U.S. CLOUD Act i förhållande till dataskyddsförordningen och offentlighets- och sekretesslagen
(2020) JURM02 20201Department of Law
Faculty of Law
- Abstract (Swedish)
- Att använda molntjänster är en stor del av många företags vardag. I dessa molntjänster lagras ofta stora mängder personuppgifter. Den 22 mars 2018 antog den amerikanska kongressen den federala lagen ”CLOUD Act”. Lagen ger amerikanska brottsbekämpande myndigheter möjlighet att begära ut information, inbegripet personuppgifter, av en molntjänstleverantör som omfattas av amerikansk jurisdiktion, trots att informationen finns lagrad inom EU.
Uppsatsen har ämnat att utreda om en molntjänstleverantör kan anses överträda reglerna om tredjelandsöverföringar i dataskyddsförordningen, om molntjänstleverantören hörsammar en begäran om utlämnande av information, inbegripet personuppgifter, av en amerikansk brottsbekämpande myndighet i enlighet med... (More) - Att använda molntjänster är en stor del av många företags vardag. I dessa molntjänster lagras ofta stora mängder personuppgifter. Den 22 mars 2018 antog den amerikanska kongressen den federala lagen ”CLOUD Act”. Lagen ger amerikanska brottsbekämpande myndigheter möjlighet att begära ut information, inbegripet personuppgifter, av en molntjänstleverantör som omfattas av amerikansk jurisdiktion, trots att informationen finns lagrad inom EU.
Uppsatsen har ämnat att utreda om en molntjänstleverantör kan anses överträda reglerna om tredjelandsöverföringar i dataskyddsförordningen, om molntjänstleverantören hörsammar en begäran om utlämnande av information, inbegripet personuppgifter, av en amerikansk brottsbekämpande myndighet i enlighet med CLOUD Act, och informationen i fråga lagras inom EU. Uppsatsens andra syfte har varit att utreda ansvarsfördelningen mellan molntjänstleverantör och molntjänstkund enligt dataskyddsförordningen, och hur detta ansvar kan påverkas om en molntjänstleverantör i egenskap av personuppgiftsbiträde hörsammar en begäran om utlämnande av information enligt CLOUD Act. Uppsatsen har slutligen ämnat att utreda om en svensk myndighet kan anses ”röja” uppgifter som omfattas av sekretess enligt offentlighets- och sekretesslagen, om den svenska myndigheten använder en molntjänstleverantör som enligt CLOUD Act kan åläggas att lämna ut information till amerikanska brottsbekämpande myndigheter.
Uppsatsen visar att en molntjänstleverantör som hörsammar en begäran om information enligt CLOUD Act i de allra flesta fall kommer att strida mot dataskyddsförordningen. Det är även möjligt att den amerikanska brottsbekämpande myndigheten riktar begäran direkt till molntjänstkunden. Företag inom EU bör därför i största möjliga mån avstå från att anlita en molntjänstleverantör som omfattas av CLOUD Act.
Ansvarsfördelningen i molntjänster kommer att bero på molntjänstens utformning. Om molntjänstleverantören i egenskap av personuppgiftsbiträde hörsammar en begäran om utlämnande av information av en amerikansk brottsbekämpande myndighet kommer denne att övergå till att bli personuppgiftsansvarig för personuppgifterna. Detta torde vara fallet även om ett överföringsförbud inte reglerats i personuppgiftsbiträdesavtalet.
Slutligen visar uppsatsen att det finns en viss diskrepans mellan rättspraxis och de rättsliga rekommendationer som behandlar vad som avses med att ”röja” en sekretessbelagd uppgift. Rättsläget skapar en stor osäkerhet för många myndigheter. En svensk myndighet bör därför i nuläget i största mån undvika att använda en molntjänstleverantör som omfattas av CLOUD Act. (Less) - Abstract
- Using cloud services is common in many companies' businesses. Large amounts of personal data are often stored in these cloud services. On March 22, 2018, the U.S. Congress passed the federal law “CLOUD Act”. The CLOUD Act allows U.S. law enforcement agencies to obtain information, including personal data, from a cloud service provider subject to U.S. jurisdiction, even though the information is stored within the European Union.
This thesis has aimed to investigate whether a cloud service provider may violate the rules on third-country transfers in Chapter V of the General Data Protection Regulation, if a cloud service provider complies with a request for disclosure of information, including personal data, by a U.S. law enforcement... (More) - Using cloud services is common in many companies' businesses. Large amounts of personal data are often stored in these cloud services. On March 22, 2018, the U.S. Congress passed the federal law “CLOUD Act”. The CLOUD Act allows U.S. law enforcement agencies to obtain information, including personal data, from a cloud service provider subject to U.S. jurisdiction, even though the information is stored within the European Union.
This thesis has aimed to investigate whether a cloud service provider may violate the rules on third-country transfers in Chapter V of the General Data Protection Regulation, if a cloud service provider complies with a request for disclosure of information, including personal data, by a U.S. law enforcement agency in accordance with the CLOUD Act, and the information in question is stored within the European Union. The second purpose of the thesis has been to investigate the division of responsibilities between a cloud service provider and a cloud service customer according to the General Data Protection Regulation, and how this responsibility may be affected if a cloud service provider as a personal data processor complies with a request for disclosure of information under the CLOUD Act. Finally, the thesis has intended to investigate whether a Swedish authority may be considered to “disclose” information covered by confidentiality according to the Public Access to Information and Secrecy Act, if the Swedish authority uses a cloud service provider which, according to the CLOUD Act, may be required to disclose information to U.S. law enforcement agencies.
The thesis shows that a cloud service provider, which complies with a request for information according to the CLOUD Act, in most cases will contravene the General Data Protection Regulation. It is also possible that the U.S. law enforcement agencies address the request directly to the cloud service customer. Companies within the European Union should therefore, as far as possible, refrain from hiring a cloud service provider subject to the CLOUD Act.
The division of responsibilities in cloud services according to the General Data Protection Regulation will depend on the technical design of the cloud service. If the cloud service provider, as a personal data processor, complies with a request for disclosure of information by a U.S. law enforcement agency, the cloud service provider will become the personal data controller instead. This should be the case even if this is not regulated in the personal data processing agreement.
Finally, the thesis shows that there is a discrepancy between Swedish case law and the legal recommendations that investigate the term "disclosing" information covered by confidentiality The legal situation creates a great uncertainty for many authorities. Therefore, a Swedish authority should, to the present extent, avoid using a cloud service provider subject to the CLOUD Act. (Less)
Please use this url to cite or link to this publication:
http://lup.lub.lu.se/student-papers/record/9010641
- author
- Limnefelt Nygren, Victoria LU
- supervisor
- organization
- alternative title
- The U.S. CLOUD Act in relation to the General Data Protection Regulation and the Public Access to Information and Secrecy Act
- course
- JURM02 20201
- year
- 2020
- type
- H3 - Professional qualifications (4 Years - )
- subject
- keywords
- IT-rätt, GDPR
- language
- Swedish
- id
- 9010641
- date added to LUP
- 2020-06-16 10:54:45
- date last changed
- 2020-06-16 10:54:45
@misc{9010641,
abstract = {{Using cloud services is common in many companies' businesses. Large amounts of personal data are often stored in these cloud services. On March 22, 2018, the U.S. Congress passed the federal law “CLOUD Act”. The CLOUD Act allows U.S. law enforcement agencies to obtain information, including personal data, from a cloud service provider subject to U.S. jurisdiction, even though the information is stored within the European Union.
This thesis has aimed to investigate whether a cloud service provider may violate the rules on third-country transfers in Chapter V of the General Data Protection Regulation, if a cloud service provider complies with a request for disclosure of information, including personal data, by a U.S. law enforcement agency in accordance with the CLOUD Act, and the information in question is stored within the European Union. The second purpose of the thesis has been to investigate the division of responsibilities between a cloud service provider and a cloud service customer according to the General Data Protection Regulation, and how this responsibility may be affected if a cloud service provider as a personal data processor complies with a request for disclosure of information under the CLOUD Act. Finally, the thesis has intended to investigate whether a Swedish authority may be considered to “disclose” information covered by confidentiality according to the Public Access to Information and Secrecy Act, if the Swedish authority uses a cloud service provider which, according to the CLOUD Act, may be required to disclose information to U.S. law enforcement agencies.
The thesis shows that a cloud service provider, which complies with a request for information according to the CLOUD Act, in most cases will contravene the General Data Protection Regulation. It is also possible that the U.S. law enforcement agencies address the request directly to the cloud service customer. Companies within the European Union should therefore, as far as possible, refrain from hiring a cloud service provider subject to the CLOUD Act.
The division of responsibilities in cloud services according to the General Data Protection Regulation will depend on the technical design of the cloud service. If the cloud service provider, as a personal data processor, complies with a request for disclosure of information by a U.S. law enforcement agency, the cloud service provider will become the personal data controller instead. This should be the case even if this is not regulated in the personal data processing agreement.
Finally, the thesis shows that there is a discrepancy between Swedish case law and the legal recommendations that investigate the term "disclosing" information covered by confidentiality The legal situation creates a great uncertainty for many authorities. Therefore, a Swedish authority should, to the present extent, avoid using a cloud service provider subject to the CLOUD Act.}},
author = {{Limnefelt Nygren, Victoria}},
language = {{swe}},
note = {{Student Paper}},
title = {{U.S. CLOUD Act i förhållande till dataskyddsförordningen och offentlighets- och sekretesslagen}},
year = {{2020}},
}