Europe: avis sur l'infonuagique

Le 1er juillet, le Groupe de l'article 29 a publié un avis sur l'infonuagique: Opinion 05/2012 on Cloud Computing dans lequel il est notamment fait mention 

• des risques quant à la protection des données personnelles (manque de contrôle et d'informations quant au processus), 
• du cadre légal applicable (i.e. Directive 95/46/CE, Directive 2002/58/CE révisée par 2009/135/CE), 
• des devoirs et responsabilités de chacun des intervenants, 
• des exigences quant à l'encadrement des données (i.e. transparence, limitation d'utilisation, sécurité, confidentialité, disponibilité, intégrité, responsabilité), 
• de la problématique des transferts internationaux. 

Dans sa conclusion, le Groupe insiste sur le fait que

"Businesses and administrations wishing to use cloud computing should conduct, as a first step, a comprehensive and thorough risk analysis. This analysis must address the risks related to processing of data in the cloud (lack of control and insufficient information) by having regard to the type of data processed in the cloud. Special attention should also be paid to assessing the legal risks regarding data protection, which concern mainly security obligations and international transfers. The processing of sensitive data via cloud computing raises additional concerns. Therefore without prejudice to national laws such processing requires additional safeguards. The conclusions below are meant to provide a checklist for data protection compliance by cloud clients and cloud providers based on the current legal framework; some recommendations are also provided with a view to future developments in the regulatory framework at EU level and beyond [il en va notamment ainsi des points suivants: "better balancing of responsabilities between controller and processor", "access to personal data for national security and law enforcement purposes", "special precautions by the public sector", "European Cloud Partnership""

(Source: Opinion 05/2012, p. 19 et 23)

Pour plus de détails, 

• ARTICLE 29 DATA PROTECTION WORKING PARTY, Opinion 05/2012 on Cloud Computing, WP 196, July 1st, 2012.