ABSTRACT
Effective protection of individuals under the EU’s General Data Protection Regulation (‘GDPR’) depends mainly on the ‘accountability’ of one or more persons, usually organizations, for ensuring compliance with relevant obligations. As we will see, identifying the ‘controllers’, ‘joint controllers’, and ‘processors’ of personal data in cloud supply chains can be challenging, especially where arrangements are dynamic and there are overlapping responsibilities. Moreover, the requirements for a customer of a cloud service, as the controller of personal data, to give detailed written ‘instructions’ to the cloud provider, as processor, may make little sense in the context of commoditized services where the provision of such specific instructions by each customer may be neither feasible nor appropriate.
Kamarinou, Dimitra and Millard, Christopher and Turton, Felicity, Responsibilities of Controllers and Processors of Personal Data in Clouds (May 2021), chapter 9 in C Millard (ed), Cloud Computing Law, (2nd ed, OUP 2021).
Leave a Reply