enterprise 2.0

Tanya L. Forsheit, Esq., CIPP writes about the EU Data Protection Directive and Cloud Computing:

The most notable thing about the EU Directive and member state laws for purposes of cloud computing is this -- in the absence of specific compliance mechanisms, the EU prohibits (yes, you read correctly, prohibits) the transfer of personal information of EU residents out of the EU to the US and the vast majority of countries around the world.

What does this mean for cloud computing?  If you want to put data in the cloud that includes personal information of EU residents (and that might be something as simple as an email address or employment information), and the data will flow from the EU to almost anywhere in the world, you cannot simple throw the data in the cloud and hope for the best.  You need to have, at a minimum, one or more of the following:

• International Safe Harbor^† Certification (which allows data transfer from the EU to the US, but not from the EU to other countries);

• model contracts (which allow data transfer from the EU to non-US countries, but do not always work well with multi-tiered vendor relationships); or

• Binding Corporate Rules (which are designed for a multinational company and therefore may not function well for cloud provider relationships).

Read more .. ..

† Safe Harbor Act also known as the European Union Data Protection Directive

1. The act prohibits the transfer of personal data to non-European Union nations that do not meet the European "adequacy" standard for privacy protection.
2. US based companies should try to obtain Safe Harbor Certifications
3. Slightly higher standard than California Privacy Laws. Somewhere between EU and US
4. Requires you to do the work up-front. 6 months - 1 year of work required. Annual re-certification required
5. Attaining Safe Harbor certification elevates reputation of the company