EU Leaders Want Cloud Computing Security Regulations

European leaders want worldwide legislation on data protection to improve the security of cloud computing.

Speaking in front of an audience of law experts at the Council of Europe's annual Octopus conference, Francesco Pizetti, the president of the data protection authority of Italy, called for greater harmonisation of cybercrime regulations.

Pizetti said that data security legislation needed to be changed to take account of cloud computing changing the legal basis on which personal data is handled by organisations.

"It is not possible to continue to guarantee the protection of citizens' data without very strong international rules accepted by all countries around the world," Pizetti said.

Cloud computing risks

Udo Helmbrecht, executive director of the European Network and Information Security Agency (ENISA), added that his agency was aware of the cloud computing risks and would be working to create Europe-wide regulation for cloud providers. "We need to build trust into the cloud. If we don't build trust into this environment, the business model will not run," said Helmbrecht.

Particular data security risks identified with cloud computing were government requests for data and determining who holds the legal authority to make information requests. Attendees felt the international nature of cyber crimes such as hacking and fraud means co-operation on gathering evidence and bringing prosecutions is essential _ hence the moves to create legislation to secure the cloud.

"We don't have a lot of good rules and structures for doing that sort of thing," commented Jim Reavis from the Cloud Security Alliance, adding: "there's a lot with the technology of cloud that we need to secure."

Pizetti commented that the Council of Europe's Convention on Cyber Crime would create an international system of regulation that would help to secure the cloud. Jorg Polakiewicz, head of law reform at the Council of Europe, said both the Convention of Cyber Crime and the Council of Europe's Data Protection Convention were being updated to take account of new technologies such as cloud computing.

Source - Security International's UK Correspondent

Information security