Recently, the Swedish Data Protection Authority (“DPA”) published a review of the use of cloud services, informed by the practices of three Swedish municipalities’ use of services from leading cloud providers.  Based on the study, the DPA has published guidelines (currently only available in Swedish) that clarify the requirements of Swedish data protection law with regard to cloud services. They contain a checklist that organizations using the cloud to provide services of their own should follow to ensure compliance. The guidelines stress the importance of negotiating contractual provisions that reflect the personal data processing practices of cloud providers, so that data controllers outsourcing to the cloud can ensure these are in line with their intentions. In summary, the Swedish DPA asserts that while it is possible for organizations to outsource processing of personal data to the cloud, it is under no circumstances possible for them to renounce responsibility for the manner in which personal data is processed.

This initiative follows decisions by other European DPAs, earlier this year, to reject the use of cloud services by public authorities because of security risks. In February 2011, The Danish DPA rejected the Municipality of Odense’s planned use of Google’s cloud computing services within schools. More recently, on September 29, 2011, the German federal and state DPAs issued a resolution on cloud computing and compliance with data protection law. In their statement, they urge cloud service customers to use cloud services only if they are in a position to fulfil their obligations as data controllers and have verified that the appropriate data security requirements are in place.

Tags: Cloud Computing, Sweden
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Dan Cooper Dan Cooper

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing…

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing clients in regulatory proceedings before privacy authorities in Europe and counseling them on their global compliance and government affairs strategies. Dan regularly lectures on the topic, and was instrumental in drafting the privacy standards applied in professional sport.

According to Chambers UK, his “level of expertise is second to none, but it’s also equally paired with a keen understanding of our business and direction.” It was noted that “he is very good at calibrating and helping to gauge risk.”

Dan is qualified to practice law in the United States, the United Kingdom, Ireland and Belgium. He has also been appointed to the advisory and expert boards of privacy NGOs and agencies, such as the IAPP’s European Advisory Board, Privacy International and the European security agency, ENISA.

Read more about Dan CooperEmail
Show more Show less