I’ve decided to post up an assignment from my first module at University, as an example of my work. We were tasked to create recommendations for a small to medium sized business on how to proceed after the recent court rulings on Safe Harbour. Enjoy!
Abstract
This report aims to provide advice to an organisation on how to proceed with their current cloud computing capabilities in light of the recent Safe Harbour ruling
Assumptions
• The organisation which this report has been written for is a medium sized business with main offices situated in both England and the United States, with around 5000 employees across numerous smaller offices in much of Europe and the US.
• The organisation is in the business of sales, both domestic and international.
• The organisation makes use of cloud computing for storage of sales data (including data backups), and makes use of infrastructure as a service providers for employee computing requirements in combination with thin client machines.
• The organisation makes use of Gmail as the backbone for their email system.
• The organisation makes use of the service Salesforce for management of sales data, as well as for other areas of the business such as customer relationship management.
• The organisation has social media pages on Facebook, Twitter, and Pinterest.
• The organisation has ensured that all companies used are self-certified as compliant with Safe Harbour.
• The organisation does not store all data in the same database, it is broken down by country. This is because the organisation sells different merchandise in different countries depending on local regulations/markets, with different websites catering to different territories.
• The organisation uses different companies to store their data and to provide infrastructure as a service.
• Data security is managed by the organisation’s data storage provider.
• The organisation adheres to the Data Protection act, and the EU directives on Data Storage.
• Although the organisation went through rapid growth in its early stages, it has since plateaued in size.
• The reader of this report will have a passing knowledge of technical terms, but will not be from a technical background.
• This report is based off of the information that is publicly available up to the 4th November 2015. It is possible that any new developments in the Safe Harbour case after this date may invalidate some or all of this document.
Executive Summary
Observations
• The fall out of the Safe Harbour ruling cannot be adequately predicted to be able to take actions with any certainty of success.
• While the NSA is legally allowed to access any data stored within the US (despite data privacy policies), companies storing data in the US will not be able to fully comply with the European Commission’s directive on Data Protection
• New legislation will likely be brought in to address this
• Even if the European Commission backs down and allows for data to legally be transferred to the US, customer pressure will likely limit the numbers of companies doing this due to a preference for their data to not be viewed by the NSA
• Some major changes are likely to take place in the future
• Our infrastructure as a service utilisation should not be affected as our supplier does not store our data
• If we do elect to change the current storage locations of our data (to another provider or to an internal data centre), we will likely experience a loss of revenue stemming from lower website availability during the switch
• Security of customer data should always be at the forefront of our minds when making any decisions
Actions
• Monitor news outlets for any updates on/recommendations stemming from the Safe Harbour ruling.
• Create a risk assessment based on the current physical locations of our data.
• Make use of model clauses and binding corporate rules while verifying that business partners do the same.
• Plan for transferring all of our non-US data to data centres within the EU.
• Plan to create facilities for making item transfers possible between stores in different territories to avoid sales having to occur across territories with incompatible data laws.
• Consult lawyers on our current data privacy obligations.
• Be prepared for major restructuring to our data storage model by researching alternatives.
Introduction
What is/was Safe Harbour?
Safe Harbour was a system created by the US Department of Commerce (Export.gov, n.d.) in response to the European Commission’s directive on Data Protection, to facilitate the ease of transfer of data from outside of Europe (primarily to the US) (Sawers, 2015). The European Commission’s directive disallows the transfer of personal data outside of the European Union (EU) to countries that don’t adhere to EU’s standards for privacy protection. Safe Harbour was designed as a framework to allow for countries outside of the EU (such as the US) to be able to bring their privacy protection policies in line with the expectations of the EU, and to certify themselves as such. The key weakness of this policy however was that companies were able to self-certify compliance, meaning that the system was perhaps not as strong as it should have been.
What happened to Safe Harbour?
An Austrian law student/privacy campaigner, Max Schrems, challenged Facebook Ireland over their data privacy policies in light of the recent Edward Snowden/National Security Agency (NSA) revelations. In this he claimed that his privacy has been invaded if Facebook had allowed the NSA to access data that was being stored about him, and as such that they were behaving in a manner that is not allowed by the Safe Harbour agreement. Schrems’ case was investigated by the Irish Data Protection Commissioner, who then rejected the case on the basis that Facebook is certified to be in agreeance with Safe Harbour. However, the High Court of Ireland contacted the European Union’s Court of Justice in Luxembourg to seek clarification on if national authorities were prevented from investigating complaints with regards to the levels of data privacy provided by the US, and if the contested transfer of data can be forcibly suspended. The EU Court of Justice responded that national authorities can and should be making rulings on a case by case basis, meaning that the Irish Data Protection Commissioner is to reopen the challenge initially started by Max Schrems.
What does this mean for Safe Harbour?
This means that Safe Harbour does not automatically make a compliant company un-attackable with regards to its data privacy policy. If a company’s habits are brought in to question, it is to be investigated on an individual basis. Simply self-certifying compliance to Safe Harbour will no longer be sufficient. The outcome of Max Schrems’ case against Facebook in Ireland may set a precedence for any future cases. In Common Law, new laws may be brought in on the basis of previous rulings (Diffen, n.d.). This may happen in this situation, or it may be that new laws to govern how international data transfers are handled may be created. Due to the efficiency in international data transfer afforded by the previous Safe Harbour policy, it seems that some new system may come in to place. This would most likely have a more formal policy review process, with an external organisation dictating and providing certification.
What is cloud computing?
Cloud computing is the use of external resources for computing. For example, cloud computing can be used for data storage. If you do not want to store data locally for any reason (such as having little space, or being concerned about physical damage/loss), you may want to store your data on “the cloud”. The cloud in this case refers to a bank of computer servers being ran by an external company, which will store your data for you. Cloud computing is not limited to just data storage however. It can have a whole range of useful business applications, such as allowing you to pay for processing power only when you need it, or allowing for users to use virtual machines to save on hardware costs.
How will this ruling effect cloud computing systems?
At this point in time following closely after the initial ruling by the EU Court of Justice, it is hard to predict what the implications of the ruling will be in the long term. Within the UK, some schools are moving away from using US cloud storage applications such as Dropbox over fears of discontinued availability within the UK (Kelion, 2015). Some cloud computing companies have begun to implement “model clauses” or “binding corporate rules” within their contacts. These set out the data privacy requirements provided by the European Commission’s directive on Data Protection, and state that these are now contractual obligations of the company. It seems that this may be one of the better options for companies. If their compliance with the directive are brought in to question due to the lack of automatic protection, they will now be able to point to the requirements also being a contractual obligation on their company’s part. So long as the company in question does actually meet these requirements, the company should in theory not experience many issues personally (and by proxy, their customers should not either). However, for companies that are in the US, the powers afforded by the NSA may be able to override the policies of a given company, causing further issues. If this is found to cause major issues with the legality of data transfer, then it will most likely be on a national scale, rather than an issue for an individual company. It is envisioned that the Article 29 Working Party of European data protection authorities (and other organisations) should over the coming months be able to analyse the impact of the Safe Harbour ruling, and so be able to provide proper guidance on how companies should proceed (Smith, 2015). Some companies, such as Google Apps, have already taken measures to ensure minimal disruptions to their services in the event of an occurrence such as this. After the Safe Harbour ruling was released, they have begun directly contacting users that may be concerned by the ruling (such as Google Apps managers (DukeP, 2015)), as well as by prompting the public to read their privacy policy to show that they are in compliance with the Data Protection directive (Google, 2015), even if their Safe Harbour self-certification is invalid.
What does this mean for our organisation?
As our organisation transfers data internationally, we may well be affected by this ruling. It is also possible that external companies which we currently rely on may be affected. The main country that has been affected by the invalidation of Safe Harbour is the US. This is because the data access rights that the NSA is in possession of are able to overrule any data privacy policy that is put in place by a company storing data within the US (Baker, 2015). As we have offices within the US (and deal with other companies within the US), we may experience some issues. Ultimately, the exact actions needed by our organisation will depend on how we are handling our data.
Steps to be taken
Risk assessment: Stock take our data
Our first action should be to form an absolute view of how our data is handled. In this case, it may be useful to use the “Five Ws” as a basis.
• Who- Who is storing our data?
• What- What are we storing?
• Where- Where is this data being stored?
• When- When did the data move here? Does it still need to be here?
• Why- Why was the decision made to store the data in this location? Can this be re-evaluated?
By asking ourselves these questions, we should be able to gain a complete view of our current data storage/transfer policy. Based on the outcome of this, we can decide what actions we may or may not need to take. For example, this could be worked through with data generated in our United Kingdom (UK) offices.
• Who- Our data is stored using Amazon RDS (Relational Database Service), part of AWS (Amazon Web Services)
• What- We store sales data, including encrypted customer information
• Where- Unsure: AWS has numerous data stores across the globe (Amazon, n.d.)
• When- Data is appended to the main database after a sale takes place
• Why- The capabilities of Amazon RDS meet our business needs, and the price is within our budget.
In this situation, it is unclear where our data is being stored. There could be the potential for us to experience issues here if for instance our sales data that’s being generated in the UK is being sent to the US for storage. It is possible that by liaising with Amazon RDS/AWS we may be able to verify the physical location of our data, and move it if necessary. However, if this proves to be impossible, we may need to re-evaluate our data storage provider. The types of data to be stored will also need to be considered if we do change providers. Sensitive data, such as customer information, will need to be stored securely. Because of this, care should be taken to evaluate the security available in any potential new companies. Information gathered during this stage can be used to form a risk assessment document. This document can be used to better assess any risks faced by our organisation, and to help us to take preventative action before any major issues arise.
Finding where we can store data: Do we just need to worry about the US?
As mentioned in the prior section, data being stored within the US but being generated externally to the US may be problematic. This stems from the NSA being able to access data stored within the US, which is in breach of the European Data Protection laws. However, not all data being stored within the US may be problematic. Sales data being generated by internal sales in our US offices will not be affected by European Data Protection directives, and so if any data is identified to be stored in this manner, it will not be an issue. However, it is worth noting that Safe Harbour was not an EU-US specific program- it is to facilitate the transfer of data from inside of Europe to outside of Europe. Because of this, we will have to look in to every other country external to Europe that we may wish to consider storing data in, and discover if there are any laws present providing local law enforcement agencies with over-ruling data access rights. Any countries that are found to do so should be handled in a manner similar to how we handle US-based data storage capabilities. It would be advisable that we make use of a lawyer to perform such research in to the laws of other countries. It may be possible that this process can be avoided if during our data storage/transfer stock take we discover that data is not being stored outside of Europe/the US, however. One country in particular to look at may be Switzerland. Although Switzerland is in Europe, it is not a member of the EU. A specific branch of Safe Harbour has been designed to deal with data transfer between Switzerland and the US (Export.gov, n.d.), which has most likely also been affected by the recent rulings. It may still be possible to transfer data between Switzerland and the rest of Europe.
An approach that is being taken by larger companies such as Facebook may be appropriate for us: “siloing” data depending on country. This would involve breaking our data down in to separate storage “silos” based on which country it is generated in. The best option going forward may be to attempt to keep our EU sales data within the EU, and our US sales data within the US. The main issue here would be within international sales. Sales within countries which we already have a presence in may be unaffected- customers attempting to make a purchase from for instance our French website to be shipped to the US could be prompted to make a purchase from our US website. This sort of suggestion could also include nearer offices- Although we do not have an office in Austria, someone attempting to make a purchase from Austria using our US website could be prompted to use our German website, as both of these countries are within Europe (and are geographically close). To facilitate this, we may have to evaluate the translation options that are available on each website. One of the key points of this model is that it will only apply to customer information. There does not seem to be a reason that for instance a European customer’s information would need to be sent to the US (if the data is not being stored there). We would still be able to exchange sales statistics between sites in different countries, without customer identifying information attached.
Re-evaluating our sales availability: Will this hurt us?
As stated above, if we decide that we need to separate out our website usage based on the territories within which we are making sales, then we may be artificially limiting our sales potentials. However, the data transfer rulings should not overly limit the countries which we are able to sell to. If a customer in a country outside of the EU/the US was to make a purchase, their data could then be stored in any one of our data centres, so long as that country does not have specific rulings about data storage (such as those seen in Switzerland). This should not cause us any issues, as we would not be sending data in to the country, only accepting data from it. Countries that have their own flavour of Safe Harbour external to the European Union (such as Switzerland) should be re-evaluated to ensure that there are not any new issues with exporting data from them, but most countries external countries should remain unchanged by this ruling. The only real source of loss of income should come from when an item is available in one territory and not another (assuming that this lack of availability comes from an item not being in demand in an area, rather than due to a legal import limitation). It is possible that customers in Europe may wish to purchase an item that is available in the US, but is not generally sold within Europe. Under this new potential measure, the customer would be prevented from doing so. To combat this, provisions for making such international purchases could potentially be afforded. Perhaps items available on one website could be requested on another website, so that sales could be handled internally to that country without any issues with the sales information passing to the US.
Covering our bases: What can we do right now?
As previously stated, some data storage companies have begun to add “model clauses” to their contracts. It could be worth us verifying that companies which we use have taken such precautions, even if their data is to be stored within the US (this is not to say that we shouldn’t begin investigating alternatives to any companies which will cause us data storage issues, however). Many companies used by us (such as Salesforce (Salesforce, 2015)) are releasing statements on their privacy policies, which it could be worth us reading and evaluating. It could also be worth us adding a model clause to our own website’s privacy policies, setting out how we intend to handle sales data in ways which are compliant with the European Commission’s directive on Data Protection. We could also add binding corporate rules to our corporate policy, again reiterating to customers that we will endeavour to keep their data secure and only transfer it legally. Similar statements can be checked for in the contracts that we have with various companies, and added as required. Taking these precautions may help to protect us in the event of any major legal fall out over this Safe Harbour issues, but again cannot be assumed to provide all of the coverage that we will require going forward.
Considering our options: Do we need to use the cloud?
In our current state, we make use of cloud computing for both data storage and for infrastructure as a service to reduce our internal computing overheads. As we use different providers for these capabilities, it seems that we should not need to re-evaluate our infrastructure as a service provider, as they do not hold any of our data. Our main issues seem to solely lie in our data storage situation. We will almost certainly have to re-consider how we store our data, and it may be time to ask ourselves: do we need to still be storing our data on the cloud? Perhaps it is time for us to move our data storage capabilities in-house. This would allow for us to have more complete control over our data, and to be able to reassure customers of what will/will not happen to our data.
In this solution, we may want to look in to building multiple data storage locations based on territorial divides, so that our data is not transferred in any way that could cause Data Protection issues. We would also need to have multiple data storage centres to be able to sufficiently back up our data. This is because in the event of for instance a natural disaster in the area of one of our data centres, we would want our back-ups to be sufficiently far away to not be damaged. The wide spread nature of our offices could be beneficial to this. We could potentially evaluate if there is space in or near our current locations, and store our data there. For instance, our offices in France and Germany could provide mirroring of each other. Our offices in the US could mirror across state borders. Another benefit to our varied geographic locations could be that we can assess the running costs of our data centres in different areas, to work out where it would be most efficient to place them. For instance, power may be cheaper in some locations over others, or placing a data centre in a location with a colder climate may be beneficial as it would reduce on cooling costs.
To facilitate the security of our data in a situation such as this, it would be useful for us to implement the Bell-LaPadula model of security (Bell & LaPadula, 1976). In our current state, all access controls are managed by our data hosts, and so this capability would need to be brought in-house if our data is too. We should be re-evaluating our current risk assessment already in light of the Safe Harbour ruling, and so we could potentially investigate the security risk of bringing data storage in-house at the same time. Our current security policy could easily be implemented using the Bell-LaPadula security model. We already have the idea of user groups laid out, as well as the levels of access required by each group assessed. This is the ideology that makes up the back-bone of the Bell-LaPadula model. In this model, subjects (users) and objects (files) are defined, and their access privileges are assigned in accordance to the security policy. Once this “secure state” is defined, checks can be performed to ensure that data may only be transferred or accessed when it is in a secure state, i.e. it is only to be moved/accessed by those with the correct security permissions to be able to do so. In calculating the overall permissions of a user, three considerations are made:
• Is the user authenticated in the system?
• Does the user need to be able to access this?
• Has the user been approved to access this?
For example, a customer sales accountant may want to access some sales information. The system will first check that the accountant has logged in to the system with their credentials. If they are logged in, it will consult the security policy to assess if they need to access the file. The security policy should state that accountants are able to access sales information, and so the accountant will pass this check. The system will then look at the accountant’s permissions to check that they have approval to access the file in question. It may well be the case that the accountant has been given permission to access the file as it is one they have been tasked to work on, and so after this step they will be able to access the file correctly. However, it may be that the accountant should not be able to access this particular file (it may for instance be a building rental bill, which this customer sales accountants does not need to be able to access), and the user may be prevented from accessing this file. This model should ensure that only people who DO have access to a given file are able to access it, providing good security for all of our data. As part of this system, read/write file permissions are also managed. Someone cannot may changes to a file that is of a different classification to what they need to be working on. The “Simple Security Property” prevents read up, meaning that for instance a sales clerk would not be able to read customer information. It is possible that a discretionary access control policy could be added to this which would allow for the clerk to be able to append to the file (e.g. adding details of a sale) while still not being able to read the entire file’s contents. The “Star-Property” of the Bell-LaPadula model prevents writing down. This could help to ensure the integrity of our data from internal corruption. For instance, an unscrupulous manager that is disappointed in their employees sales statistics would be able to read them, but would be prevented from editing them in any way. This system would also allow for the presence of “trusted users”, which are able move outside of the normal user constraints. This role would be reserved for IT staff such as system administrators, however.
One of the main reasons that our organisation decided to use the cloud for hosting data and for infrastructure as a service was due to our rapid expansion. At the time it was hard for us to estimate how fast our growth rate would be, and so the dynamic sizing afforded by cloud computing was very useful to us. However, in these post-recession times, our company has ceased its rapid growth. Although we are still very profitable, we have not built any new offices in the past 7 years, and our numbers of people employed have remained fairly constant. Our rate of sales are fairly constant (apart from the expected spikes in the run-up to Christmas), and it seems that it would no-longer be hard for us to make estimates of how much data we will need to be storing in the foreseeable future. The Data Protection Act compels us to store customer data until it is no longer needed (ico, n.d.). However, the measure of how long we need to store data for is a grey area. When a customer registers for an account with us, we may be holding on to their data indefinitely. We also need to hold information on guest account purchases in-case of any future disputes such as returns. A review should be done in to how long we should be holding customer information for, under the advice of corporate lawyers. We may also want to be storing other pieces of information in the long-term, such as historical sales data. We will need to make calculations of all of these factors, and extrapolate how the amounts of storage space required may change in the future to calculate our exact storage space.
Although there is no immediate reason for us to move away from making use of external infrastructure as a service, we may also wish to make some calculations as to how expensive it would be to convert our current thin-client based system to each user having their own standalone system. It may prove that this would be the less-secure option, due to the increased risk in people being able to gain access to systems. With our current thin-client systems, employees are only able to activate the machine if their ID card is inserted in to the machine. If we moved to standalone machines, this level of authentication may not be required. There is also the consideration as to the risks associated with standalone machines, such as the implications of having data stored locally to the machines. If employees were provided with laptops to support the types of flexible working already afforded in our office by the thin-client machines, then they may be tempted to take them off site where they would be more susceptible to attack. In essence, the level of physical security provided by our facilities would be removed. It may be possible that laptops could be provided to employees using thick-client systems, in which they will still have to use ID cards to access the machines. In these thick-client systems, the bulk of the processing would be performed on the client rather than on a server. This could allow for us to minimise our infrastructure as a service usage, or even move it to be entirely internal. However, as previously stated, this should not be our prime focus- it is only our data storage capabilities that are in urgent need of re-evaluation. It is just worth considering this as an option if we do elect to move to local data storage, as data centres to host our own processing servers could be planned for simultaneously.
Overall, it does seem that bringing our cloud computing capabilities in-house may be more trouble than it’s worth. The initial cost overheads of setting up data centres will be quite great, as it seems likely that we will not be able to completely re-purpose existing infrastructure for use as data centres. We would also have to re-evaluate the physical security of our buildings if we were to do so. Currently we have carded access to all buildings and a policy that encourages employees to challenge the identity of anyone that is not displaying their ID card, but this would not be sufficient for a data centre. We would likely need to investigate having security personnel patrolling the centre, as well as more comprehensive CCTV coverage than we currently do. The digital security of our data would also be quite problematic. Currently, our data security and transfer security is managed by external companies, which have staff dedicated to constantly monitoring security threats and ensuring that all of our systems kept up to date. It would be unfair of us to shift such responsibility to our existing IT/network administration teams, and so we would be looking at employing more a dedicated computer security team. Our data storage providers are able to employ very high class security experts to maintain their systems, and as such none of our providers have yet to suffer a breach. It seems to in bringing our capabilities in-house, we would be putting customer data at risk. If we were to even experience teething problems in getting our new solution set-up, we could potentially be looking at a breach that could result in massive fines on our part. In our current situation, in the event of a breach, responsibility for it may not automatically fall on us (Hughes, 2014). It would of course be a terrible thing, but we may be protected from some legal repercussions if we took all reasonable security measures (including verifying the credentials of our suppliers), and the supplier was found to be entirely responsible for the breach. In the event that we are storing data in-house however, the complete onus would be on us. That said, we would still lose credibility in the eyes of our customers in the event of a breach, and so we should attempt to vet any potential new suppliers to the best of our abilities (perhaps even making use of third party consultants to perform testing). Finally, we would be quite likely to experience a loss in sales (perhaps even having to take our online shops offline) for the duration of the switch. This will also occur if we do decide to switch cloud providers, but hopefully to a lesser extent. We would need to investigate the data transfer mechanisms available to us if we are to switch provider or even to local storage, as it may be possible for us to pre-transfer all of the data and have two instances of it “running” simultaneously for a smoother switch. It is also possible that retrieving the data from our current provides may be a very time consuming process depending on if we would have to digitally download the data, or if some sort of solution such as the shipping of the physical discs that are data is currently stored on is available.
Conclusions
It is hard to be able to predict the exact fall outs of the Safe Harbour ruling, and so it is impossible to say precisely what actions should be taken. However, investigation of our options should be undertaken immediately, so that we can quickly react to any new rulings or recommendations that are made. It would be preferable for our organisation to continue to make use of cloud computing solutions for both our data storage and our computing needs, but we must be ready to make alterations to our current data storage methods if needed. The most likely change required by the organisation would be to change the geographic locations in which our data is stored, which could potentially require us to change data storage providers. The security of our customer’s data is key crucial to our business, and we need customers to have trust in our ability to safely and securely manage their data. Because of this, we must be ready to make any changes that are required once future recommendations are released.
Bibliography
References
Amazon, n.d. Global Infrastructure. [Online]
Available at: https://aws.amazon.com/about-aws/global-infrastructure/
[Accessed 02 11 2015].
Baker, J., 2015. Safe harbour ruling: RELAX, Facebook and Google will be FINE!. [Online]
Available at: http://www.theregister.co.uk/2015/10/06/safe_harbour_aftermath_schrems_eu_us_data_sharing/
[Accessed 02 11 2015].
Beal, V., 2006. The Differences Between Thick & Thin Client Hardware. [Online]
Available at: http://www.webopedia.com/DidYouKnow/Hardware_Software/thin_client.asp
[Accessed 03 11 2015].
Bell, D. & LaPadula, L., 1976. Secure Computer System: Unified Exposition And Multics Interpretation, Bedford, Massachusettes: United States Air Force.
Cloud Architecture, 2015. EU Safe harbour ruling & how that affects Salesforce. [Online]
Available at: http://www.radnip.com/eu-safe-harbour-ruling-how-that-effects-salesforce/
[Accessed 02 11 2015].
Diffen, n.d. Common Law vs. Statutory Law. [Online]
Available at: http://www.diffen.com/difference/Common_Law_vs_Statutory_Law
[Accessed 30 10 2015].
DukeP, 2015. Ars Technica Forum. [Online]
Available at: http://arstechnica.com/civis/viewtopic.php?p=29944607&sid=b2c0391698a9de48e0bbbaa2e9e2053b#p29944607
[Accessed 02 11 2015].
Export.gov, n.d. U.S.-EU SAFE HARBOR LIST. [Online]
Available at: https://safeharbor.export.gov/list.aspx
[Accessed 04 11 2015].
Export.gov, n.d. Welcome to the U.S.-Swiss Safe Harbor. [Online]
Available at: http://export.gov/safeharbor/swiss/
[Accessed 02 11 2015].
Google, 2015. Privacy reminder from Google. [Online]
Available at: https://support.google.com/accounts/answer/6227261?hl=en
[Accessed 02 11 2015].
Harkness, V., 2015. Security models for information security. [Online]
Available at: https://www.vicharkness.co.uk/2015/10/15/security-models-for-information-security/
[Accessed 03 11 2015].
Hughes, J., 2014. Data Breaches in the Cloud: Who’s Responsible?. [Online]
Available at: http://www.govtech.com/security/Data-Breaches-in-the-Cloud-Whos-Responsible.html
[Accessed 03 11 2015].
ico, n.d. Retaining personal data (Principle 5). [Online]
Available at: https://ico.org.uk/for-organisations/guide-to-data-protection/principle-5-retention/
[Accessed 03 11 2015].
Kelion, L., 2015. Schools given Dropbox guidance after Safe Harbour warning. [Online]
Available at: http://www.bbc.co.uk/news/technology-34646146
[Accessed 30 10 2015].
Pham, T., 2013. How Safe Harbor Affects Cloud Service Providers. [Online]
Available at: http://resource.onlinetech.com/how-safe-harbor-affects-cloud-service-providers/
[Accessed 03 11 2015].
Salesforce, 2015. Privacy and Data Protection Questions and Answers for Salesforce Customers. [Online]
Available at: http://www.salesforce.com/company/privacy/data-processing-addendum-faq.jsp
[Accessed 02 11 2015].
Sawers, P., 2015. European court rules the U.S. ‘Safe Harbor’ data-sharing pact is invalid. [Online]
Available at: http://venturebeat.com/2015/10/06/european-court-rules-the-u-s-safe-harbor-data-sharing-pact-is-invalid/
[Accessed 30 10 2015].
Schiff, J. L., 2014. 9 Things You Need to Know Before You Store Data in the Cloud. [Online]
Available at: http://www.cio.com/article/2377060/cloud-computing/9-things-you-need-to-know-before-you-store-data-in-the-cloud.html
[Accessed 03 11 2015].
Smith, D., 2015. The US Safe Harbor – breached but perhaps not destroyed!. [Online]
Available at: https://iconewsblog.wordpress.com/2015/10/27/the-us-safe-harbor-breached-but-perhaps-not-destroyed/
[Accessed 30 10 2015].
Additional Reading
Beal, V., 2006. The Differences Between Thick & Thin Client Hardware. [Online]
Available at: http://www.webopedia.com/DidYouKnow/Hardware_Software/thin_client.asp
[Accessed 03 11 2015].
Cloud Architecture, 2015. EU Safe harbour ruling & how that affects Salesforce. [Online]
Available at: http://www.radnip.com/eu-safe-harbour-ruling-how-that-effects-salesforce/
[Accessed 02 11 2015].
Pham, T., 2013. How Safe Harbor Affects Cloud Service Providers. [Online]
Available at: http://resource.onlinetech.com/how-safe-harbor-affects-cloud-service-providers/
[Accessed 03 11 2015].
Schiff, J. L., 2014. 9 Things You Need to Know Before You Store Data in the Cloud. [Online]
Available at: http://www.cio.com/article/2377060/cloud-computing/9-things-you-need-to-know-before-you-store-data-in-the-cloud.html
[Accessed 03 11 2015].
[…] wrote a paper on the Schrems I case several years ago, and last year found myself correcting lawyers on a panel when they attempted to talk about […]