본문 바로가기
KERD
논문KCI 등재

Challenges to Personal Data Protection in Cloud Computing

Anne S.Y. Cheung|Ricci Ieong|K.P. Chow|Rolf H. Weber
법학연구소 (The Institute of Legal Studies Konkuk University)|2013.05|경제규제와 법|제6권 제1호|pp. 105-128

0

조회

0

다운로드

5

인용

0

참고문헌

키워드

data securityBinding corporate rulesdata controllers and data processorsprotection of personal datatrans-border data transfer
주제분류법학

초록

Although cloud computing technology is at its early stage, it has already transformed our ways of life and has ushered in a wave of new challenges to IT companies and law makers. With this technology, we can access information and be connected with others almost anywhere, any time with Internet connection at much lower cost. The business potential is huge with a forecast of more than US70 billion by 2015. Yet the challenges posed by cloud computing to personal data protection and security are also unprecedented. When our personal data is in remote servers, we may lose control easily, especially when so often, we do not know how, where, by whom our personal data is being processed, not to mention which jurisdictional law should apply. This article focuses on how personal data protection has evolved (1) in the sharing of roles and responsibilities between service providers and data users, with illustrations on the problems of security; and (2) in the particular context of trans-border data flow. The meaning of cloud computing and its various deployment models, entailing different personal data concerns will also be explained. Fully aware that legal regulation cannot catch up with technological advancement, this article argues that a co-regulatory regime that requires and enables personal data protection, implementation and compensation at industry, corporate and individual levels is the way to move forward.

Abstract

Although cloud computing technology is at its early stage, it has already transformed our ways of life and has ushered in a wave of new challenges to IT companies and law makers. With this technology, we can access information and be connected with others almost anywhere, any time with Internet connection at much lower cost. The business potential is huge with a forecast of more than US70 billion by 2015. Yet the challenges posed by cloud computing to personal data protection and security are also unprecedented. When our personal data is in remote servers, we may lose control easily, especially when so often, we do not know how, where, by whom our personal data is being processed, not to mention which jurisdictional law should apply. This article focuses on how personal data protection has evolved (1) in the sharing of roles and responsibilities between service providers and data users, with illustrations on the problems of security; and (2) in the particular context of trans-border data flow. The meaning of cloud computing and its various deployment models, entailing different personal data concerns will also be explained. Fully aware that legal regulation cannot catch up with technological advancement, this article argues that a co-regulatory regime that requires and enables personal data protection, implementation and compensation at industry, corporate and individual levels is the way to move forward.

참고문헌 (50)

  1. Marchini, Renzo, "Cloud Computing : A Practical Introduction to the Legal Issues" (2010), BSI Standards
  2. Hon, W. Kuan, "Hon, W. Kuan, et al., Who is Responsible for “Personal Data” in Cloud Computing? － The Cloud of Unknowing, Part 2", INTERNATIONAL DATA PRIVACY LAW, 2, pp.3~ (2012)
  3. Hon, W. Kuan, "The Problem of “Personal Data” in Cloud Computing: What Information is Regulated? － The Cloud of Unknowing", INTERNATIONAL DATA PRIVACY LAW, 1, pp.211~ (2011)
  4. King, Nancy J., "Protecting the Privacy and Security of Sensitive Consumer Data in the Cloud", COMPUTER LAW & SECURITY REVIEW, 38, pp.308~ (2012)
  5. Robison, William Jeremy, "Free at What Cost? Cloud Computing Privacy Under the Stored Communications Act", GEORGETOWN LAW JOURNAL, 98, pp.1195~ (2010)
  6. Sluijs, Jasper P., "Cloud Computing in the EU Policy Sphere: Interoperability, Vertical Integration and the Internal Market", JOURNAL OF INTELLECTUAL PROPERTY, INFORMATION TECHNOLOGY AND E-COMMERCE LAW, 3, pp.12~ (2012)
  7. Svantesson, Dan, "Privacy and Consumer Risks in Cloud Computing", COMPUTER LAW & SECURITY REVIEW, 26, pp.391~ (2010)
  8. Taylor, Mark, "Cloud Computing", COMPUTER AND TELECOMMUNICATIONS LAW REVIEW, 16, pp.57~ (2010)
  9. Weber, Rolf H., "Transborder data transfers Concepts, regulatory approaches and new legislative initiatives", INTERNATIONAL DATA PRIVACY LAW, pp.1~ (2013)
  10. Weber, Rolf H, "Legal Challenges of Trans-border Data Flow in the Cloud, Rz11", JUSLETTER IT, pp.15~ (2013)
  11. "A Comprehensive Approach on Personal Data Protection in the European Union, COM (10) 609 final"[URL]
  12. "Proposal for A Regulation of the European Parliament and of the Council on the Protection of Individuals with Regards to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation), COM(12) 11 final"[URL]
  13. "Unleashing the Potential of Cloud Computing in Europe, COM(12) 529 final"[URL]
  14. "Article 29 Data Protection Working Party, Opinion on Cloud Opinion" (2012)[URL]
  15. "Article 29 Data Protection Working Party, Opinion 1/2010 on the Concepts of “Controller” and “Processor”, WP169" (2010)[URL]
  16. "Article 29 Data Protection Working Party, Working Document: Transfers of personal data to third countries: Applying Article 26(2) of the EU Data Protection Directive to Binding Corporate Rules for International Data Transfers, WP4"[URL]
  17. "Lulzsec Hacker Pleads Guilty over Sony Attack" (2012)[URL]
  18. "Gartner Lists Top 10 IT Technologies for 2012" (2011)[URL]
  19. "Sony Division Moves Some Services From AWS To Openstack" (2012)[URL]
  20. "CSA Cloud Controls Matrix v1.4" (2013)[URL]
  21. "CSA Consensus Assessments Initiative v1.1" (2011)[URL]
  22. "turns away from AWS, gets into bed with OpenStack" (2012)[URL]
  23. "Security Overview of Dropbox"[URL]
  24. "European Commission: Commission Staff Working Paper: Impact Assessment Accompanying the document Regulation of the European Parliament and of the Council on the Protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) and Directive of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by competent authorities for the purpose of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data, SEC(12) 72 final"[URL]
  25. "Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions: Unleashing the Potential of Cloud Computing in Europe, SWD (12) 271 final"[URL]
  26. "Digital Agenda: New Strategy to Drive European Business and Government Productivity via Cloud Computing" (2012)[URL]
  27. "Commission Adopts Its Cloud Computing Strategy" (2012)[URL]
  28. "Prepare To Invest Billions in the Cloud, EU Warns Businesses" (2012)[URL]
  29. "Gartner Reveals Top Predictions for IT Organizations and Users for 2012 and Beyond" (2011)[URL]
  30. "Cloud Computing And Its Implications On Data Protection. Paper For The Council Of Europe’s Project On Cloud Computing, Centre de Recherche Informatique et Droit" (2010)[URL]
  31. "Report: Lulzsec Hacker Pleads Guilty to Breaching Sony Website" (2012)[URL]
  32. "Towards A European Cloud Computing Strategy (speech delivered at World Economic Forum Davos)" (2011)[URL]
  33. "Sony: Hacker stole PlayStation users’ personal info" (2011)[URL]
  34. "Sony Turns Away From AWS, Gets Into Bed With OpenStack" (2012)[URL]
  35. "The NIST Definition of Cloud Computing" (2011)[URL]
  36. "Sony division moves some services from AWS to OpenStack" (2012)[URL]
  37. "Google, Facebook Bypass IE Privacy Settings; Researchers Say Microsoft Knew since 2010" (2012)[URL]
  38. "The Role Of The 2002 Security Guidelines: Towards Cybersecurity For An Open And Interconnected Economy" (2012)[URL]
  39. "Cloud Computing Service Outages in 2011" (2011)[URL]
  40. "Dropbox Left Open For 4 Hours" (2011)[URL]
  41. "Cloud Service Provider Study" (2011)[URL]
  42. "Cloud Computing and its Implications on Data Protection (Project on Cyber Crime Discussion Paper 5)" (2010)[URL]
  43. "Sony Hit Yet Again; Consumer Passwords Exposed" (2011)[URL]
  44. "Update: Dropbox Will Hand Over Your Files to the Feds If Asked" (2011)[URL]
  45. "Sony’s Letter to Consumer Protection Bureau of United States" (2011)[URL]
  46. "Google Responds To Microsoft Over Privacy Issues, Calls IE’s Cookie Policy “Widely Non-Operational”" (2012)[URL]
  47. "Google Facing More Privacy Litigation (according to WSJ)" (2012)[URL]
  48. "Platform for Privacy Preferences (P3P) Project" (2007)[URL]
  49. "Google And Facebook Accused Of Bypassing iPhone’s Privacy Settings To Spy On Owners To Build Advertising Profiles" (2012)[URL]
  50. "No Privacy on Amazon’s Cloud Drive" (2011)[URL]

관련 논문AI추천

‘클라우드법 제정안’의 주요내용과 검토과제박종찬, 정민호법학연구원 · 법학논총2012 · 제36권 제2호클라우드 서비스 유형별 개인정보보호 방안김범수, 이보성한국정보보호학회 · 정보보호학회논문지2015 · 제25권 제5호클라우드 환경에서 개인정보 국외이전의 법적 쟁점과 개선방향강철하법학연구소 · 경제규제와 법2017 · 제10권 제2호클라우드 컴퓨팅 환경에서 제기되는 개인정보 문제의 법적 고찰정원준법학연구원 · 법학논총2016 · 제40권 제1호클라우드 서비스와 개인정보보호김기창한국정보법학회 · 정보법학2012 · 제16권 제3호Clouds of Things : Data Protection and Consumer Law at the Intersection of Cloud Computing and the Internet of Things in the United KingdomGuido Noto La Diega법학연구소 · 경제규제와 법2016 · 제9권 제1호

이 간행물의 다른 논문 (7건)

The Balance Between Data Flow and Privacy a United States PerspectiveTimothy J. Tooheypp. 7-33One Step Forward, Two Steps Back? Critical Observations on the Proposed Reform of the EU Data Protection FrameworkJudith Rauhoferpp. 57-84개인정보 처리와 관련한 법적 문제 - 우리나라 「개인정보 보호법」과 EU의 ‘2012년 규칙안’을 중심으로 하여 -함인선pp. 150-171정부조직개편과 ICT규제체계의 개선: CPND와 정부기능배분권헌영, 김경열pp. 172-187새로운 통신환경 하에서 플랫폼 중립성의 함의와 규제방법김윤정pp. 188-206
원문 보기