Stormy Weather: Jurisdiction Over Privacy and Data Protection in the Cloud – Part 1

In recent months, "the Cloud" has worked its way firmly into the lexicon of the popular media. Often, the Cloud is presented as a choice— convenience and efficiency or privacy. On the one hand, Cloud providers, tech gurus and private enterprise, expound the benefits of a mass migration to Cloud-based computing—better customer service, enhanced consumer experience, and lower overhead costs. On the other hand, privacy advocates and civil libertarians have sounded the alarm about the increased risks to individuals when their personal information is transferred, stored, accessed, and processed across several jurisdictions by numerous parties in a Cloud environment.

Caught in the middle of the debate are organizations contemplating migrating some or all of their IT infrastructure to the Cloud. While the benefits of the Cloud seem tangible, so do the legal, reputational, and enterprise risks. To compound the complexity of the choice faced by an organization contemplating a move to the Cloud, the jurisdictional questions of which law applies, and when, in the transnational Cloud environment can seem insurmountably complex and uncertain, making some organizations reluctant to move to the Cloud for fear of violating their obligations.

In this article, we discuss the jurisdictional issues associated with privacy and data protection in the Cloud, particularly as they relate to the obligations of libraries and archival institutions and offer some guidance on what organizations might consider in light of compliance obligations. Although the jurisdictional questions can be confounding, many major jurisdictions have a substantial body of law and resources that offer guidance on how best to meet privacy and data protection obligations while not losing the benefits of the evolving and expanding Cloud environment.

Reproduced with permission of the publisher of Internet and E-Commerce Law in Canada, vol. 13, no. 9, January 2013.