On the basis of the explanations set out in the above sections, it can be concluded that the legal systems of the European countries show numerous significant differences, and provide different country-specific administrative duties, which may often cause substantial legal and practical problems for cross-border service providers on the internal market (especially in the online environment). Therefore, according to the EU Commission, further harmonization of national data protection systems in the member countries is necessary in order to ensure a consistent level of protection for individuals throughout the European Union and to prevent divergences hampering the free movement of personal data within the internal market.

As the result of long discussions, the EU Commission published on the 25th of January 2012 its proposal for a Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Although the proposal of the EU Commission is at its current stage only a draft, we can already have a good insight how the current practice of companies with regard to personal data processing may be affected by the concept of the new regulation. In the context of cloud computing the compliance with most of the new legal provisions may be of great importance both for cloud users (as a data controllers) and for cloud providers (as technical data processors). Especially the new uniform rules regarding the legal basis of data processing, and the requirement of implementation of appropriate technical and organizational measures and procedures in the data processing (so-called "privacy by design"), or the restrictions applicable for transferring personal data into third countries outside the EU should be mentioned at this point, as these rules may have a significant effect on the current practice of cloud service providers and customers. The purpose of the following summary is to give an overview on the most important provisions of the new EU data protection regulation.

1Currently, the EU Directive No. 95/46/EC is the most important instrument of the European harmonization of data protection law that should be replaced by the new regulation.

Legal nature and scope of the new regulation

In contrary to the currently effective EU Directive the new harmonization of the EU data protection system would be achieved in form of a regulation. The difference is that a regulation is directly applicable and binding for companies even without implementation by the national legislative bodies. This means that the new rules of the future General Data Protection Regulation will also apply if the national laws themselves do not contain equivalent provisions.

According to the draft the new General Data Protection Regulation shall be applied with some exceptions to any type of processing of personal data. A major difference between the current and the expected new European data protection system is that the new regulation will also apply to companies established outside the EU, which are processing personal data of data subjects resided in the EU and the data processing is related to the offering of goods or services to such data subjects in the EU or to monitoring their behaviour. Due to this extra-territorial scope of the new regulation cloud providers having their headquarters outside the EU, but offering their services to EU citizens should also comply with the rules of the new regulation.

The most important principles of design

Consent and Purpose

The principle of necessity of prior consent and a specific appropriate purpose as the main conditions of lawful data processing will be the most important requirements for data processing in every member country of the European Union. An implied consent of the data subject will not be sufficient, according to the new regulation data subjects shall give their expressed consent in possession of all information related to the specific data processing. In light of these requirements, for example data processors providing online services shall make sure, that their clients express their consent to the data processing in an appropriate and provable way before using the services, and in addition service providers shall make the most important information regarding the data processing easily accessible to their clients. It is important to note that in case of doubt, the data processor shall prove that the data subjects have given appropriate consent to the processing of their personal data.

While the collection of personal data without a specific purpose is in many European countries (e.g. Hungary and Germany) already prohibited, this limitation will be applicable throughout the whole European Union according to the new regulation. Personal data shall be processed only for exactly defined, explicit and legitimate purposes and only if the purpose of processing cannot be achieved without processing the given personal data.

'privacy by design and by default ", transparency of data processing

The principle of "privacy by design and by default” is probably one of the most important requirements of the new regulation for data controllers and technical data processors. The aim of the implementation of this requirement is to ensure that data protection safeguards are considered already in the planning phase of processes and systems regarding data processing. Therefore, according to the proposal companies should both at the time of determining the means for processing and at the time of the actual processing implement and use appropriate technical and organizational measures and procedures to ensure the compliance with the provisions of the General Data Protection Regulation.

In addition to the above the draft regulation requires further organizational duties on the side of the data controller and the technical data processor in order to ensure the transparency of data processing. Such requirement is that the data controller or technical data processor shall have transparent and easily accessible policies with regard to the processing of personal data and the exercise of data subjects' rights under the provisions of the regulation. In the course of data processing data controllers should always be able to prove that the personal data have been processed in compliance with the regulation. In certain cases, the data controller and technical data processor are even required to obtain prior authorization for planned data processing from the competent national supervisory authority.

Furthermore, companies employing 250 or more employees will be obliged to appoint a data protection officer. The officer shall - among other tasks - monitor the implementation and application of the regulation and the policies of the data controller or the technical data processor in relation to the protection of personal data, including the assignment of responsibilities, the training of staff involved in the processing operations, and the related audits.

Data controllers should also be prepared to be able to inform the supervisory authority (and in some cases, even the affected data subjects) in the event of a personal data breach within 24 hours after having become aware of it. In case the breach occurs during the activity of the commissioned technical data processor, it shall immediately alert the data controller.

Right to be forgotten

The "right to be forgotten" principle introduced by the new regulation will enable the persons concerned that they may request the immediate deletion of their data by the data controller, for example, if the person withdraws his consent or the data are no longer necessary in relation to the purposes for which they were collected. According to another provision of the draft regulation, where the data controller has made the personal data public, it shall take all reasonable steps, including technical measures, in relation to data for the publication of which the controller is responsible, to inform third parties which are processing such data, that a data subject requests them to erase any links to, or copy or replication of that personal data. Furthermore, where the data controller has authorized a third party publication of personal data, the first data controller shall be considered responsible for that publication. Especially these above mentioned two strict provisions may cause significant practical and technical difficulties to data controllers, if they would like to comply with such request of the data subject.

Data Portability

According to the proposal, data controllers and technical data processors will have the obligation to provide an easy access for the data subjects to their own personal data. According to the draft regulation, the data subjects shall have the right to obtain from the data controller a copy of their personal data in an electronic and structured format which is commonly used and allows for further use by the data subject.

"One-Stop-Shop"


In contrary to the above mentioned strict provisions, the new uniform rules regarding the international competency of national supervisory authorities may be a relief for cross-border service providers. Currently, it means usually significant practical difficulties and uncertainties for multinational companies that their processing activity is supervised by different authorities in different EU countries (with different rules of procedure). According to the draft regulation only one single national data protection authority shall be responsible in the future for supervising the data processing activity by the given company throughout the whole EU under the same procedural rules. The competent authority for such “one-stop shop” control should be the supervisory authority of the country in which the data controller or the technical data processor has its main establishment.

Some other important comments regarding the application of new EU General Data Protection Regulation for cloud computing services


Data controllers would be able to use a third party agent (technical data processor) for processing the personal data also under the new regulation. The proposal, however, contains many new provisions with respect to such data processing on behalf of the data controller, and in certain cases even the commissioned data processor may have direct financial responsibility with regard to its processing activity. Numerous duties binding currently directly only the data controller, will find direct application also on the data processor. Therefore, in case the cloud provider as data processor fails to comply with its obligation to implement appropriate and adequate technical and organizational measures for ensuring the security of personal data during data processing, a fine may be directly imposed to the processor by the supervisory authority.

The new regulation also contains several new rules regarding transferring data into third countries outside the EU, which may affect cloud providers with servers in the USA, India or China in the first place. Generally, transferring personal data into a third country will be only possible, if the EU Commission has determined that the third country provides adequate protection for personal data. Such data transfers do not require further approval by the supervisory authority. If there is no positive assessment of the EU Commission regarding a third country, the personal data may be transferred only with additional guarantees and safeguards to such third country. According to the draft regulation such guarantees may be provided particularly by using binding corporate rules ("binding corporate rules") or standard protection clauses adopted by the Commission or by the supervisory authorities.

To ensure that companies will take the provisions and restrictions of the new regulation and the importance of data protection seriously, according to the proposal companies will face substantial sanctions in case of violation of the requirements of the regulation. For example, in case of a willful or negligent violation of essential rules of the regulation, the supervisory authorities may impose fines of up to 1 million Euros, or in case of a company, the fine may amount even up to 2% of the annual global turnover of the company according to the draft regulation. The amount of the administrative fine shall be fixed with due regard to the nature, gravity and duration of the breach, the intentional or negligent character of the infringement, the degree of responsibility of the given person and of previous breaches by this person.

The above mentioned provisions are currently still in draft status and according to the expectations, several changes and modifications shall be made to the current text of the proposal before the regulation reaches its final form and enters into force approximately in 2015 or 2016. However, it is also assumed that most of the general principles should not change significantly. Therefore, cloud users and cloud providers should closely follow the further developments of adopting and finalizing the new EU data protection regulation, and they should be already prepared to adapt their practice and their contracts to the expected requirements provided by the new uniform EU data protection system, in order to avoid potential future fines.