Cloud Computing And Data Protection - A Legal Perspective
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
CLOUD COMPUTING AND DATA PROTECTION: A LEGAL
PERSPECTIVE
Sumanth Ravi, Sastra Deemed University
ABSTRACT
A potent paradigm known as "cloud computing" has surfaced, offering online users on-demand access to pooled computer resources including processing power, storage, and software. Due to its unmatched costeffectiveness, scalability, and flexibility, it is becoming more and more wellliked by both people and enterprises. To maintain the confidentiality, integrity, and availability of data and services in the cloud, security concerns have grown in importance as cloud computing becomes more and more used. Data privacy, access control, data integrity, compliance, legal concerns, identity and access management, and risk assessment are just a few of the many security difficulties it covers. It is imperative to tackle these obstacles in order to guarantee the credibility and dependability of cloud computing settings.
To guard against possible cyber threats, insider assaults, and other security hazards, organizations must have strong security measures in place for their sensitive data and vital applications. In order to protect the data of their clients and guarantee adherence to pertinent laws and guidelines, cloud service providers must also have strong security measures in place. The article addresses emerging themes such the rising acceptance of secure enclaves, confidential computing, risk assessment, and access control, as well as the increased attention on data localization regulations. Last but not least, it offers suggestions for handling data privacy and compliance concerns, which are crucial for businesses to take use of cloud computing's advantages while safeguarding sensitive data and honoring their moral and legal obligations.
INTRODUCTION
The way we live, interact, and do business has changed dramatically since the turn of the twenty-first century. Our work, pleasure, and interactions with the outside world have all changed dramatically as a result of the unprecedented connectedness and ease that digital technology have brought to almost every aspect of modern life. We have seen how quickly smart phones are becoming commonplace in this digital age, how quickly the Internet of Things (IoT) is expanding, and how big data analytics and cloud computing are having a significant influence. These technological wonders have ushered in an unparalleled era of interconnection, allowing us to control our lives with a few taps on a screen, interact instantly across continents, and access a plethora of information. In this sort of technical era, cloud computing plays a vital role in storage of large amount of data.
This paper deals the challenges encountered by the service providers towards the protection of privacy and personal datas of the users and also the some of the privacy laws used in countries which acts as a watch dog over the data handling and security related issues emerging from cloud computing.
RESEARCH
METHODOLOGY
A. RESEARCH PROBLEM Despite the growing adoption of cloud services, there are inadequate robust mechanisms and consistent global standards to ensure the security and privacy of data stored and processed in the cloud.
B. RESEARCH
OBJECTIVE
Objective
of the paper is to provide suggestions for a better regulatory mechanism covering all aspects of the cloud both at national and international level. C. RESEARCH QUESTION
1. What security vulnerabilities exist in cloud infrastructures ?
2. How different countries laws regarding data storage and privacy effect on
cloud service?
3. How can integrated security framework that leverage emerging technology
help in addressing the various issues?
D. RESEARCH METHOD
Literature review
is used as the research method in this paper. This involves reviewing of previous published research papers, articles and analyzing their outcome.
1. Data confidentiality, Accountability and Integrity
Author: Bhadoria Cloud computing, a revolutionary approach in delivering on-demand resources, brings critical data privacy and security challenges that must be addressed to ensure the confidentiality, integrity, and availability (CIA) of cloud-stored information. Bhadoria (2015) highlights the CIA triad as fundamental to robust cloud security, emphasizing the need for stringent access controls and data protection to prevent unauthorized access. Organizations increasingly rely on cloud services, making secure, uninterrupted access essential to prevent operational disruptions. This research examines these security pillars, assessing how compliance, secure architectures, and access management can fortify data protection in the cloud.
2. Data Privacy and user concerns
Author :Mishra and Pandya This article explores the heightened concerns surrounding data privacy, particularly as cloud storage becomes more central to both personal and organizational operations. The vast storage of sensitive data raises significant privacy issues, compounded by the security challenges associated with Internet of Things (IoT) applications . Addressing these challenges requires innovative, privacy-preserving mechanisms to build and sustain user trust, ensuring that cloud environments are both secure and dependable for diverse applications and sensitive information.
3. Access Control Mechanism
Author: Kure et al. This paper highlights the essential role of access control in safeguarding cloud environments. Effective access control mechanisms, such as the blockchain-based framework proposed by Yang et al. (2020), offer enhanced privacy protection, demonstrating the potential of decentralized technologies to secure cloud data. Additionally, Kure et al. (2018) emphasize integrating cybersecurity risk management with access control strategies as crucial for defending against insider threats, which are significant to maintaining data integrity and confidentiality in cloud settings. Together, these approaches strengthen cloud security and bolster user trust.
4. Insider threats and substantial security challenges within cloud computing
environment Author: Ghafir et al. This paper addresses the significant challenge of insider threats and human factors in cloud security. Insider threats, as Ghafir et al. (2018) point out, are often exacerbated by human factors, with employees or contractors sometimes acting maliciously or negligently. This highlights the importance of comprehensive training and awareness programs designed to minimize these risks. By fostering a culture of security awareness, organizations can reduce vulnerabilities and protect the integrity of their cloud environments from internal threats.
5. Compliance and legal considerations
Author: Delimitrou and Kozyrakis This article highlights the critical need for compliance with regulatory frameworks to uphold data privacy and security. Organizations face the challenge of navigating varied legal landscapes, with jurisdictional inconsistencies complicating standardized security practices. Delimitrou and Kozyrakis (2014) suggest resourceefficient cluster management strategies that support compliance by optimizing resource use without compromising security. Such strategies are vital for organizations aiming to meet complex regulatory requirements while maintaining effective and secure cloud operations.
6. Legal entanglements of cloud computing
Author: Lipsa Dash and Sambhabi Patniak This article highlights the need for a regulatory framework for an effective protection of personal information that is collected, processed and transmitted by the cloud computing. It points out that Information Technology Act 2008 does not deal with the protection of data which is under the use of Data fiduciary. CLOUD COMPUTING Cloud computing is the term used to describe a method of data and information storage related to offering hosted services via the internet. It basically refers to the work that IT service providers undertake to provide a firm of end receivers with storage requirements as a service. Cloud computing is a technology that is expanding quickly and has a large market, providing a useful platform for sharing resources between individuals and businesses.
All parties involved—users, service providers, and the businesses in need of these IT services—are aware of the need to reduce the risks. Several cloud services are available, such as Google's Google File System (GFS), Amazon's storage cloud, Oracle Cloud, IBM, and Microsoft Azure. These services offer various functionalities such as infrastructure, platform, and software. Depending on the type of service and the service provider, consumers might receive these offerings for a fee orneed to pay charges for their services. The cloud is advantageous for organizational areas including IT, telecom, healthcare, hospitality, entertainment, and education, among others. Depending on the architectural model, the cloud can be public, private, or hybrid.
As cloud services are so easily accessible, flexible, and cost-effective for businesses, the technology is expected to increase exponentially in the future. They are more centralized, have tougher privacy regulations, and react to hacks and security lapses more quickly. When it comes to the utilization of advanced technological services, a select group of service providers have great confidence. Yet, with this remarkable digital transformation has emerged an intricate web of challenges and vulnerabilities.
SECURITY THREATS IN CLOUD COMPUTING1
An extensive array of processors, memory, software, and other resources linked to the Internet make up a cloud. With malicious intent, cyber attackers are always searching for security holes and cloud vulnerabilities. When a third party is involved in providing services that further impair the organization's firewall (security system) access, protection and security of software and data will be the primary issues. Knowing exactly where your system may be vulnerable and what to do to close any gaps and vulnerabilities is crucial. The following section discusses some of the most significant cyber security risks that might have an impact on a user's cloud computing services.
1. DATA BREACH
When it comes to cloud computing, this is the most common and straightforward hazard. The availability of vast amounts of data kept on cloud servers is a key draw for hackers, drawing them in. A key consequence of data breaches is that they might allow hackers to get unauthorized access to victims' cloud accounts, which can result in data loss or leaking. These breaches may reveal sensitive data, including bank account details, personal health information, an organization's intellectual property, etc., and may cause significant harm. Legal ramifications arise from data breaches since they violate contractual and legal duties.
2. DENIAL OF SERVICE
One frequent and harmful danger to cloud computing is the denial-of-service attack (DoS). One may not be able to stop DoS assaults entirely, as stopping them is typically not feasible. Attacks with denial of service (DoS) typically overwhelm a cloud service's resources, preventing customers from accessing services or data. By flooding the servers with excessive web traffic, this type of attack can force the cloud services to go down. As the foundation of any company, servers will be immediately impacted by a denial-of-service attack, which prevents them from being used for any type of processing or buffering. A DoS assault of this kind will destroy any firm that depends only on cloud services.
3. BOTNETS
These are malware programs called "robots," which invisibly infiltrate a system and enable an unauthorized user to remotely access and take control of it in order to do any kind of destructive behavior. Considering its dispersed platform, which may serve as a breeding ground for any cybercrime in the cloud, botnets are seen as a greater threat to cloud security than other forms of malware. By sending out millions of messages at once, for instance, a botnet may be used to spam any operating system. For the purpose of unlocking encrypted or password-protected data, an attacker can deploy botnets.
4. CRYPTO HIJACKING
It is a relatively new type of cyberattack that mines cryptocurrency, such as bitcoin. One's cloud system provides easy access for attackers to computer systems and resources, which might cause sluggish performance while the program is still running. As such, this attack's detection is difficult and may easily slip under the radar. Many people mistakenly think that their system is being crypto-jacked because of a processor problem or a poor internet connection.
5. INSIDER THREATS
It is widely held that one of the biggest risks to cloud services' cyber security is hackers and cybercriminals. It is startling to learn, though, that due of their special position and access to networks and systems, security risks can also arise from inside. As the term implies, dangers may come from within the organization. Insiders, such as personnel, workers, and administrators, may misuse their permitted access, or they may pose a threat due to their carelessness and mistakes. A malevolent insider can occasionally inflict more harm than an outside attacker. The malevolent insider might be a vengeful former employee or a current member of the firm, or an accessory with the credentials who willfully gains access to and misuses the guarded information.
As a result, firms must be vigilant and keep an eye out for any cyber criminal conduct perpetrated by their workers, as well as implement a full-proof offboarding procedure that ensures employees' access is revoked once they leave the organization.
6. HIJACKING OF ACCOUNTS
This is one of the most thoroughly investigated cybercrimes to date. Hijacking may be accomplished quickly using tactics such as phishing and password cracking, allowing cyber thieves to get access to a variety of accounts, including cloud services. Once hackers have gained secure access to accounts, they may simply cause havoc while users are ignorant of the crime. Basic approaches for mitigating the dangers involved with such assaults include proper training, permission control, and end user agreements. Organizations and celebrity cloud accounts are particularly vulnerable to such hijackings.
7. INSURE APPLICATIONS
Securing your own programs, systems, and networks is not always sufficient since a danger might come from an external source, even if purchased from a legitimate app store. Using a third-party service or application might pose severe cloud security concerns, even if the organization's infrastructure is well-protected against conventional cyber attacks. As a result, it is strongly advised that necessary precautions be taken before installing any third-party apps to ensure their viability and security on the organization's own network. It is not recommended for employees to download unlawful files without prior consent from the IT staff, as their primary responsibility is to secure client data.
8. INADEQUATE TRAINING
Employee carelessness in their actions has been observed to be the cause of a few cyberattacks. This may occur sometimes as a result of inadequate threat management or a lack of concern over cybercrimes. In light of this, experts recommend that all members undergo periodic training. This will provide them with current and sufficient knowledge and enable them to recognize cyber threats early on and take appropriate action, particularly with regard to cloud services. These are some of the technical threats to cloud computing which are tackled with different data protection and privacy laws implemented in different countries by setting up mechanisms which acts as a watch dog over data handling. REGULATORY FRAMEWORK
1. European Union
A comprehensive data protection regulation known as The General Data Protection Regulation was applied by the European Union on May 25, 2018. It affects any organization that gathers, handles, and keeps track of personal information belonging to EU citizens. Any information pertaining to a natural person who can be identified or is otherwise identifiable is considered personal data under the GDPR2. The General Data Protection Regulation (GDPR) classifies names, government ID numbers, and online identifiers like IP addresses, cookies, and device IDs as personal data.
The GDPR lays forth seven fundamental guidelines for handling personal data3: l Lawfulness, fairness and transparency l Purpose limitation l Data minimization l Accuracy l Storage limitation l Integrity and confidentiality l Accountability It ensures that individuals who provide personal information have certain rights, such as the right to information, the right to access, the right to rectification, the right to erasure ("right to be forgotten"), the right to restrict processing, the right to data portability, the right to object, and rights concerning automated decision making and profiling4. GDPR stipulates that in order for an organization to process personal data, it must have a legitimate legal basis.
Examples of these include getting explicit consent, carrying out a contract, abiding by the law, safeguarding vital interests, carrying out a public interest task, or pursuing legitimate interests that aren't competing with individual rights. . When relying on consent, it must be freely given, specific, informed and unambiguous Even stronger regulations
2 General Data Protection Regulation (GDPR), art. 4(1), 2016 O.J. (L 119) 1
3 General Data Protection Regulation (GDPR), art. 5, 2016 O.J. (L 119) 1.
4 General Data Protection Regulation (GDPR), arts. 12-23, 2016 O.J. (L 119) 1
apply to special categories of personal data, which include information about a person's health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, and information about their sexual orientation or sex life. GDPR has significant implication to be followed regarding cloud computing: l There are a number of duties pertaining to data subject rights, data retention, data security, breach reporting, and other matters that arise when cloud providers and their clients are regarded as data controllers and/or processors5. l As the data controller, the cloud client is responsible for making sure that the cloud provider will abide by GDPR regulations and that there is a legitimate reason for transmitting personal data to the cloud. Strong vendor due diligence and contractual protections are therefore required.
l Restrictions on cross-border data transmission are in place when personal information that originated in the European Union is sent to nations that aren't thought to offer sufficient data protection. Mechanisms such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or derogations for certain circumstances may still be used to facilitate transfers. 6 l Cloud providers are required to promptly notify clients of any data breaches, and there are rigorous deadlines for notifying supervisory agencies and data subjects of breaches7. l Data Protection Impact Assessments (DPIAs) are required by the data controller in situations where processing procedures pose a significant risk to the rights and freedoms of data subjects, such as when transferring sensitive data to the cloud.
These provisions ensures that the cloud service providers does not leak the personal data of its customers. 5 https://www. edpb. europa. eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controllerand-processor-gdpr_en
6 General Data Protection Regulation (GDPR), arts. 44-50, 2016 O.J. (L 119) 1
7 General Data Protection Regulation (GDPR), arts. 33-34, 2016 O.J. (L 119) 1.
2 United States
Unlike European Union, USA has various laws which regulate the personal data obtained by different sectors of the economy like hospitals, other business sectors. Some of the laws are California Consumer Privacy Act and Health Insurance Portability and Accountability Act. l California Consumer Privacy Act The primary application of this legislation is to businesses that are for-profit in California. It went into effect on January 1, 2020. Like the GDPR in the EU, the CCPA gives citizens rights such as the ability to seek the erasure of personal information, the right to know what personal information is collected, processed, shared, or sold, and the right not to be subjected to discrimination for exercising these rights8.
Customers have the right to ask a company to reveal the kinds and particular pieces of personal data it has gathered, the sources it used to gather the data, the reasons it was collected or sold for profit, and the kinds of third parties it shared the data with. 9 For cloud computing, key requirements under CCPA are: a. Identifying whether the business or its cloud provider is subject to CCPA based on the thresholds b. Determining what personal information is collected and stored in the cloud, and properly disclosing this in notices and privacy policies c. Putting processes in place to handle consumer access and deletion requests when data resides in the cloud d. Having contractual safeguards and due diligence to ensure cloud providers comply with CCPA obligations e. Understanding and complying with restrictions on the sale of personal information
8 Cal. Civ. Code §§ 1798.100, 1798.105, 1798.110, 1798.115, 1798.120, 1798.125
9 Cal. Civ. Code § 1798.110(a)
The California Privacy Rights Act (CPRA) was passed in addition to the CCPA. It modified the CCPA's provisions by creating a new category known as sensitive personal data, imposing additional obligations under contracts for the transfer of sensitive personal data to third parties, and establishing the Privacy Protection Agency to carry out and enforce the law10 l Health Insurance portability and Accountability Act ( HIPAA) The main US law governing the security and privacy of protected health information (PHI) was passed in 1996 and is known as the Health Insurance Portability and Accountability Act (HIPAA). PHI is defined as personally identifiable health information that is stored or transferred by a covered entity or one of its business associates in any format or manner11. Healthcare clearinghouses, healthcare providers, and health plans are examples of covered entities.
Those who carry out specific tasks or activities on behalf of, or offer specific services to, a covered entity that involves the use or disclosure of PHI are known as business associates12. HIPAA Privacy Rules lays down standards for the protection of PHI, including its usage and disclosure. It ensures that such information is disclosed only for treatments, payments, and health care operations with proper authorization from the individual. HIPAA also ensures that entities and their business associates must protect the confidentiality, integrity, and availability of PHI. When it comes to cloud service provider, HIPAA states various obligations which are essential for the protection of PHI. They are: l The covered entity must enter into a business associate agreement (BAA) with the CSP, specifying each party's responsibilities and liabilities with respect to the ePHI13.
l The CSP must comply with the applicable provisions of the HIPAA Security Rule, including implementing appropriate administrative, physical, and technical safeguards to protect the ePHI14.
10 Cal. Civ. Code § 1798.185(a).
11 45 C.F.R. § 160.103 (2022)
12 45 C.F.R. § 160.103 (2022)
13 45 C.F.R. § 164.504(e) (2022)
14 45 C.F.R. § 164.314(a) (2022)
l The CSP must ensure that any subcontractors it engages to assist in its work for the covered entity agree to the same restrictions and conditions that apply to the CSP15. l The CSP must report any security incidents or breaches of unsecured PHI to the covered entity16. l The CSP must make its internal practices, books and records relating to the use and disclosure of PHI received from or created by CSP17. Violation of such obligations will lead to severe financial penalties to the service providers.
3 India
Dealing with a variety of technical breakthroughs, including the internet's rapid expansion and global influence, has presented challenges for India's legal system. The need for face-to-face contact in the establishment of significant legal relationships between the parties is repeatedly diminished by technology. As such, the legal community has the responsibility of determining the standards of conduct that these parties must adhere to in order to maintain their legal relationships. India now uses the Information Technology Act of 2000, together with the Information Technology Rules and Regulations established under it, to control cyber security problems. Since cloud services are provided via the internet, they are likewise subject to the Act's restrictions.
Established by the Act, the Computer Emergency Response Team-In (CERT) is tasked with gathering, analyzing, and sharing information about any cyber-related event while also supporting emergency protocols. Information Technology Act mainly deals with the computer related works like electronic records, electronic signature, electronic governance and the authorities regulating these operations. It also grants legal recognition to the admissibility of electronic evidence in court and imposes penalties for cyber crimes or breach of personal data.
15 45 C.F.R. § 164.314(a)(2)(i)(B) (2022)
16 45 C.F.R. § 164.314(a)(2)(i)(C) (2022).
17 45 C.F.R. § 164.504(e)(2)(ii)(H) (2022).
Information Technology goes blind when it comes to cloud service providers. There is no specific provisions deals or regulates the mechanism of these service providers except Section
79 deals with Intermediary, whereas Section 43A and 72A are penal provisions.
Section 79: l The Information Technology (Intermediaries Guidelines) Rules 2011 (which were revised in 2018) and Section 79 of the Information Technology Act 2000 require intermediaries to have adequate security methods and procedures in place to protect their computer resources. l The Act requires the intermediaries to report cybersecurity events to CERT-In. Intermediaries will be held liable under the Act if they neglect to notify CERT-In of such instances. The maximum amount of the fine will be 25,000 rupees. Information may be requested by CERT-In from business entities, service providers, and intermediaries that do not comply. A fine of up to 100,000 rupees or a year in jail might be imposed against them, or both. l According to the 2018 Intermediary Rules, the intermediary must use appropriate due diligence when performing his obligations.
The intermediary must disclose its rules and regulations, privacy policy, and user agreement before anybody may access or utilize its computer resources. Users of computer resources are not permitted to host, upload, display, alter, publish, transmit, update, or distribute any information that could have an impact on public health and safety or the critical information structure, according to the rules, regulations, and terms and conditions specified in the user agreement.
l The IT Act 2000's Clause 3 of Section 79 states that an intermediary cannot claim an exemption "if it has conspired or abetted or aided or induced whether by threats or promise or otherwise in the commission of the unlawful act; or the intermediary upon receiving actual knowledge, or upon being notified by the appropriate Government that any information, or communication link residing in or connected to a computer resource controlled by the intermediary is being used to commit the unlawful act, the intermediary fails to expeditiously remove or disable access to that material on that resource without vitiating the evidence in any way.
" l Sections 43A addresses the compensation for failing to protect the sensitive personal data, Section 72A deals with the punishment for disclosing personal information in breach of lawful contract and section 79 states the extent of liability borne by the intermediaries who uses, process the personal information of its customers. One of the vital section under IT Act 2000 is the Section 10A Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules of 2011 deals with the protection of sensitive personal data that the computer resources owned , controlled, operated by the entity18. But the various provisions of the Rules are not extraterritorial in nature and so entities unless they stick to the standards mentioned under the Rules, that are not bound by any contractual obligations19.
Thus cloud service providers need to make sure that they comply with the Information Technology Rules before trading in India20. DIGITAL PERSONAL DATA PRIVACY ACT 202321 After encountering all these grey areas under Information Technology Act 2008, India introduces, the Data Protection Privacy B ill of 2019 was submitted with the intention of addressing the gathering, storing, and sharing of sensitive data. It also lays out the rights and obligations of data subjects and data fiduciaries, respectively. Personal information that can be used to identify an individual is included in this data, such as financial information, caste, and religion. This measure regulates all data gathered by government and commercial entities alike. For legitimate purposes, such as national security or sovereignty, this allowed government personnel to access residents' personal in formation.
The advent of the Covid-19 pandemic has prompted many government entities throughout the world to take all necessary precautions to preserve the public's health. In India, the spread of viruses is constantly tracked, and information about the public's health status is collected and monitored by various government departments, non-profit organizations, outsourcing agencies
18 http://www.narasappa.com/resources/InformationTechnologyRules.pdf
19 Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, Gazette of India, part II section 3(1), R.7 (Apr. 11, 2011). 20 Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, Gazette of India, part II section 3(1), R. 3 (Apr. 11, 2011).
21 Kanungo, S. . (2024). Data Privacy and Compliance Issues in Cloud Computing
Legal and Regulatory Perspectives. International Journal of Intelligent Systems and Applications in Engineering, 12(21s), 1721–1734. Retrieved from https://ijisae. org/index. php/IJISAE/article/view/5710 working under government departments, corporations, and other stakeholders. As a result of the government's failure to establish sufficient norms and procedures for protecting data transfers, undesired information that is personal to an individual gets leaked to others. This is one of the ways in which data breaches and leaks demand the implementation of the Digital Personal Data Protection Act in India. Corresponding to the Data Protection Bill 2019, The Digital Personal Data Protection Act 2023,was enforced which is identical to the General Data Protection Regulations of the European Union.
The following states the main objective of Digital Personal Data Protection Act 2023: l Protecting personal data l User Consent l Accountability l Data Minimisation l Establishment of data protection board The statute requires that any personal data gathered, transmitted, and retained by any organization, agency, cloud service provider, or its connected agencies in India follow the norms and restrictions outlined in the statute. To safeguard the protection of customers' data, the Data fiduciary and Data principal must comply with specific rights and obligations outlined in the act. The legislation established the Data Protection Board, which is a regulatory entity that functions as a watchdog over the so-collected data of the public for various uses by the government and other organizations, including their respective cloud service providers.
Despite the implementation of these regulations, the Ministry of Electronics and Information Technology is unable to properly manage the leakage and breach of personal information belonging to Indian residents. As a solution rather than a regulating tool, the Ministry is just punishing the victims and giving them compensation. Being a recently enacted law, the functioning of the Controller of the Data Protection Board established by the Digital Privacy Data Protection Act 2023 is still up for debate. Following the passage of the DPDP Act, there have been several breaches or leaks of personal information, including the following:
1 BSNL Data breach
For the second time in six months, Bharat Sanchar Nigam Limited, a state-owned telecom business, had a data breach involving more than 278 GB. This leads to the disclosure of sensitive customer information such as the International Mobile Subscriber Identity (IMSI) number, Sim card information, home addresses, and other essential security keys.
2 Star health Insurance leakage
Customers with Star Health Insurance policies, as well as information on more than 5.8 million claims, were made public via Telegram bots. Personal information included the victims' cellphone numbers, copies of their ID cards, test results, and medical diagnostic reports. In order to combat these situations, some alterations needs to be made in Digital Personal Data Protection Act 2023 so that India has a effective legislation as that of General Data Protection Regulation of European Union.
RECOMMENDATIONS
The following tactical suggestions must be taken into account in order to successfully negotiate India's complicated and constantly changing data privacy legislation and compliance environment in relation to cloud computing:
1 Vendor Risk Assessment
Third-party risks are introduced when using a cloud service provider, and they need to be properly controlled. A strong vendor risk management approach is necessary to guarantee that cloud providers fulfill the security, privacy, and compliance needs of the company. The first step is conducting through risk assessment of potential cloud service provider. This should cover: l Information security Practices: Assessing the provider's security measures, including physical and network security, access restrictions, data encryption, and vulnerability management. l Compliance posture: Examining the provider's compliance with applicable industry norms and laws like GDPR, HIPAA l Incident response capabilities:Evaluate the provider's issue detection, response, and notification methods in relation to the customer's own response plan.
l Supply chain security: Evaluating the security practices of the provider's subcontractors and suppliers. l Jurisdictional and data residency: Understanding where the provider stores and processes data, and how it complies with cross-border data transfer requirements.
2 Cloud Security Standards
The Cloud Standards Customer Council (CSCC) has been founded as "an end-user advocacy group dedicated to accelerating cloud adoption by establishing standards and catering to security and interoperability issues that typically surround the transition to the cloud. " According to reports, the vast majority of important organizations from around the world with comparable goals have joined the CSCC. The Council has recommended 10 actions that each cloud service client should consider implementing to manage the security of their cloud environment, which will assist them in dealing with cloud security concerns. Each stage has cloud-specific security requirements and certifications to provide a secure cloud environment.
Following are those ten steps: l Ensure effective governance, risk and compliance processes exist l Audit operational and business processes l Manage people, roles and identities l Ensure proper protection of data and information l Enforce privacy policies l Assess the security provisions for cloud applications l Ensure cloud networks and connections are secure l Evaluate security controls on physical infrastructure and facilities l Manage security terms in the cloud service agreement l Understand the security requirements of the exit process
3 Shared Responsibility Model
l Both the cloud provider and the customer have compliance obligations. The customer cannot fully delegate its compliance responsibilities to the provider. l The customer must understand what controls the provider has in place and how they align with the customer's compliance requirements. This requires thorough due diligence and ongoing monitoring. l Compliance responsibilities should be clearly defined in contracts and SLAs. The contract should specify each party's roles, the security measures the provider will implement, the customer's audit and monitoring rights, and the provider's incident response and breach notification obligations. l The customer must implement its own security controls for the areas it is responsible for, such as data encryption, access management, and application security.
l Compliance assessments and audits should cover both the provider's and the customer's areas of responsibility. The customer should ensure it has sufficient visibility into the provider's operations to demonstrate compliance For instance, HIPAA defines cloud providers that process ePHI as business associates, regardless of service style. The BAA standards and regulations vary based on the type of the services provided. A supplier who solely provides IaaS and does not access ePHI may have less HIPAA requirements than a SaaS provider who handles ePHI. The GDPR classifies cloud providers and customers as data controllers, joint controllers, or processors based on their participation in deciding processing intents and means.
The GDPR mandates that controllers and processors establish a contract outlining the subject matter, length, nature, purpose, kind of personal data, data subject categories, and the controller's duties and rights. With regard to Cross-Border Data Transfer
1 Standard Contractual Clauses
The European Commission has approved contractual terms that provide appropriate protections for personal data transfers. The SCCs require both data exporters and importers to secure the data. In June 2021, the Commission implemented new SCCs that comply with the GDPR.
2 Binding Corporate Rules
European Data Protection Board lays down rules regarding the corporate rules which regulates the corporate internal rules governing the data transfer between multinational companies. Such transfers need to be approved by appropriate authority.
CONCLUSION
Since data is kept online, there is no longer any chance of data loss or destruction, which is the main reason why practically all businesses, organizations, and related agencies use cloud computing instead of alternative storage methods. The Digital Personal Data Protection Act
2023 and the Information Technology Act 2008 have established statutory frameworks for the
protection of personal information in India, a growing nation in terms of technical sophistication. Notwithstanding the existence of these restrictions, certain gaps exist that prevent the laws from being applied to particular fields. All of the shortcomings in the present statute will be addressed by an amendment that states the suggestions made in this study report.