What do I need to consider as a Swiss company regarding the protection of personal data when I rely on US software from the cloud? Which solution protects me?
Cloud computing and the protection of personal data – how do they fit together?
More and more companies are adopting a cloud strategy and relying on software-as-a-service offerings from established US providers. This is practical, because it means more software offerings can be used with little technical expertise. Widely used services such as Office 365 from Microsoft, CRM from Salesforce or surveys with SurveyMonkey are applications operated by US companies. It is not only software offerings that are increasingly obtained as a service; the infrastructure and platform services of Amazon AWS, Microsoft Azure or Google are also recording high growth rates. The advantage is obvious: predictable costs, guaranteed maintenance and easy access.
The disadvantage: the processing and storage of personal data (worthy of protection) thus lie with US companies, which are subject to US law and therefore also to the CLOUD Act (Clarifying Lawful Overseas Use of Data Act). This law, in force since 2018, governs US authorities' access to stored data, even if the data is not stored in the USA.
Is the legal protection of the previous Privacy Shields inadequate?
The informal arrangement between the EU and the US from 2016, known as the EU-US Privacy Shield, consists of a series of assurances by the US government to adhere to data protection as understood in Europe or Switzerland.
However, on 16 July 2020, the Court of Justice of the European Union (CJEU) declared the Privacy Shield invalid in its ‘Schrems II’ ruling. As a result, the US-EU Privacy Shield does not constitute a sufficient legal basis for data transfers to the USA.
In its statement of 8 September 2020 on the US-Swiss Privacy Shield, the Swiss Federal Data Protection and Information Commissioner (FDPIC) came to the same conclusion and removed the reference ‘adequate protection under certain conditions’ for the USA from its list of countries. Swiss companies can therefore no longer base their data transfers to the USA on the US-Swiss Privacy Shield.
Alternatively, the European standard contractual clauses (SCC) or binding internal corporate data protection rules (so-called Binding Corporate Rules, BCR) can be used. The CJEU also has doubts as to whether the standard contractual clauses (SCC) can justify the transfer of personal data to the USA.
Neither the Privacy Shields nor the SCC are mechanisms that can prevent access by the US authorities.
How can data be protected in the cloud in such a way that it complies with local legal requirements?
Encrypting the data and storing the keys securely makes it possible to offer a legally compliant and secure technical solution that protects all data in the cloud against access – including by the US authorities. So-called data-centric security is the umbrella term for various methods that protect the data itself, as opposed to protecting the data through the infrastructure.
Depending on the form and use of the data, different types of encryption are used:
Encrypting, anonymising, pseudonymising or tokenising attributes in applications and databases
Transparent end-to-end encryption of documents, emails and attachments
The central element of data-centric security is protecting the key. It is generated during encryption and guarantees secure access to the encrypted data. It is advisable to store the key in a hardware security module (HSM). HSMs are built specifically for the efficient and secure execution of cryptographic operations or applications and offer the highest possible protection for this.
Your own encryption solution offers the best protection
In principle, there are three variants for generating a key and storing it securely, the third of which, the so-called ‘Hold your own key’ solution, is the most secure. It follows the principle of separation of powers: encryption and key never lie with the same provider.
Use someones key: the key is created at the cloud service provider (e.g. Microsoft Azure) and managed by the provider. Assessment: rather insecure.
Bring your own key (BYOK): keys are created in your own environment and then uploaded to the cloud service provider's environment. Condition: a) the keys can only be used by your own tenant ID; b) the key cannot be exported from the cloud service provider's HSM. Assessment: secure.
Hold your own key (HYOK): keys are created and managed in your own HSM. Assessment: the most secure of all variants.
Encryption as a service: for SMEs that do not have their own IT security department
More and more SMEs are concentrating on their core competencies. Operating the IT infrastructure and being responsible for data security are rarely among them. Managed HSM providers such as Prewen offer alternatives for companies that want to know their security requirements are in good hands.
The encryption-as-a-service range of solutions includes:
Solutions to protect data in cloud applications.
Transparent document encryption for any type of file.
End-to-end encryption of emails and attachments of any size
Learn more about data-centric protection or Prewen's data security offering.
Questions on this topic? We look forward to talking with you.
Get in touch