Cloud Hosting

The Information Commissioners Office (ICO) has issued its long-awaited guidance on cloud computing. Unfortunately, the wait has not lived up to expectations. As a result, it is not possible to follow the ICO advice on cloud computing and still have a solution that could be called a cloud solution.

The information commissioner acknowledges that organisations might find it difficult to exercise any meaningful control over their cloud providers. However, he warns, that does not mean that cloud customers will not be ultimately responsible for any data breaches by their service provider.

The ICO warns organisations to tread cautiously if a cloud provider offers "take it or leave it" terms and conditions. Such contracts, it says,may not allow the cloud customer to retain sufficient control over the data to fulfil their data protection obligations.

Organisations must therefore check their cloud provider's terms of service carefully, to ensure they meet their obligations under the Data Protection Act.

There is only one way to read this guidance. Since most cloud service providers do not comply with the provisions of the Data Protection Act 1998 (DPA), the ICO is, in effect, banning the use of cloud services.

Since most cloud service providers do not comply with the Data Protection Act, the ICO is, in effect, banning the use of cloud services

Dai Davis, lawyer

The reality is, the whole purpose of commercial cloud services is to pile it high and sell it cheap.It is not that those services "may" not give sufficient control to a cloud customer they are designed not to. None of them do so.That is the whole rationale behind piling it high and selling it cheap.

The result is that none of those cloud services give meaningful legal guarantees to cloud customers.

Yes, a cloud customer could negotiate a one-off solution from a cloud provider. If the cloud customer is willing to pay enough, anything is possible.But the cloud customer would not then end up with what a normal businessman would regard as a cloud solution it would end up with a bespoke outsourcing solution.And it would not end up with most of the benefits of the cloud certainly not the cost benefits.

Link:

Where does the ICO's new cloud guidance take you?