Data Protection Commissioner Looks To The Clouds

The Irish Data Protection Commissioner recently issued guidance in relation to data protection issues to be considered when contracting for cloud computing services. The primary focus of the Commissioner is on the security of data processed in the cloud. The Commissioner references the recently published opinion of the Article 29 Working Party in relation to cloud computing (Opinion 05/2012) which also provides useful guidance on this topic.


Cloud Security

Ultimately responsibility for security of personal data rests with the data controller under Irish data protection legislation. The data controller is obliged to ensure that it meets the security requirements set out in the legislation in the event that responsibility for data processing is outsourced to any service provider, including a cloud provider.