Patrick Sefton | Principal

1. Privacy and data control in the era of cloud computing Patrick Sefton| Principal

2. Outline “cloud computing” definition & examples information privacy compliance requirements pre-contract enquiries / capability questions contracts (including GITC in particular) standards & certifications ongoing contract management & reporting

3. “Cloud computing” Many names, slightly different meanings data / application hostingICT managed servicesASP / software-as-a-serviceplatform-as-a-serviceinfrastructure-as-a-serviceutility computing but the same concept:ICT capabilityprovisioned remotely, delivered as a servicewith abstraction of detail

4. ← less of this more like this... →

5. ...connected tothese →

6. Commercial & technical drivers ubiquitous high-speed communications leverage economies of scale cost of supporting infrastructure & redundancy energy costs reduce capital expenditure flexibility / agility rapid provisioning / dynamic scalability

7. Example: Microsoft Steve Ballmer, 4 March 2010: “literally I will tell you we’re betting our company on it.”

8. Example: Google Google Apps (Office workalike, email, storage) USD50/user/year 2M+ clients, including significant government clients eg City of Los Angeles, City of Washington DC • Google AppEngine • Run private software onGoogle’s infrastructure • Spanner (announced October 2009) • storage and computation system which spans all datacentres & scales to 10M+ servers, 1B+ clients

9. The devil is in the details so ... ICT capability is provided as a service,the details are abstracted and the cost is downso everyone’s happy? but ... some of those about-to-be-abstracted-away details are really important information privacy and data control are important details that need to be addressed up front in cloud computing arrangements statutory essentials pre-contract enquiries contract terms

10. IPA & service providers to agencies special provisions about agencies entering service arrangements if service provider performing agency function... s35: agency must take all reasonable steps to ensure service provider required to comply with IPPs/NPPs as if it was the agency s36: “bound contracted service provider” required to comply with IPPs/NPPs (attracts complaint, approval, compliance mechanics of IPA) s37: failure to bind → agency still has obligation

11. IPA section 35 s35: agency must take all reasonable steps to ensure service provider required to comply with IPPs/NPPs as if it was the agency essential minimal requirement for departments & agencies – a low water mark easy to include: The Contractor must comply with Parts 1 and 3 of Chapter 2 of the Act, as if it was the Customer, in relation to the discharge of its obligations under this agreement.

12. IPA & cross-border transfers special provisions about cross-border transfers by agencies (s33) consent, or at least 2 of the following: equivalent treatment necessity individual benefits, consent impracticable & likely reasonable steps to protect

13. Service providers & the Cth Act private sector has no provision like s35 IPA: you’re on your own is the service provider governed by the Act? $3M turnover threshold s6D(4)(c) & (d): collecting/disclosing for payment should contractor “opt in”? (s6EA) otherwise, contract terms equivalent to NPPs

14. Pre-contract enquiries What questions should we ask a potential cloud computing service provider? location of provider, data (including backups)deletion & disposal process? who has access? what access controls are used?are any subcontractors involved? insolvency of supplier? ease of transfer to another supplier? single- or multi-tenanted servers? supplier’s own privacy & security policies (incl. physical security)awareness of compliance mechanics of IPA reporting / notification / breach response standards compliance & certifications, audit reports?

15. Contract terms is GITC sufficient? cl 5.4: broad confidentiality terms cl 5.5: broad privacy terms can obtain deed of confidentiality / privacy from subcontractors, but only if not reasonably satisfied proper practices in place(query whether this is done as a matter of course) a good start, but what about ...

16. Contract terms what about... supplier’s responses to pre-contract enquiries (incorporate them) more detailed action in response to security / privacy breachpromptness & detail of reportinformation about security / privacy breaches for other clientsaudit right (electronic & physical practices) or periodic audit awareness of personnel who have access (with ongoing updates) disposal / return of records regular reporting freedom to move (incl. return of data in standard format) limitation of liability: does the normal position work?

17. Standards & Certifications FISMA: a framework for managing information security under Federal Information Security Management Act of 2002 (US) HIPAA: standards for eHealth transactions under Health Insurance Portability and Accountability Act of 1996 (US) extended by HITECH: Health Information Technology for Economic and Clinical Health Act 2009 (US) SOX: Sarbanes-Oxley Act of 2002 (US) (public companies) &Basel II: international standard for risks in financial sector PCI DSS: Payment Card Industry Data Security Standard SAS70: Statement on Auditing Standards No.70: an accounting standard to assess internal controls within a service organisation ISO15489: int’l standard for record and information managementISO27001: int’l standard for information security systems access to audit/certification reports?

18. Ongoing management Don’t forget ongoing management periodic reporting: review & act on issues options under contract including audit, further deed internal process for privacy breaches co-operative & transparent management of privacy complaints and investigations appropriate escalation of issues:privacy a critical reputational & political risk

19. Thank you. Patrick Seftonpatrick.sefton@brightline.com.au