Cloud Security Alliance Releases First Guidelines for Cloud Service Providers Delivering Services in the European Union

CSA Privacy Level Working Group Encourages Adoption Worldwide as a Powerful Self-regulatory Tool for Data Protection Transparency and accountability in the Cloud

RSA CONFERENCE – San Francisco, CA – February 25, 2013 - The Cloud Security Alliance (CSA) Privacy Level Agreement (PLA) Working Group today released the Privacy Level Agreement (PLA) Outline for Cloud Service Providers providing services in the European Union. The Outline provides a structure for Cloud Service Providers (CSP) to disclose, in a consistent matter, information about the privacy and data protection policies, procedures and practices used when processing personal data that customers upload or store in the CSP’s servers. Once a PLA outline is completed by a CSP, it will provide current and potential customers with a new tool to assess that CSP’s disclosure of its practices. “The adoption of the PLA Outline by cloud service providers worldwide can be a powerful self-regulatory harmonization tool,” said Daniele Catteddu, EMEA Managing Director of CSA. “Our intention is that the outline will help cloud customers obtain a clearer view of their CSPs’ privacy and data protection practices. This knowledge, in turn, will allow companies to evaluate the extent to which the use of a particular CSP will allow them to achieve compliance with applicable data protection laws, including, in particular, their transparency and accountability obligations, a positive shift for both the customer and provider alike.” Key elements covered in the outline include:

• Cloud customer internal and external due diligence
• Categories of personal data that may be uploaded to the service
• Ways which data should be processed in the cloud
• Data location, transfer, retention, monitoring and security measures
• Personal data breach notification
• Data portability, migration, and transfer back assistance
• Accountability
• Law enforcement access
• Remedies

The CSA PLA Working Group was formed in 2012 to help transpose the Art. 29 WP and EU National Data Protection Regulators’ recommendations on Cloud Computing into an easy to use outline that CSPs can use to disclose personal data handling practices. The scope and objective of the PLA Initiative was previously presented to the European Parliament as part of discussions on the potential effect of the proposed General Data Protection Regulation on the cloud computing market, held last fall in Brussels. Since then, the PLA Working Group has been working to define a structured method for communicating the level of privacy measures that a CSP agrees to maintain while hosting personal data on behalf of its customers. The PLA Working Group is comprised of independent privacy and data protection subject matter experts, privacy officers, and representatives from Data Protection Authorities. Organizations interested in PLA sponsorship opportunities can learn more by downloading the PLA Initiative Research Sponsorship Outline. About the Cloud Security Alliance The Cloud Security Alliance is a not-for-profit organization with a mission to promote the use of best practices for providing security assurance within Cloud Computing, and to provide education on the uses of Cloud Computing to help secure all other forms of computing. The Cloud Security Alliance is led by a broad coalition of industry practitioners, corporations, associations, and other key stakeholders. For further information, visit us at www.cloudsecurityalliance.org, and follow us on Twitter @cloudsa. Media Contact: Kari Walker [email protected] 703.928.9996