Geneva, Switzerland, 14 November 2014 Data Protection for Public Cloud (International Standard ISO 27018) Stéphane Guilloteau Engineer Expert, Orange Labs ITU Workshop on “Cloud Computing Standards – Today and the Future” (Geneva, Switzerland 14 November 2014)

Geneva, Switzerland, 14 November Agenda Introduction Scope of Methodology Context Requirements Structure Principles Sector-specific examples Conclusion

Geneva, Switzerland, 14 November ISO/IEC Title Code of practice for PII protection in public clouds acting as PII processors PII=Personally Identifiable Information ISO/IEC JTC1 SC27 WG5 Information technology, Security techniques, Identity management and privacy technologies published in 2014/08

Geneva, Switzerland, 14 November SC 27 Figure by Jan Schallaböck, Vice-Convenor WG5

Geneva, Switzerland, 14 November WG5 Figure by Jan Schallaböck, Vice-Convenor WG5

Geneva, Switzerland, 14 November Scope Objective To create a common set of security categories and controls that apply to a public cloud computing service provider To meet the requirements for the protection of PII

Geneva, Switzerland, 14 November Methodology Collecting together PII protection requirements according to ISO/IEC and the guidance for implementing controls given in ISO/IEC Designed for All types and sizes of organizations

Geneva, Switzerland, 14 November Context A public cloud service provider is a “PII processor” when it processes PII for and according to the instructions of a cloud service customer (controller) “Privacy by Design” “PII lyfecycle consideration” Information security risk environment

Geneva, Switzerland, 14 November Ecosystem Figure by Chris Mitchell, Editor

Geneva, Switzerland, 14 November Requirements Three main sources legal, statutory, regulatory and contractual requirements risks corporate policies

Geneva, Switzerland, 14 November structure Security policies Organization of information security Human resource security Asset management Access control Cryptography Physical and environmental security Operations security Communications security System acquisition, development and maintenance Supplier relationships Information security incident management Information security aspects of business continuity management Compliance

Geneva, Switzerland, 14 November principles Consent and choice Purpose legitimacy and specification Collection limitation Data minimization Use, retention and disclosure limitation Accuracy and quality Openness, transparency and notice Individual participation and access Accountability Information security Privacy compliance

Geneva, Switzerland, 14 November sector-specific examples clearly allocate responsibilities between the public cloud PII processor, its sub-contractors and the cloud service customer facilitate the exercise of PII principals’ rights ensure purpose specification and limitation principles notify data breach specify PII geographical location

Geneva, Switzerland, 14 November Conclusion comply with applicable obligations be transparent enter into contractual agreement demonstrate effective implementation of PII protection do not replace applicable legislation and regulations, but can assist complete with standards in progress (29151, 29134…)