Legal Commentary

Cloud computing presents real concerns over privacy issues

By David Canton

For the London Free Press - September 29, 2008

Read this on Canoe

We are moving into “cloud” computing, where users increasingly rely on data and software residing somewhere out there on the Internet.

That means we have little direct knowledge of, involvement with or control over the data or its location. And since that data inevitably includes personal information, it raises information security and privacy issues.

Use of the cloud has moved beyond e-mail such as Hotmail to include applications such as Google Apps for word-processing and social networking sites such as Facebook. And increasingly, it means our data is not only processed, but stored in cyberspace.

This is true for business as well as personal applications.

Cloud computing promises flexibility, better reliability and security, enhanced collaboration, portability and simpler devices. It lets Internet users use servers, storage systems and computing power in multiple locations.

But it also means leaving digital footprints all over the Internet, in places where we have no idea how information is policed.

Ontario Privacy Commissioner Ann Cavoukian weighed in on this issue in the recent white paper, Privacy in the Clouds.

“It will not be possible to realize the full potential of the next generation of the Internet or Cloud Computing without developing better ways of establishing digital identity and protecting privacy,” she wrote.

Cavoukian believes the answer is a flexible, user-centric identity management system with open standards and community-driven interoperability.

In other words, a system where we can log on to a tool that establishes who we are, then use it to identify us to services. We could then use services anonymously, or control how much the service knows about us to minimize risk of identity theft or fraud.

It would help eliminate the many logins and passwords that plague us today. A flexible system would take in any device reaching the Internet, such as Blackberries or game consoles.

A standard approach would also make it easier and cheaper for cloud service providers to authenticate its users, build trust in its privacy and security promises, and cut the risk of security breaches by limiting the personal information they keep.

Such services are starting to appear, but are not yet universally accepted.

Full post as published by eLegal Canton on September 29, 2008 (boomark / email).