Cloud computing is not only a technical and business concern, but also a legal and regulatory issue given the fact that users are essentially handing over the management or storage of their content and data to third-party service providers. In some jurisdictions, it is unlawful to store sensitive data offshore, hence reducing the viability of running cloud deployments. A recent study commissioned by the European Union warns that public clouds might not be suitable for government use, given certain restrictions.
A study published by the European Network and Information Security Agency (ENISA) entitled Security & Resilience in Governmental Clouds has warned EU government agencies to avoid running public cloud deployments that involve sensitive data. This is due to legislation in some EU member states that restrict certain types of information from leaving national borders. In the case of public cloud deployments, the ENISA says storing sensitive data on public clouds will effectively violate these restrictions, particularly if the data centers are physically located in other countries.
An example of such a legal restriction is included in the UK’s Data Protection Act, which is based on the EU’s Data Protection Directive. The directive is currently being amended to include provisions for exchanging data across national borders.
via European Union Concerned With Cloud Deployments Storing Sensitive Data Offshore.