Cloud Computing: The cloud and the LOPD
That the cloud computing It is here and that it is here to stay is beyond doubt. That this approach to service has obvious technical and economic advantages What is perhaps causing the greatest concern in some cases is the issue of security and, in particular, compliance with the LOPD with suppliers that are not Spanish companies.
It is a common phase of the pre-sale of cloud services; the client wants and needs to know where their data will be in order to register the corresponding file in the Spanish Data Protection Agency.
In the case of the most “classic” cloud computing, it is simple, we indicate the postal address of our CPD in Spain. However, we are increasingly deploying and managing services on third-party platforms, and these third parties are multinationals that do not physically have their servers in Spain (Google Apps,Amazon Web Services, Microsoft Azure, Microsoft Office 365The physical locations of the CPDs of these providers are not public, in fact they are sometimes kept with genuine “professional zeal”. On one occasion, an Amazon salesperson told me that they themselves do not know where the CPDs are, beyond the fact that they are located in a specific country.
So, how should companies continue to comply with the LOPD if they “go to the cloud”? Although the legal background is broad and certainly complicated, when push comes to shove, trusting a recognised provider is the most appropriate solution. Issues to consider:
- A contract must be signed between the client and the service provider, clearly specifying that the service provider is going to outsource certain services (e.g. the virtualization platform) to a third party, specifying
- When a service is contracted from a third party in “online” mode, it is not necessary to physically sign a contract with this third party; the “I accept the conditions” of this type of service can be accepted as acceptance of the contract for the purposes of the LOPD.
- When hiring a foreign company, it is almost essential that the company is a member of the “Safe Harbor” system. Google, Amazon and Microsoft are. Although this does not guarantee everything, I think it should be a “must” when choosing. At least it means that there is no international data transfer In the face of LOPD, these companies are recognized as having an adequate level of protection (Decision 2000/520/EC)
- Regardless of the fact that American cloud providers are Safe Harbor compliant, it is interesting that the physical location of the servers is within the EEC, which is the case of Amazon and Microsoft, for example, which have those that provide service to Europe in Ireland.
- Let's face it, relying 100% on the infrastructure provider is generally not a good approach. Trust a provider that complements this third-party platform with a completely independent backup system and that uses data encryption.
The Spanish data protection agency has just published a guide “For Clients who contract Cloud Computing services” interesting and recommended reading. You can also consult this guide to learn more about cloud computing security:
