In August this year (to not a great deal of fanfare), ISO published a new security standard for cloud services: ISO/IEC 27018Information technology – Security techniques – Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors (“ISO 27018”).  Datonomy reported in May this year, that this new standard was on its way. This publication is a welcome step towards ensuring compliance with the principles of privacy laws and further boosting customer confidence in in cloud computing technologies.

 Here are Datonomy’s questions and answers on this new security standard.  

 What’s the aim of ISO 27018?

 The standard’s aim is to create a common set of security controls that can be implemented by a public cloud computing service provider that is processing personal data on behalf of another party.   

 How is ISO 27018 structured?

 The standard is based on (and follows a similar structure to) ISO/IEC 27002 – Information technology – Security techniques – Code of practice for information security controls (“ISO 27002”).  In short, ISO 27018 tailors ISO 27002 for use by a public cloud computing service provider.  The structure breaks down into three key parts:

  1. ISO 27018 provides a reference to ISO 27002 where the controls in ISO 27002 are applicable to cloud computing service providers processing personal data. 
  2. ISO 27018 sets out additional guidance and/or information for these controls, where necessary for cloud computing service providers processing personal data. 
  3. There are additional controls (and associated guidance) in the Annex to the standard which are not covered in ISO 27002.

 What’s in ISO 27018?

 The main section of ISO 27018 covers the same  areas as ISO 27002: Information security policies; Organization of information; Human resource security; Asset management; Access control; Cryptography; Physical and environmental security; Operations security; Communications security; System acquisition, development and maintenance; Supplier relationships; Information security incident management; Information security aspects of business continuity management; and Compliance.

 The Annex to ISO 27018 covers additional areas: Consent and choice; Purpose legitimacy and specification; Data minimization; Use, retention and disclosure limitation; Openness, transparency and notice; Accountability; Information security; and Privacy compliance.

 From a legal perspective, ISO 27018 can been seen as having elements of a controller to processor agreement and elements of technical and organizational security measures.

 Who can use ISO 27018?

 ISO states that “ISO 27018 is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, which provide information processing services as PII processors via cloud computing under contract to other organizations.

 How can ISO 27018 be used?

 The organizations listed above can use the standard to select applicable controls when implementing a cloud computing information security management system and/or as a guidance document for implementing these controls. Like ISO 27002, ISO 27018 does not specify what controls are applicable to what organization.  This is not surprising as it would be near impossible to do so. However, to circumvent this issue, ISO/IEC 27001 requires a risk assessment to be performed to identify what controls are required and to what extent it should be applied. A new ISO 27017  that is still in the pipeline might fill this gap.

 Providers that comply with ISO 27018 will definitely have a better selling argument as they confirm compliance with important data protection standards. There are also good arguments that a self-audit by a provider under ISO 27018 is accepted as proof of compliance with technical and organizational measures (as required, for example, under EU law for data processing agreements).

 What are the limitations of ISO 27018?

 Most of the controls in the standard will also apply to a controller of personal data.  However, the controller will, in most cases, be subject to additional obligations, not included in this standard.

  1. Cloud beyond personal data.  ISO 27017, which has not been published yet, will deal with the application of ISO 27002 to the use of cloud services and to the provision of cloud services generally.  ISO 27018 is focused on cloud services that process personal data.
  2. Legal nuances.  We will have to see if this ISO standard is widely adopted. It is being  heavily promoted by cloud giants.  The standard addresses, broadly, the key obligations in privacy laws around the world (and there are of course large similarities).  However,  there are nuances in privacy laws around the world.  The standard does not address all of these.  Therefore customers and providers alike will still have to consider those nuances. 
  3. Additional sector rules.  There are often additional rules to privacy laws that ISO 27018 doesn’t deal with.  Many readers will be familiar with additional relevant rules imposed in particular industry sectors e.g. the financial services industry, the public sector, the health sector and the education sector.  Customers and providers in these sectors will still have to consider these additional rules.


 This is a helpful standard for the cloud industry.  ISO 27018 is not a management standard (c.f. ISO 27001) and therefore is unlikely to be certified against.  The same is true for ISO 27017.  However, it provides a useful reference guide for customers and suppliers alike – it is the first global standard of its kind and is a suitable means for globally operating providers to demonstrate their data protection/privacy compliance – instead of having to cope with different national standard in various jurisdictions.  If this standard is adopted and accepted widely, then customers and providers can use this standard to evaluate what protections are in place and, more importantly, what’s missing!

Posted in Uncategorized | Leave a comment
Christian Leuthner

On August 19, 2014, more than one year after the first draft bill of an IT Security Act, the German Federal Ministry of the Interior has published the new draft bill of the Act, aimed at boosting the security of information technology systems. The full title of the legislation is “Entwurf eines Gesetzes zur Erhöhung der Sicherheit informationstechnischer Systeme“ (IT Sicherheitsgesetz) (“IT Security Act”). The new rules are still subject to change but look likely to come into force in early 2015.

General overview

In fact, the IT Security Act will not be an individual law, but will amend the Act on the Federal Office for Information Security, the Telecommunication Act, the Telemedia Act and the Act on the Federal Criminal Police Office as well as the Act on the German Federal Office of Information Security. The IT Security Act contains five central topics and provides for:

  • IT security in companies (see A. below)
  • Protection of individuals/citizens while using networks (see B. below)
  • Securing federal IT (see C. below)
  • Strengthening the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik “BSI”) (see C. below)
  • Extension of competences of the Federal Criminal Police Office (Bundeskriminalamt “BKA”). (see C. below)

The aim behind the IT Security Act is to turn German IT systems and critical infrastructures into the safest systems in the world.

A. IT security in companies

Scope: which organisations are caught by the new rules?

Under the new IT Security Act, providers of critical infrastructures (“CI Providers”) shall implement an acknowledged standard of technical measures to secure their IT systems and inform authorities about certain attacks or IT incidents without undue delay. “Critical Infrastructures” will be defined by a separate regulation to be enacted once the IT Security Act is in place. According to the proposed amendment of the Act on the German Federal Office of Information Security critical infrastructures shall, however, include establishments, plants and parts of it in the sectors of energy, IT, transport and traffic, health, water, nutrition, finance and insurance. Provider of critical infrastructures considered to be micro, small and medium-sized enterprises in the meaning of Recommendation 2003/361/EC are excluded from the scope of the IT Security Act.

Expressly excluded from the term “critical infrastructures” are federal communication technologies that are used for internal communication between authorities and for communication towards third parties. This exclusion is subject to criticism of industry associations because the the IT Security Act does not apply to the biggest critical infrastructure in Germany.

Furthermore, currently there is a lot of criticism as the term “Critical Infrastructures” requires concrete definition. To date it is not fully clear which organisations are covered by the new rules.

  1. Security standards

CI Providers, except providers of public telecommunication networks or public telecommunication services, will be obliged to implement adequate organizational and technical precautions and other measures to protect the IT systems, their components and the processes that are mandatory to provide the critical infrastructure (“Security Measures”). Security Measures must be fully implemented two years after the IT Security Act comes into effect. CI Providers will be obliged to prove those Security Measures every two years by providing sufficient audit reports or certificates.

CI Providers in common sectors and their relevant sector associations may propose their own standards for Security Measures that substantiate the general Security Measures.

  1. Notification duties

CI Providers must designate at least 15 individuals as contact points for warning and alerting (Warn- und Alamierungskontakte). CI Providers are obliged to notify the BSI via those designated contacts without undue delay in case of interference or impairment that could lead to breakdown or the impairment of the critical infrastructure. In such cases, providers may notify the BSI on an anonymous basis. The notification must contain the technical framework of the CI Provider used to provide the critical infrastructure, the Security Measures implemented and the sector of the provider. In cases where the interference or impairment has already led to a breakdown or impairment, an anonymous notification is not permitted.

  1. Further obligations

Companies in the same sector may designate one common contact person managing the communication between CI Providers and the BSI.

Third parties may request information on Security Measures and on security incidents from the BSI unless CI Providers have legitimate interest in non-disclosure or if the disclosure of such information would impact material security interests of the general public. CI Providers have to consent in the disclosure of information with regard to actual breakdowns or impairments as well as on the result of the regular audits.

B. Protection of individuals/citizens while using networks

Protection of individuals/citizens is mainly aimed at telemedia and telecommunication providers. Telemedia providers and telecommunication providers shall implement an acknowledged standard of technical security measures.

Telecommunication providers are obliged to inform the Federal Network Agency (Bundesnetzagentur) in case of impairment of the telecommunication networks that could lead to significant security incidents, e.g. unauthorized access to users’ systems. The Federal Network Agency may request a detailed report in case of an actual incident from the providers. In case of an incident, the Federal Network Agency either may inform the public itself or oblige the provider to do so.

Providers are obliged to inform their customers about incidents on the providers’ data processing systems (e.g. malware and cyber-attacks) and provide them with information and, if applicable, software or applications to remove or combat such malware or cyber attacks.

In addition, Telemedia providers are permitted to process and use usage data, telecommunication providers may process and use inventory and traffic data to identify, limit or eliminate impairments.

C. Securing federal IT and strengthening federal authorities

BSI is entitled and obliged to determine minimum security requirements for federal authorities to secure federal IT networks. BSI is entitled to assess IT systems and services to and publish the results for the purpose of improving IT systems and services. BSI is no longer only entitled to inform the public on malware but also on the loss of data. The BKA is entitled to investigate in more kinds of cybercrime, such as espionage of data, computer fraud.

D. Olswang comment and outlook for the new act

The IT Security Act is a step in the right direction – creating high security standards where necessary, increasing protection for individuals and providing assistance for individuals to self-help with regard to security incidents. The opportunity to notify the BSI anonymously of security incidents leads to a fair balance between the reputation of providers and the protection of individuals and general public. However, as long as the term ‘critical infrastructures’ is not defined, it is not fully clear what companies are in the scope of the IT Security Act. Furthermore, the provider of the biggest critical infrastructure of all, the Federation, is excluded from this scope. Furthermore, the costs of implementation which providers will face are currently not easy to quantify. Industry associations assume costs of more than one billion Euros triggered by the implementation and maintenance of the technical and organizational measures under the IT Security Act.

In addition, there are privacy concerns with regard to the processing and use of usage data by telemedia providers and processing and use of inventory and traffic data by telecommunication providers. These companies are entitled to store a lot of information under the cloak of IT security and share this information with federal authorities, i.e. what was denied by the ECJ with regard to the Data Retention Directive.

The IT Security Act is now subject to interdepartmental coordination and will then be discussed with stakeholders of the relevant industries and stakeholders of society. A formal procedure with regard to the participation of stakeholders does not exist. Industry associations will likely request their members to provide feedback and raise issues so that the IT Security Act can be amended. According to a statement made previously by the German Federal Ministry of the Interior, the IT Security Act shall be enacted in early 2015. The content of the final draft will be eagerly awaited.

It is interesting to see that Germany is introducing its own legislation on cyber security ahead of the formal adoption of the EU Network and Information Security Directive, which is still to be agreed by the EU institutions and Member States. However, the EU Network and Information Security Directive and the IT Security Act cover similar topics. The IT Security Act can be seen as Germany’s position in further discussions about the EU Network and Information Security Directive. Next steps, and the final text of the Act, will be monitored with interest by Datonomy.



Posted in breach notification, cyber crime, data breach notification; telecoms package; europe, data breaches, data security standards, data theft, data violation, disclosure of personal data, EU, EU Legislation, Germany | Tagged , , , , , , , | Leave a comment
Thibault Soyer

CNIL’s recent ruling against Orange has wider lessons for all data controllers who rely on processors and sub processors to process personal data. Datonomy’s correspondent in Paris analyses the issues.


In its deliberation dated 7 August 2014 (but only published on 25 August), the CNIL issued, for the first time, a public warning (i.e no fine has been imposed on Orange, but the sanction consists in the publication of CNIL’s ruling on its website) against a telecoms operator on the basis of personal data breach requirements (pursuant to Article 34 bis of the French data protection act 1978). On 25 April 2014, Orange notified the CNIL of a technical failure in one of its marketing sub-processors, resulting in the leak of personal data (name, surname, birth date, email address and phone number) concerning 1.3 million subscribers. Following this notification, the CNIL investigated Orange and its processors’ premises and found that Orange had not fulfilled its obligation to ensure the security and confidentiality of personal data with such sub-processor, despite the fact that the security breach had been adequately notified and dealt with by Orange.

Sanction grounds

The focal point of particular interest in this decision is that, although Orange was found to be compliant with personal data breach requirements, notably by having notified the CNIL and data subjects “forthwith” of the breach, this notification brought the attention of the French privacy watchdog to the security and confidentiality measures imposed by Orange on its subcontracting chain. The key issues highlighted by CNIL were as follows:

  • although its first (main) processor had complied with security and confidentiality measures imposed on it contractually, Orange had not ensured a back-to-back of the security and confidentiality provisions in the agreement between the processor and its sub-processors;
  • Orange had not conducted any security audit on the version of the marketing application specifically developed by its sub-processor, which would have allowed it to identify the security breach; and
  • Orange did not sufficiently protect customers’ personal data when updating and sending them to its processors (by non-encrypted emails).

Lessons to be learned and security standards to be set to anticipate data breaches

This case stresses the utmost importance for electronic communications operators to be proactive and plan appropriately, notably by complying with the high preventive standards that regulators expect data controllers to adopt in order to demonstrate that they have implemented “appropriate” security measures under the current data breach rules, as indicated in the recent March 2014 Data Breach Opinion issued by the EU’s Article 29 Working Party. On top of that, this ruling shows how important it is for electronic communications operators to impose security obligations at least as stringent as those applicable to them on their processors and sub processors. For further information on this WP 29 Opinion, please see the report by my fellow Datonomist Claire issued in April this year, and the coverage of the underlying Regulation by Carsten in July 2013.


Posted in Article 29 Working Party, breach notification, Controller to processor clauses, data breach, data breach notification, data breach notification; telecoms package; Directive 95/46/EC, data breach notification; telecoms package; europe, data breaches, data loss, data processor, data protection compliance, data security standards, encryption, information security, Telecoms Package | Leave a comment
Andreas Splittgerber

Our quarterly IT and data protection newsletter keeps you informed of current legal issues, decisions and events in the technology sector in Germany. We hope you enjoy reading.

This edition covers the following topics.

I.          Canvas Fingerprinting – Tracking without Cookies

II.          District Court of Berlin: WhatsApp must provide terms and conditions in German, and improve the legal notice

III.          „No-Spy decree“ of the German Federal Ministry of Interior requires guarantee in procurement procedures

IV.          German Supreme Court: Collection of minors’ personal data for marketing purposes in the course of a competition is not permitted

V.          ECJ: Copies on the user’s computer screen as well as in the ‘cache’ of a computer’s hard disk, created in the course of viewing a website, do not infringe copyright

This is the link to the full version.

Posted in Uncategorized | Tagged , , , | Leave a comment
Mel Shefford

With the awareness that future cyber-attacks could have very serious consequences, the Government has proposed amendments to the Computer Misuse Act 1990. In this post we look at the current offences under the Act as well as recent amendments proposed by the Serious Crime Bill.

In August 2013, the outgoing US Secretary of Homeland Security Janet Napolitano gave a farewell speech in which she warned: “Our country will, at some point, face a major cyber event that will have a serious effect on our lives, our economy and the everyday functioning of our society.”

Her message vocalised what governments, businesses and organisations around the world are well aware of: as we become increasingly reliant on technology, and as systems become even more interconnected and complex, the risk of a serious cyber-attack increases. And whilst we currently associate cyber-attacks with access to personal data and damage to commercial interests, in the future the impact could be even more serious. For example, future attacks could result in major damage to the economy, national security, the environment and/or human welfare.

With this in mind, the British Government has been ramping up efforts over the past few years to tackle cyber-crime. For example, in 2011 it launched the National Cyber Security Strategy; in 2013 the National Cyber Crime Unit started operations; and £860 million has been committed until 2016 to boost the UK’s cyber capabilities. More recently, BIS announced the Cyber Essentials scheme to help businesses protect themselves against cyber-attacks.

Most Datonomy readers will be well aware of how important it is for organisations to be proactive about preventing data breaches, and how devastating the consequences can be if a breach does occur. But what are the consequences for hackers who are caught?

Offences under the Computer Misuse Act 1990

In the UK, the hacker might be guilty of  one or more of the following offences under the Computer Misuse Act 1990:

  • Obtaining unauthorised access to computer material (for example, using another person’s ID and password to log onto a computer and access data). The maximum penalty is a 2 year prison sentence and/or an uncapped fine (Section 1).
  • Obtaining such access in order to commit or facilitate the commission of another offence, such as theft of funds or data. The maximum penalty here is a 5 year prison sentence and/or an uncapped fine (Section 2).
  • Obtaining such access in order to intentionally or recklessly impair the operation of any computer, a program or the reliability of data held on a computer; prevent or hinder access to any program or such data; or enable such impairment, prevention or hindrance. This offence carries a maximum penalty of 10 years in prison and/or an uncapped fine (Section 3).
  • Making, supplying or obtaining articles for use in any of the above offences. This carries a maximum 2 year prison sentence and/or an uncapped fine (Section 3A).

The Serious Crime Bill

In June, the Queen announced the Serious Crime Bill which (among other aims) seeks to amend the Computer Misuse Act so that serious cyber-attacks are properly punished. In particular, there is a concern that the current custodial penalties – which have been described as “woefully inadequate” by a member of the House of Lords – are not sufficient for serious cyber-attacks. The two main changes proposed by the Bill are as follows:

(1)   The creation of a new offence to cover serious cyber-attacks

This new offence would be committed where a person knowingly, and intentionally or recklessly, commits any unauthorised act in relation to a computer which causes or creates a significant risk of serious damage to human welfare, the economy, the environment or national security in any country.

An act causing damage to “human welfare” would be something causing loss to human life; human illness or injury; disruption of a supply of money, food, water, energy or fuel; disruption of a system of communication; disruption of facilities for transport; or disruption of facilities relating to health.

Commission of this offence would be punishable by up to 14 years’ imprisonment and/or a fine, except where the act causes loss to human life, human illness or injury, or serious damage to national security, in which case the penalty is life imprisonment and/or a fine.

The Home Office has acknowledged that no cyber-attack has occurred to date which would engage this new offence. However, the idea is to ensure that there are substantive penalties if a serious attack were to occur in the future. Indeed, the Home Office anticipates – and no doubt hopes – that the number of prosecutions for this offence will be minimal.

(2)   Implementation of the EU Directive on Attacks Against Information Systems (2013/40/EU)

This Directive is designed to ensure that the EU has minimum rules on cyber offences and sanctions, and to ensure co-operation between EU member states in relation to cyber-attacks. The UK is already compliant with the Directive, except for the following two aspects:

  • Tools for the commission of an offence

The existing Section 3A offence of making, supplying or obtaining articles for use in another offence under the Act requires the prosecution to prove that the defendant obtained the tool with a view to it being supplied for use to commit or assist in the commission of the other offence. The Bill seeks to amend this offence so that it covers circumstances where an individual obtained a tool with the intention to use it themselves to commit or assist in the commission of a separate offence. Given the increasing ease with which individuals can now obtain malware, the Home Office hopes that this amendment will be instrumental in helping to avoid cyber-attacks in the first place.

  •  Extension of the extra-territorial jurisdiction of the Act

The Directive requires EU member states to establish their jurisdiction over cyber offences which are committed by their nationals. The Act currently requires the prosecution to demonstrate a “significant link” to the UK for the section 1 and 3 offences, essentially being that the defendant or computer was in the UK at the time of the offence. To conform to the Directive, the Bill extends the list of possible significant links to the UK to include the defendant’s nationality. This would mean that a UK national could be prosecuted for an offence where the only link to the UK is her/her nationality, provided that the offence is also an offence in the jurisdiction where it took place.

The legislative timetable and process

The Bill started in the House of Lords, and at the time of writing, the House of Lords report stage – where the Bill will be examined in more detail and the Lords will vote on proposed amendments – is scheduled to commence on 14 October. After a third reading at the House of Lords, it will then be considered by the House of Commons. The EU implementation aspects will need to be in force on or before 4 September 2015 in order to meet the EU transposition deadline, but the rest of the Bill will no doubt be subject to more scrutiny.

Posted in cyber-privacy, data breach, data breaches, data disclosure, data loss, data theft, data violation, Datonomy, EU, EU Legislation, fines, Home Office, identity fraud. personal data defintion., Penalty, police, UK | Tagged , , , , , | Leave a comment
Andreas Splittgerber

The European Union Agency for Fundamental Rights has published a Handbook of European data protection law, to which I was a contributor.

This handbook is designed to familiarise legal practitioners who are not specialised in the field of data protection with this area of law. It provides an overview of the European Union’s and the Council of Europe’s applicable legal frameworks.

The Handbook can be found here.

Posted in Uncategorized | Tagged , | Leave a comment
Jai Nathwani

The first edition of Olswang’s Cyber Alert, a regular round up of regulation, best practice and news from our international cyber breach and crisis management team has been published.

Please click here for a printable PDF version.  In this first edition we cover:

In the last few months we have seen news headlines ranging from the international operation against the GameOver Zeus botnet, to  state-sponsored hacking, arrests over the BlackShades malware, and the release of the latest Information Security Breaches Survey, not to mention continued concern over the Heartbleed vulnerability, so there is much for businesses to consider. Click here for a summary of some of the latest headlines.

It is also worth mentioning the European Court of Justice’s Google Spainruling in May, which is arguably the most profound internet case of this decade and which continues to send shockwaves through the tech sector. Whilst Google Spain does not relate to cybersecurity specifically, it does establish that in some circumstances a non-European company is answerable to the European courts and accountable under European data protection laws, including the requirement for appropriate technical and organisational measures to be in place to protect personal data. Read Olswang’s analysis of Google Spain here.

Posted in cyber crime, cyber-privacy, data breach, data loss | Tagged , | Leave a comment
Claire Walker

Last week’s  seismic  decision in the Google Spain case continues to generate many column inches of comment and will no doubt continue to do so for some time. Datonomy’s colleagues in  Olswang’s international privacy team have just published a paper  considering the practical implications of this decision in the round.  You can access it at this link. The paper considers:

  •  Google’s practical options in terms of next steps
  • the implications for individuals’ rights
  • the implications for online publishers
  • what it means for the Right To Be Forgotten under the new EU Regulation
  • the impact on  wider “data debates” over other technologies such as email scanning and Google Glass
  • what it tells us about the workings of Europe’s highest commercial court, and tactical tips for bringing referrals on points of EU law.

The paper is also available in PDF here.

Posted in Directive 95/46/EC, ECJ ruling, EU data protection reform, EU Legislation, eu proposals, Google, journalism, online data protection, Reform of EU DP law, reform proposals, search engine, Spain | Leave a comment
Marcos García-Gasco

The Court of Justice of the European Union (“CJEU”) made a historic ruling  in the case of Google v Spain [Case C‑131/12]. The CJEU ruled that Googleis responsible for the processing that it carries out of personal data which appear on web pages published by third parties.

The decision is something of a surprise given that it goes against the Advocate General’s Opinion delivered last year, and indeed is quite a bold statement by the CJEU on what it sees as the future of data protection in the internet age and the legal responsibilities of search engines.


The case arose after a complaint that was brought against Google by a Spanish individual, Mario Costeja González, to the Spanish Data Protection Authority (AEPD). Mr González had been the subject of an auction notice for unpaid debts that was published in a widely-read newspaper in Spain around a decade ago.  Despite the time that had elapsed since this initial publication, this was still featured prominently in a Google search for Mr González’s name.  Mr González argued that this was in breach of the EU Data Protection Directive (the “DPD”) as the data was not current and that in such circumstances, there should essentially be a “right to be forgotten.” 

The AEPD agreed, and Google subsequently appealed to the Spanish National High Court which in turn referred questions on the meaning of the DPD to the CJEU.

The decision

Despite the Opinion of Advocate General Jääskinen, who considered last year that search engine service providers should not be considered responsible for third-party content on the basis of the DPD for personal data appearing on web pages they process, the Grand Chamber of the ECJ in the judgement published today has concluded as follows:

  • The activities carried out by Google, namely ‘finding information published, indexing it automatically, storing it temporarily and making it available to the public’, must be classified as ‘processing of personal data’ for DPD purposes.  Furthermore, the operator of the search engine must be regarded as the ‘data controller’ regardless of the fact that they have no control over the underlying data itself. 


  • Google falls within the territorial scope of the DPD as its Spanish subsidiary is intended to promote and sell advertising space directed at the citizens of that Member State, which is sufficient to be considered ‘established’ in that Member State.


  • Google must remove links to third-party websites displayed from a search of an individual, where those websites contain personal data relating to the individuals  concerned.  This is subject to certain exceptions, such as public figures, and to achieving a proper balance between the data subject’s fundamental rights and the right to information.


This decision has far-reaching consequences for Google in Europe.  The bar to when there would be a public interest in search engines processing data relating to individuals in the form of search returns seems very high and where the data relates to an individual who is not a public figure, it is rather doubtful that this could ever be permitted. 

There is no clear view how Google will respond to the judgment, but there must be a significant possibility that it will have to establish an elaborate administrative system to deal with individuals who complain about it using their data and sophisticated technical means to ensure that this is blocked. 

It is also unclear how the ruling will affect the ongoing negotiations of the General Data Protection Regulation.  Early drafts of the Regulation included a broad “right to be forgotten” though the latest draft has watered this down somewhat.  Commissioner Viviane Reding who is championing the draft Regulation welcomed today’s ruling saying it was a “strong tailwind” to the proposed data protection reforms in Europe.  The reality is that the Regulation still faces a rocky road before it is passed and some commentators are already questioning why we need new rules for a right to be forgotten at all given today’s ruling.

What is clearer is that the ruling is a sign of the CJEU’s reluctance to allow non-EU-based multinationals to evade European laws where they are clearly otherwise established here.

Posted in Uncategorized | Leave a comment
Jai Nathwani

The ISO is developing specific new security standards for cloud services, which are expected to be published in 2015. This is another welcome step towards ensuring compliance with the principles in the Data Protection Act and further boosting customer confidence in in cloud computing technologies.

Why the new standard?

The development of the new standard is a direct response to one of the key goals announced in the 2012 European Cloud Computing Strategy (the “Strategy”). The Strategy was published by the European Commission with the aim of promoting the rapid adoption of cloud computing in all sectors of the economy in order to boost productivity. The Commission’s own Cloud Standards Roadmap talks about concerns over security as often being cited as a barrier to migrating data to the cloud. Under current rules, liability for breach of data protection rules rests with the data controller therefore, an auditable standard for cloud service providers who process personal data is crucial to demonstrate the supplier’s resilience and hence enable a customer to meet its own regulatory obligations on data security. The need for a recognised benchmark was further endorsed by the Information Commissioners’ guidance on Cloud Computing, published in 2012. The guidance states that when selecting a cloud service provider, the data controller must choose a processor providing sufficient guarantees about the technical and organisation security measures governing the processing to be carried out, and must take reasonable steps to ensure compliance with those measures. Audited compliance to a standard would be the appropriate method to ensure that data controllers comply with its data protection obligations and could be written into the contract between a cloud services supplier and a customer.

The new ISO 27017 and 27018

In response to the need for a cloud computing security standard the International Organisation for Standardisation (“ISO”), which is already responsible for benchmark standards for due diligence on data processors, is developing two cloud specific standards, ISO 27017 and ISO 27018. The two standards are due for official release in 2015.

The new standards are based on the familiar standards of ISO 27001 and 27002. ISO 27001 provides a framework of security controls that can be adapted and applied to an organisation of any size to create a security standards framework. ISO 27002 provides for the practical implementation of the ISO 27001 framework in an organisation. The 27001 and 27002 standards apply generally to the operation of ICT systems. The two new standards under development apply 27002 specifically to cloud computing.

ISO 27017 deals with the application of the ISO 27002 specification to the use of cloud services and to the provision of cloud services. It will recommend cloud-specific information security controls to supplement those recommended by ISO 27002.

ISO 27018 deals with the application of 27002 to the handling of Personally Identifiable Information (“PII”) and will serve as a code of practice for PII protection in public clouds which act as PII processor.

For more detail see this link to the ISO’s website.

Posted in Cloud computing, data protection compliance | Leave a comment