Google urges EU to adopt cloud-friendly privacy regime
EU adoption of cloud services is being held back by inconsistent approaches to security in the laws of member states, Google has told the European Commission. The company’s submission is part of a public consultation that will help to shape future EU policy on a range of issues raised by cloud services, such as security and data protection.
Many EU states have interpreted privacy directives in significantly different ways, says Google. In practice, cloud providers face a legal tangle when providing cloud services to customers in different member states – they may give different answers on whether it is permissible to transfer data to organisations outside the EU, for example.
Among the cases cited by Google:
- Several EU based companies have explored or even implemented technical controls that prevent their employees from accessing their cloud-based services – e.g. email – from outside the EU, or ensured that their network connection to the cloud service always flows through the EU.
- A Google customer from the EU has been advised by its legal counsel that cloud services certified as meeting safe harbor requirements do not fulfil international transfer provisions under EU law.
- A potential Google customer was informed by its auditor that it would lose ISO27001 accreditation if it moved email services to a cloud provider based in the US, on the grounds that the US Government could then have access to the data.
