CSA releases tool for personal data legal protection
At Infosecurity Europe 2015, the Cloud Security Alliance (CSA) Privacy Level Agreement (PLA) Working Group released the Privacy Level Agreement (PLA) v2, a tool that provides cloud customers and potential customers, of any size, with a mechanism to identify a baseline of mandatory personal data protection legal requirements across the EU.
It also allows cloud customers the ability to evaluate the level of personal data protection offered by different cloud service providers (CSPs). PLA v2 also addresses the needs of CSPs by providing a guidance to achieve compliance with mandatory privacy legislations across the EU and a simple way to disclose, in a structured way, the level of personal data protection that they offer to customers.
“The continued reliance and adoption of the PLA by cloud service providers worldwide has been an important building block for developing a modern and ethical privacy-rich framework to address the security challenges facing enterprises worldwide,” said Daniele Catteddu, EMEA Managing Director of CSA. “This next version that addresses personal data protection compliance will be of significant importance in building the confidence of cloud consumers.”
Initially released in 2013, the PLA provides a structure for CSPs to disclose, in a consistent matter, information about the privacy and data protection policies, procedures and practices used when processing personal data that customers upload or store in the CSP’s servers. The updated release provides CSPs not only with a mechanism to support transparency but also, and most importantly, with a tool to achieve compliance with the EU-wide personal data protection legislations. It also provides cloud customers with a tool to understand and evaluate CSP EU-wide personal data protection compliance.
Key elements covered in the PLA v2 are:
- Identity of the CSP, its role, and the contact information for the data protection inquiries
- Ways in which the data will be processed
- Data transfer
- Data security measures
- Monitoring
- Personal data breach notification
- Data portability, migration and transfer back assistance
- Data retention, restitution and deletion
- Accountability
- Cooperation
- Legally required disclosure.
“PLA V2 is a valuable tool to guide CSPs of any size to address EU personal data protection compliance,” said Dr. Paolo Balboni, Co-Chair of the PLA Working Group, top tier European ICT, Privacy & Data Protection lawyer, Founding Partner of ICT Legal Consulting. “In a market where customers still struggle to assess CSP data protection compliance, PLA v2 aims to fill this gap and facilitate customer understanding.”