New EU directive to feature cloud 'bridge'

The Binding Safe Processor Rules will ask cloud service providers to prove their security and agree to become legally liable for any data offences.

Cloud

When the EU drafts a new data protection law in November, it will introduce rules designed to ensure cloud providers are offering a safe service, IT Pro has learned.

The Binding Safe Processor Rules (BSPR) will ask cloud service providers working in the EU to agree to becoming legally liable should any data offences occur at their data centres, lawyers said yesterday.

It will effectively act as an accreditation scheme for cloud providers, meaning it will need vendors to sign up to the initiative.

However, the driving force behind the new rules, partner at Field Fisher Waterhouse Eduardo Ustaran, said service providers were certain to sign up as it would give them a much-needed selling point and, if they didn't, they would be seen as unsafe to use.

Advertisement
Advertisement - Article continues below

To get that accreditation, vendors would have to prove their security models were adequate as well, Ustaran said.

"Cloud service providers would be given an accreditation from their data protection authority," Ustaran told IT Pro.

Verizon Business is one organisation that has been pushing for the EU to enshrine the BSPR concept in data protection law, which is now set to happen.

Stewart Room, partner in FFW's Privacy and Information Law Group, described it as the "bridge" for cloud adoption, given the fears around being legally liable if data offences occur in the cloud.

However, it will do little to allay fears around the US Patriot Act, which is fast emerging as a real threat to cloud adoption. The law effectively means the US can search through any US-run cloud provider's data centres to find information on illegal activities.

For companies planning on using vendors with data centres in the US, this poses a significant obstacle to cloud adoption.

The European Parliament has already raised concerns about the impact of the Patriot Act and its effective overriding of EU data protection laws.

Legal changes incoming

In November, the EU will publish the draft new data protection law, which will form the basis of national legislations for the next 15-20 years. This will replace the current Data Protection Directive and the Data Protection Act in the UK.

Outside of the new Binding Safe Processor Rules, mandatory breach disclosure will be embedded in the draft law.

Advertisement
Advertisement - Article continues below

"We are certain that mandatory breach disclosure laws will be contained with the new EU data protection law. The European Commission has made this clear already," Room said.

This means companies will be required to report any breaches, making more work for Information Commissioner's Office (ICO). It makes it much more likely private companies will be reprimanded by the watchdog, if it decides to show its teeth.

Room believes the ICO will order companies to provide records of any breaches on a monthly basis.

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019
Visit/information-commissioner/31751/what-is-the-information-commissioner-s-office-ico
Information Commissioner

What is the Information Commissioner’s Office (ICO)?

5 Sep 2019
Visit/data-protection/33450/bounty-fined-by-ico-for-unlawfully-sharing-member-data
data protection

Bounty fined by ICO for unlawfully sharing member data

15 Apr 2019
Visit/backup/33385/arcserve-udp-9240dr-review-beef-up-your-backups
backup

Arcserve UDP 9240DR review: Beef up your backups

4 Apr 2019

Most Popular

Visit/security/identity-and-access-management-iam/354289/44-million-microsoft-customers-found-using
identity and access management (IAM)

44 million Microsoft customers found using compromised passwords

6 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/network-internet/wifi-hotspots/354283/industrial-wi-fi-6-trial-reveals-blistering-speeds
wifi & hotspots

Industrial Wi-Fi 6 trial reveals blistering speeds

5 Dec 2019
Visit/hardware/354237/five-signs-that-its-time-to-retire-it-kit
Sponsored

Five signs that it’s time to retire IT kit

29 Nov 2019