Tobias Höllwarth draws some lines between
the new EU General Data Protection Regulation, Binding Corporate Rules, strategies
of Microsoft and Salesforce as well as the Cloud Privacy Check.
It is interesting to hear that Salesforce, one of the largest US cloud providers,
has announced that its BCR (Binding Corporate Rules) have been accepted by the
European Data Protection Authorities (WP29). See detailed text here.
The leading authority behind the acceptance was the French Commission Nationale de l'Informatique et des Libertés (CNIL), which was assisted by the Netherlands DPA and the Bavarian Landesamt
für Datenschutzaufsicht. Link to the list of BCR accepted by the European
Union here.
This development
should be viewed in context with the end of the Safe Harbor Agreement caused by
the Austrian law student Max Schrems (see "EU versus Facebook") in October 2015. “My personal guess
is that the European BCR will not survive a similar kind of inspection by the
European High Court” says Tobias Höllwarth, VP of EuroCloud Europe. Höllwarth
argues that no matter how well an individual agreement between two companies is
worded, it will never overcome the core problem “that existing US law – related
to the Patriot Act – shows fundamental differences to existing European law in
some areas. Companies will not be able to overcome this issue – not even with
BCR.”
This seems
to be the uncomfortable truth for several thousand US cloud providers that
store and process data for European customers. See information by the US House
of Representatives here, the ongoing court case of
Microsoft versus USA (the so called Ireland case) here, and a comment in the New York Law Journal here.
On the
other hand, it is quite obvious that this would lead to a disastrous situation
for European cloud customers who are willing to use cloud services delivered by
providers outside the IT-Schengen area – a situation that nobody would wish to
become reality.
Despite the
surprising and clever agreement between Microsoft and Deutsche Telecom to use
DT as a trustee for the Microsoft Azure and Office365 services (see here), it is clear that this cannot be a
model for each and every cloud service provider outside the EU. “Neither will Deutsche
Telekom be able to handle numerous cloud services, nor is this a model that is
economically advantageous for the cloud customer, since he is forced to pay an
additional charge for the trustee service,” says Höllwarth and argues: "
“I have the greatest respect for companies like
Microsoft or Salesforce, that deliver high service quality and do everything to
comply with the complex situation of data privacy regulations in Europe, that
vary from country to country. Most cloud providers do not have the necessary resources
to handle such an unnecessary complex framework. It is this fragmented legal
framework that we need to chang.”
It is
therefore interesting to know that there are more and more rumours indicating that
the European Data Protection Directive might be approved by the Council of the
European Union at the beginning of next year.
After the Commission’s
draft in 2012 and the Albrecht Report (see EU/Albrecht Report), which was passed by
the EU Parliament with 95% approval shortly after the Snowden case was revealed,
we have now been waiting for more than 18 months for the Council to approve a
hopefully not substantially modified text.
There is a very
impressive independent movie (Link) currently running in selected cinemas that
shows the development of this new law and the massive opposition by lobbyists
against Mr. Jan Philipp Albrecht, a 33-year-old member of the European
Parliament who acts as Vice Chair of the EU Committee
on Civil Liberties, Justice and Home Affairs (see here). Mr. Albrecht was the official rapporteur of
this new law to the EU parliament.
A pertinent multinational program called the Cloud Privacy Check (CPC) is also
currently in its final phase of development. 45 lawyers from 32 countries are working on the
project, whose final report as well as an online tool are expected to be
published in 26 different languages at the end of January 2016. In the context of
Safe Harbor, Binding Corporate Rules and the expected European Data Directive,
the CPC will arrive at the perfect moment.
For the next 2-3 years, the CPC will serve as a guideline for cloud providers,
customers and users alike. The CPC will help people to understand the generic value,
concept and requirements of data protection regulations, and will make easy for
them to handle the country-specific differences with confidence until unified –
or at least similar and comparable – data protection regulations come into effect
in all of these countries.
The Cloud Privacy Check (CPC) is intended to
provide relief by employing three methodical approaches:
Simplification of a complex subject matter without loss in
terms of content. The goal of the CPC is to elucidate the topic of data
protection in the cloud to 90 percent on a single page, thus providing a
comprehensible and workable basis of information for 90 percent of the people
having to deal with the topic. But don’t worry: Jurists will still be needed.
Structuring of a plethora of questions into individual
topical blocks which can then be approached step by step – from the simplest to
the most complex case. Simultaneous correlation of the respectively required
legal tools to be generated and evaluated in detail by jurists.
Separation of the generally applicable from the specific.
This is probably the most significant aid for managing a complex trans-border
endeavour. By identifying what is the same throughout all countries, the CPC
allows the user to focus on the differences – if they actually apply to him.
The CPC aims to provide access to relevant information affecting another
country quickly and easily, without having to deal with those aspects that are
the same as “at home”.
Keine Kommentare:
Kommentar veröffentlichen
Ihre Meinung zu dem Blogbeitrag: