Emtel 4G LTE NETWORK

““The DPO Regulatory Perspective about Cloud Solutions”The DPO Regulatory Perspective about Cloud Solutions”

Presented by Mrs Drudeisha Madhub Presented by Mrs Drudeisha Madhub (The Commissionner )(The Commissionner )

Email:Email: dmadhub@mail.gov.mudmadhub@mail.gov.muTel: +230 201 36 04Tel: +230 201 36 04

Helpdesk: +230 203 90 76Helpdesk: +230 203 90 76Website: http://dataprotection.gov.mu Website: http://dataprotection.gov.mu

Address: 4th Floor, Emmanuel Anquetil Address: 4th Floor, Emmanuel Anquetil Building, Port LouisBuilding, Port Louis

The Data Protection ActThe Data Protection Act

The Data Protection Act 2004 was proclaimed in its entirety on the 16th of February 2009, except for section 17(5). In addition, the Data Protection Regulations 2009 (GN 22/09) were enacted to cater for registration fees for data controllers, other prescribed fees, the registration form for data controllers and the request for access to personal data form which represents the form to be used by data subjects (living individuals), for requesting access to their personal data from data controllers.

The Data Protection ActThe Data Protection Act

The Data Protection Act 2004 gives individuals rights to protect them against data protection breaches, and creates obligations for those keeping personal information. Under the Act, individuals have the right to be informed of any data processing activity which relate to them as data subjects.

Cloud ComputingCloud Computing

Cloud Computing has data protection implications which should be seriously looked into by all stakeholders to avoid putting people’s privacy rights at stake.

Note:Accountability for security and privacy in public clouds remains with the organisation as data controller. Consequently, organisations must ensure that any selected public cloud computing solution is configured, deployed, and managed to meet the security, privacy, and other requirements of the organisation..

Recommendations to OrganisationsRecommendations to Organisations

1.0 Criteria for selecting a cloud provider

• The security, privacy and other organisational requirements for cloud services to meet should be identified.

Recommendations to OrganisationsRecommendations to Organisations

2.0 Risk and Privacy-Impact Assessments

• It helps in analysing the security and privacy controls of a cloud provider with respect to the control objectives of the organisation.

Volume 6: Guidelines on Privacy Impact

Recommendations to OrganisationsRecommendations to Organisations3.0 Evaluation of the cloud provider

• This process helps in determining the ability and commitment to deliver cloud services over the target timeframe and meet the security and privacy levels stipulated.

4.0 Service Level Agreement

• It ensures that all contractual requirements are recorded including privacy and security provisions endorsed by the provider.

• A legal advisor is important for the negotiation and review of the terms of the SLA.

Recommendations to OrganisationsRecommendations to Organisations5.0 Performance Assessment

• The cloud provider should continually be assessed.• It must be ensured that all contract obligations are being met.

6.0 Termination

• The cloud provider should be alerted about any contractual requirements that must be observed upon termination.

7.0 Physical Access

• All electronic access rights, physical tokens, physical badges or others should be revoked in a timely manner.

Recommendations to OrganisationsRecommendations to Organisations8.0 Resources

• It should be ensured that all resources under the SLA are returned in a usable form and secure evidence that information has been properly expunged.

Guideline - Data Protection Act 2004

Vol. 7 - Guidelines on Privacy Enhancing Technologies

ConclusionConclusionThe use of cloud services can make very good business sense, but data controllers

must always bear in mind that they cannot outsource their data protection legal

obligations, nor the risk to their reputations with regard to the personal data they

entrust to service providers.

In connection with the globalised environment in which cloud computing operates,

the current regulatory framework is the Data Protection Act which gives the DPO the

responsibility for the safeguarding of personal data.

However, when no specific data protection provisions apply in relation to cloud

computing, users have no other choice but to safeguard data by means of detailed

agreements with cloud computing service providers.