This guest post is written by @matthew1hunter and @aisling1odwyer.
Regular readers of this blog will know we have been tracking the impact of ISO/IEC 27018:2014 –Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors (ISO/IEC 27018). We see this as the go-to standard for customers of public cloud computing services. In a significant move, the Hong Kong Privacy Commissioner for Personal Data (Privacy Commissioner) has recently recognised the value of ISO/IEC 27018 in its revised Cloud Computing Information Leaflet (Information Leaflet).
The Information Leaflet is a helpful piece of guidance which sets out the practical steps cloud customers should take to ensure they comply with the Hong Kong privacy laws when using cloud computing services. In the leaflet the Privacy Commissioner recognises ISO/IEC 27018 as “a comprehensive reference that has met the need to assist the selection of cloud providers by data users”.
Recap on ISO/IEC 27018
We previously covered the publication ISO/IEC 27018, and also discussed how ISO/IEC 27018 would be a useful tool for customers looking to ensure compliance with privacy laws in Singapore and other countries.
We predicted regulators would begin to recognise and refer to ISO/IEC 27018 in setting privacy standards for customers of cloud computing services. Hong Kong provides the most recent example of this. We also predicted the adoption of ISO/IEC 27018 by market-leading cloud service providers (CSPs).
Why Hong Kong and its Privacy Commissioner matter
Hong Kong was one of the early adopters of privacy laws in Asia, and has an established and well-respected privacy regime. Its Personal Data (Privacy) Ordinance (PDPO) has been in force since December 1996 and the independent Privacy Commissioner has played an active role in promoting and maintaining high privacy standards since then.
It is very significant that that Privacy Commissioner in Hong Kong has recognised the benefits of ISO/IEC 27018 in its Information Leaflet. This endorsement sets the stage for wider recognition of ISO/IEC 27018 as the go-to international standard for protecting personal information in the cloud.
When regulators accept ISO/IEC 27018 as the global gold standard for CSPs, this makes the lives of customers, CSPs and regulators easier. It is easier for customers and CSPs to ensure compliance with one international standard that facilitates compliance with most national-level privacy laws, rather than starting with the each of the national-level privacy laws.
Does ISO/IEC 27018 help customers in Hong Kong?
Hong Kong’s privacy laws, set out in the PDPO, place obligations on organisations in relation to the collection, processing, use and deletion of data. Organisations that wish to use cloud computing services need to assess how they can implement such services and continue to comply with the PDPO, and in particular, its six data protection principles.
The revised Information Leaflet alerts customers to their obligations under the PDPO and highlights three overarching points cloud customers should have in mind when choosing a CSP. These points are:
- Rapid transborder data flow: CSPs may have data centres in multiple jurisdictions and customers need to know their data will have the same level of protection wherever it is stored.
- Loose outsourcing arrangements: Customers need to know that any CSP sub-contractors are subject to the same standards as their CSP, and that there are legally enforceable contracts in place between the CSP and its sub-contractors.
- Standard services and contracts: Customers need to carefully evaluate whether their specific security and personal data privacy protection needs are met by any standard contract offered.
It is helpful then to note that the controls introduced by ISO/IEC 27018 help customers to address these points. Taking each in turn:
- CSPs are required to disclose and document where personal data will be processed and the controls in ISO/IEC 27018 are applicable no matter where the personal data is located;
- ISO/IEC 27018 requires CSPs to be transparent about their use of sub-contractors and enter into written agreements with any sub-contractors, preventing weak, informal outsourcing arrangements; and
- ISO/IEC 27018 imposes strict security standards that CSPs must adhere to, which are applicable even where the CSP and the customer are contracting on standard terms.
In summary: Hong Kong’s privacy laws impose a range of obligations on customers, some of which apply to the customer’s use of cloud computing services. ISO/IEC 27018 is a helpful tool for customers to rely on to meet those obligations. If a customer’s CSP commits to comply with ISO/IEC 27018, this should reassure the customer that the CPS’s solution will help the customer to comply with the relevant obligations under Hong Kong’s privacy laws.
Conclusion
The recognition of ISO/IEC 27018 by the Hong Kong regulator shows that the standard is a robust tool, capable of addressing important questions customers will have to consider when choosing a CSP.
Hong Kong now joins privacy regulators in Australia, Belgium, Canada, Germany and Slovenia (among others) who have all recognised the benefit ISO/IEC 27018 offers as a global standard for CSPs. We anticipate that more CSPs will commit to ISO/IEC 27018 and also that more customers will look for CSPs that commit to the standard (e.g. by adding a requirement in their RFPs for CSPs to be compliant with ISO/IEC 27018).