Cloud computing still doesn't circumvent data protection rules

As cloud computing slowly becomes a trend, more and more personal data are moving out of the company's own data centers and moving to cloud computing, meaning that data can reside anywhere on the planet.

But the UK has strict rules on the data that can be processed, and http://www.aliyun.com/zixun/aggregation/13681.html "The Office of the British Information Commissioner, the > Data protection watchdog, fears Many companies are unaware of their responsibility to continue managing their data and even submit them to the cloud provider for management.

Simon Raiss, a technical policy advisor to ICO, said the law on outsourcing data was very clear. "As a businessman, you are responsible for protecting your data security. You can outsource some of the processed data, such as cloud computing, but it is still your responsibility to use and protect the data. ”

Rice warned UK privacy regulators to act against legal groups that do not satisfy data protection. For example, ICO criticized the Scottish Border Committee for using 250000 to digitize pension records after failing to manage a company properly.

Guidelines for moving data to cloud computing

To underscore this message, ICO has issued a series of guidelines for the enterprise to move data to cloud computing. It says companies first need to look at the data they are working on and determine whether there is any data that should not be transferred to the cloud-for example, because when personal data is collected, specific guarantees are given.

"As a businessman, you are responsible for protecting your data security. You can outsource some processing data ... However, it is still your responsibility to protect the data. --ico Simon Rice

The enterprise may also need to inform the end user about the processing arrangements that the cloud service is already in place. In addition, they must ensure that their cloud service providers have adequate technical and organizational security.

While the best way to assess security is to check the vendor's operating site, ICO says "It is not possible for a cloud provider to allow every potential and existing customer to enter its site for audits", so the alternative is an independent third-party audit.

The regulator also says that the encryption of data in transit and the potential for "rest" is an important consideration, especially when dealing with sensitive personal data.

Where is the data going?

The UK Data Protection Act requires that personal information not be transferred to areas where the European Economic Area is unexpected unless the destination country ensures adequate data protection. In view of this, companies intending to use cloud services should ask a range of national data-processing providers and information providers related to safeguards.

"When data will be moved to these locations, the cloud provider should be able to explain," Ico said.

There is another reminder for businesses that use cloud services and that data is kept outside the UK: it should be remembered that a foreign law enforcement agency might have the right to access personal data or destroy the availability of personal data to cloud customers and users.

(Responsible editor: The good of the Legacy)