Cloud Computing - Legal Considerations For Data Controllers

Author:Mr Matthew Ryan
Profession:Dillon Eustace

What is cloud computing and why is it relevant?

Cloud computing can be described as technology delivered as a service made available on demand over the internet. There are effectively three types of cloud computing services: software as a service ("SaaS"), infrastructure as a service ("IaaS") and platform as a service ("PaaS"). By utilising a cloud computing service, an organisation is effectively outsourcing its IT requirements.

Online email accounts (such as Gmail or Hotmail) are everyday examples of cloud computing, users of which can access their inbox from anywhere in the world. From a business perspective, cloud computing might be used as a platform for obtaining software or storage on demand. For example, an organisation may opt to outsource its storage requirements, resulting in their data being stored on another entity's server.

Cloud computing is one of the fastest growing segments of the global IT industry with use of cloud computing services forecast to increase by 40% per annum in the coming years. It forms part of the Irish Government's vision for a "smart economy" and many of the global IT firms have invested heavily in their Irish-based cloud computing competency centres. These factors have positioned Ireland at the forefront of global developments in cloud computing.

What are the benefits of cloud computing to organisations?

The use of cloud computing services can offer benefits for organisations of all sizes, including:-

Cost reductions The burdensome task of maintaining IT systems can be outsourced, with organisations paying for software/hardware only as and when they are needed. This greatly reduces capital investment requirements, allowing resources to be invested elsewhere. Access to state of the art applications In addition to cost savings, organisations will have the ability to utilise the most up-to-date software/hardware systems, thereby increasing efficiencies. Flexibility Organisations will have access to the systems and storage they require on demand. For example, software can be made available in a very short space of time and increased storage capabilities will be available as and when they are needed, without the associated cost of having such capacity in reserve. Data Protection and Security Issues

Despite the tangible benefits listed above, Irish entities have generally been slow to embrace cloud computing as a service. This is, no doubt, due in part to certain data protection and security issues that Data Controllers1 are obliged to investigate.

In February, 2010 the Chief State Solicitor's Office (the "CSSO") issued a statement to Government departments warning that contracts for cloud computing services being used at the time did not address issues such as data protection, confidentiality and security at a level that would be required in the public sector. At the time this letter caused outrage in the cloud computing community – how could a Government who had publicly endorsed cloud computing overtly condemn its use by Government departments? A number of key data protection and security issues arising in this regard are considered below.

Jurisdictional Issues


To continue reading