Emtel 4G LTE NETWORK

“ The DPO Regulatory Perspective about Cloud Solutions” Presented by Mrs Drudeisha Madhub (The Commissionner ) Tel: Helpdesk: Website: Address: 4th Floor, Emmanuel Anquetil Building, Port Louis

The Data Protection Act The Data Protection Act 2004 was proclaimed in its entirety on the 16th of February 2009, except for section 17(5). In addition, the Data Protection Regulations 2009 (GN 22/09) were enacted to cater for registration fees for data controllers, other prescribed fees, the registration form for data controllers and the request for access to personal data form which represents the form to be used by data subjects (living individuals), for requesting access to their personal data from data controllers.

The Data Protection Act The Data Protection Act 2004 gives individuals rights to protect them against data protection breaches, and creates obligations for those keeping personal information. Under the Act, individuals have the right to be informed of any data processing activity which relate to them as data subjects.

Cloud Computing Cloud Computing has data protection implications which should be seriously looked into by all stakeholders to avoid putting people’s privacy rights at stake. Note:. Accountability for security and privacy in public clouds remains with the organisation as data controller. Consequently, organisations must ensure that any selected public cloud computing solution is configured, deployed, and managed to meet the security, privacy, and other requirements of the organisation.

Recommendations to Organisations 1.0 Criteria for selecting a cloud provider The security, privacy and other organisational requirements for cloud services to meet should be identified.

Recommendations to Organisations 2.0 Risk and Privacy-Impact Assessments It helps in analysing the security and privacy controls of a cloud provider with respect to the control objectives of the organisation. Volume 6: Guidelines on Privacy Impact

Recommendations to Organisations 3.0 Evaluation of the cloud provider This process helps in determining the ability and commitment to deliver cloud services over the target timeframe and meet the security and privacy levels stipulated. 4.0 Service Level Agreement It ensures that all contractual requirements are recorded including privacy and security provisions endorsed by the provider. A legal advisor is important for the negotiation and review of the terms of the SLA.

Recommendations to Organisations 5.0 Performance Assessment The cloud provider should continually be assessed. It must be ensured that all contract obligations are being met. 6.0 Termination The cloud provider should be alerted about any contractual requirements that must be observed upon termination. 7.0 Physical Access All electronic access rights, physical tokens, physical badges or others should be revoked in a timely manner.

Recommendations to Organisations 8.0 Resources It should be ensured that all resources under the SLA are returned in a usable form and secure evidence that information has been properly expunged.

Guideline - Data Protection Act 2004 Vol. 7 - Guidelines on Privacy Enhancing Technologies

Conclusion The use of cloud services can make very good business sense, but data controllers must always bear in mind that they cannot outsource their data protection legal obligations, nor the risk to their reputations with regard to the personal data they entrust to service providers. In connection with the globalised environment in which cloud computing operates, the current regulatory framework is the Data Protection Act which gives the DPO the responsibility for the safeguarding of personal data. However, when no specific data protection provisions apply in relation to cloud computing, users have no other choice but to safeguard data by means of detailed agreements with cloud computing service providers.