protection in a cloud computing environment must not be inferior to that required in any other data processing context. cloud computing practices can only be developed and applied legally if they guarantee that this level of data protection is respected (see Chapter III.3). The Opinion takes into account the guidance provided in the WP29 Opinion.

11.

The second goal is to further analyse the main challenges that cloud computing brings for data protection in the context of the proposed data protection regulation, in particular the difficulty to establish unambiguously the responsibilities of the different actors and the notions of controller and processor. The Opinion (mainly, Chapter IV) analyses how the proposed regulation would, as it is currently put forward (11), help ensure a high level of data protection in cloud computing services. It therefore builds upon the views developed by the EDPS in his Opinion on the data protection reform package (hereafter ‘the EDPS Opinion on the data protection reform package’) (12) and complements it by considering specifically the cloud computing environment. The EDPS underlines that his Opinion on the data protection reform package fully applies in relation to cloud computing services and must be considered as a basis for the present Opinion. Moreover, some of the issues mentioned there — such as his analysis of the new provisions on data subjects' rights (13) — are sufficiently clear and will therefore not be developed further in this Opinion.

12.

The third goal is to identify areas that require further action at EU level from a data protection and privacy perspective, in view of the cloud strategy put forward by the Commission in the Communication. They include, amongst others, providing further guidance, standardisation efforts, carrying out further risks assessments for specific sectors (such as public sector), developing standard contract terms and conditions, engaging into international dialogue on issues related to cloud computing and ensuring effective means of international cooperation (to be developed in Chapter V).

13.

The Opinion is structured as follows: Section II provides an overview of the main characteristics of cloud computing and the related data protection challenges. Section III reviews the most relevant elements of the existing EU legal framework and of the proposed regulation. Section IV analyses how the proposed regulation would help address the data protection challenges raised by the use of cloud computing services. Section V analyses the Commission's suggestions for further policy developments and identifies the areas where further work might be needed. Section VI contains the conclusions.

14.

While many of the considerations of this Opinion apply to all environments in which cloud computing is used, this Opinion does not address the use of cloud computing services specifically by EU institutions and bodies subject to the supervision of the EDPS under Regulation (EC) No 45/2001. The EDPS will issue guidelines to these institutions and bodies on this subject separately.

121.

As described in the Communication, cloud computing offers many new opportunities to businesses, consumers, and the public sector for the management of data through the use of remote external IT resources. At the same time, it presents many challenges in particular as to the appropriate level of data protection offered to data processed therein.

122.

The use of cloud computing services raises a major risk of seeing responsibility evaporating in relation to processing operations carried out by cloud service providers, if the criteria for applicability of EU data protection law are not sufficiently clear and if the role and the responsibility of cloud service providers are defined or understood too narrowly, or are not implemented effectively. The EDPS emphasises that the use of cloud computing services cannot justify a lowering of data protection standards as compared to those applicable to conventional data processing operations.

123.

In this respect, the proposed data protection regulation, as it has been put forward, would provide many clarifications and tools that would help ensure that a satisfactory level of data protection is complied with by cloud service providers offering their services to clients based in Europe, in particular:

124.

The EDPS nonetheless suggests that, after having taken into account the specificities of cloud computing services, further clarifications be made in the proposed regulation on the following aspects:

125.

The EDPS also underlines that further guidance will be necessary from the Commission and/or from supervisory authorities (in particular through the future European Data Protection Board) on the following aspects:

126.

Furthermore, the EDPS acknowledges that codes of conduct drawn up by the industry and approved by the relevant supervisory authorities could be a useful tool to enhance compliance as well as trust among the various players.

127.

The EDPS supports the development by the Commission, in consultation with supervisory authorities, of standard contractual terms for the provision of cloud computing services that respect data protection requirements, in particular:

128.

The EDPS underlines that appropriate consideration must be given to data protection requirements in the development of standards and certification schemes, in particular:

129.

Finally, the EDPS stresses the need to address the challenges raised by cloud computing at an international level. He encourages the Commission to engage in an international dialogue on the issues raised by cloud computing, including jurisdiction and access by law enforcement, and suggests that many of these issues could be addressed in different international or bilateral agreements, such as mutual assistance agreements and also trade agreements. Global standards should be developed at international level to set forth minimum conditions and principles regarding the access to data by law enforcement bodies. He also supports the development by the supervisory authorities of effective international cooperation mechanisms, in particular as relates to cloud computing issues.