27 Sep 2012: The Information Commissioner’s Office (ICO) has published guidelines to businesses today to underline that companies remain responsible for how personal data is looked after, even if they pass it to cloud network providers. As more and more businesses migrate to cloud computing, with the economies of scale they offer giving access to a range of computer technologies and expertise that would be difficult to afford in-house.

As more and more businesses migrate to cloud computing, with the economies of scale they offer giving access to a range of computer technologies and expertise that would be difficult to afford in-house. But data protection regulator ICO says it is concerned that many businesses do not realise they remain responsible for how the data is looked after, even after passing it to the cloud network provider.

That’s prompted the ICO to produce a guide to cloud computing, to help businesses comply with the law. The guide gives tips including:

• Seek assurances on how your data will be kept safe. How secure is the cloud network, and what systems are in place to stop someone hacking in or disrupting your access to the data?
• Think about the physical security of the cloud provider. Your data will be stored on a server in a data centre, which needs to have sufficient security in place.

• Have a written contract in place with the cloud provider. This is a legal requirement, and means the cloud provider will not be able to change the terms of the service without your agreement.

• Put a policy in place to make clear the expectations you have of the cloud provider. This is key where services are funded through adverts targeted at your customers: if they’re using personal data and you haven’t asked your customers’ permission, you’re breaking data protection law.

• Don’t forget that transferring data internationally brings a number of obligations – that includes using cloud storage based abroad

Speaking as the guide was launched, author Dr Simon Rice, ICO Technology Policy Advisor, said:  “The law on outsourcing data is very clear. As a business, you are responsible for keeping your data safe. You can out-source some of the processing of that data, as happens with cloud computing, but how that data is used and protected remains your responsibility. It would be naïve for an organisation to take the attitude that these guidelines are too much effort to simply store some data in a different place. Where personal information is involved, the stakes are high and the ICO has already demonstrated it will act firmly against those who don’t meet data protection laws”

A recent online YouGov survey commissioned by the ICO found that 46% of UK adults online who use cloud storage are concerned about the security of their information in cloud storage.  The survey also found that only 39% of adults online realised that social media used cloud storage to store personal data, while 46% did not realise that by hosting their information on cloud servers, their information could be being stored anywhere in the world.

The cloud computing guidance for organisations is available on the ICO website here.
The ICO has also produced advice for members of the public on cloud computing here.