Protecting the privacy and security of sensitive customer data in the cloud

doi:10.1016/j.clsr.2012.03.003

Computer Law & Security Review

Volume 28, Issue 3, June 2012, Pages 308-319

https://doi.org/10.1016/j.clsr.2012.03.003 Get rights and content

Abstract

The global ubiquity of cloud computing may expose consumers' sensitive personal data to significant privacy and security threats. A critical challenge for the cloud computing industry is to earn consumers' trust by ensuring adequate privacy and security for sensitive consumer data. Regulating consumer privacy and security also challenges government enforcement of data protection laws that were designed with national borders in mind. From an information privacy perspective, this article analyses how well the regulatory frameworks in place in Europe and the United States help protect the privacy and security of sensitive consumer data in the cloud. It makes suggestions for regulatory reform to protect sensitive information in cloud computing environments and to remove regulatory constraints that limit the growth of this vibrant new industry.

Introduction

Cloud computing is as important “to this decade [as] PCs were to the 1970's, a technological and social leap that will change how businesses function, how cities are planned, how people carry out their work and what citizens expect from online services”.¹ The cloud offers many potential benefits to companies that may be achieved including reduced waste of information systems resources, increased data centre efficiency and lower operating costs.² Already a $68 billion global industry, anticipated to grow $17 billion a year, the significance of cloud computing to the global economy cannot be underestimated.³ To reach this potential, it will be essential to ensure privacy and security for sensitive customer data, which is viewed as a top challenge for companies that are considering cloud computing.⁴

This paper focuses on the information privacy laws of the European Union and the United States, the world's two largest trading partners.⁵ It recognizes that the question of which countries' laws apply to a cloud computing scenario may be difficult to answer because “the exact place where data are located [in the cloud] is not always known and it can change in time”.⁶ Sometimes providing information privacy and security for sensitive data is required by law in the EU or the U.S. Apart from laws that mandate privacy and security for sensitive data, there are questions about whether sensitive data are adequately protected in the cloud. Information privacy and security failures may give rise to lawsuits, invite government investigations and undermine consumers' trust in cloud computing.⁷

Section snippets

Information privacy and security in the cloud

Cloud computing “at its most basic level … means the delivery of IT [information technology] resources as a service to multiple customers via the internet.”⁸ It “can be contrasted with an ‘on premise’ IT infrastructure whereby a business purchases and maintains its own

What is sensitive data?

The starting point for defining sensitive data under EU law is the list of “special categories of data” in the Data Protection Directive (Directive) that includes “personal data revealing the racial origin, political opinions or religious or other beliefs, as well as personal data on health, sex life or criminal convictions” of natural persons.²¹

How the EU regulates privacy and security for sensitive customer data in the cloud

European laws set high compliance obligations for companies requiring them to protect the privacy and security of consumers' sensitive data including sensitive data that is stored in a public cloud.

How the US regulates privacy and security of sensitive data in the cloud

The cloud computing industry faces few legal restrictions in the U.S. Currently there is no comprehensive federal legislation to protect consumers' privacy and personal data and no generally-applicable regulation that limits exports of personal data from the U.S. to other countries.⁵⁹

Regulatory reform is needed to protect sensitive consumer data in the cloud

To adequately protect sensitive consumer data in the cloud, both EU and U.S. laws need to be revised to provide heightened privacy and security for sensitive data. Failure to do so will undermine consumer trust and expose organizations that adopt cloud computing or provide cloud computing services to security breaches and legal and other costs. EU Policy makers have called for a cloud strategy in Europe that would make the EU not only “cloud friendly,” but “cloud active” and anticipate the need

Conclusion

In both the EU and the U.S., privacy laws need to be reformed to provide a solid regulatory foundation for the growth of cloud computing. A primary goal of reform should be to build a regulatory framework worthy of consumers' trust that their sensitive personal data will be kept private and secure in the cloud. Both cloud service providers as well as companies hoping to gain the business advantages of using cloud computing to store and process customer data will benefit from having well

Nancy J. King ([email protected]) is an Associate Professor at Oregon State University's College of Business in Corvallis, Oregon, U.S.A. In 2008 she was a Fulbright Fellow at the Centre de Recherches Informatique et Droit (CRID), University of Namur, Namur, Belgium. While at the CRID she conducted comparative legal research from an EU/U.S. regulatory perspective on data protection and privacy issues related to consumers' use of mobile phones incorporating location tracking

References (0)

Cited by (100)

Understanding the adoption of digital conferencing tools: Unpacking the impact of privacy concerns and incident response efficacy
2023, Computers and Security
Since working from home has become a new norm for many individuals worldwide, digital-conferencing tools have increased in popularity. To date, few studies have investigated how the adoption of digital-conferencing tools relates to user information privacy concerns against security incidents and coping appraisal. This paper utilizes an integrated IUIPC and Privacy Calculus model to explore the impact of privacy concerns, incident response efficacy, trust, and risk involved in digital conferencing adoption. To test the proposed model, we administer a survey to 212 participants and find that perceived benefits, trusting beliefs, and personal Internet interest increase intention to use digital conferencing software while risk beliefs decrease behavioral intentions. In addition, we find incident response efficacy to be a salient construct in explaining users’ trusting beliefs. The study provides recommendations for digital conferencing service providers on how to improve consumer adoption through strengthened security practices and incident response strategies.
Friendly or competent? The effects of perception of robot appearance and service context on usage intention
2022, Annals of Tourism Research
This study examines the influence of the perception of robot appearance and service context on customers'/tourists' intention to use robots. Four studies confirm a congruity effect between the perception of service robot appearance and service context. Results suggest that customers/tourists are more willing to use a service robot perceived as warm in hedonic service contexts, whereas they are more willing to use a service robot perceived as competent in utilitarian service contexts. These effects are driven by trust. This study offers a novel perspective on customers'/tourists' reactions to service robots. It also provides insights for hospitality and tourism practitioners making decisions about robot adoption.
Technology-enabled leadership and performance enhancement outcomes: an empirical investigation from the dynamic capabilities perspective
2023, Journal of Systems and Information Technology
BUSINESS ETHICS IN E-COMMERCE – LEGAL CHALLENGES AND OPPORTUNITIES
2023, Access to Justice in Eastern Europe
Factors Influencing the Sharing of Personal Health Data Based on the Integrated Theory of Privacy Calculus and Theory of Planned Behaviors Framework: Results of a Cross-Sectional Study of Chinese Patients in the Yangtze River Delta
2023, Journal of Medical Internet Research
Understanding medical service quality, system quality and information quality of Tele-Health for sustainable development in the Indian context
2023, Kybernetes

View all citing articles on Scopus

V.T. Raja ([email protected]) is an instructor at Oregon State University's College of Business in Corvallis, Oregon, U.S.A. He earned a Ph.D. in Business Administration from Washington State University, U.S.A. He has a Master's Degree in Mathematics from the Indian Institute of Technology, and a Bachelor's degree in Mathematics from Loyola College, India.

View full text