Security and Privacy Cloud Storage as a Personal Digital Archive Storage Media

The Quest for Information Privacy in Africa: A Review Essay

<span lang="EN-US">Cloud Computing is the ability to improve the utility or train new human resources without investing in new infrastructure, or add capabilities to existence without the latest software licensing. It expanded the capabilities of Information Technology (IT). From the past few years, cloud computing has developed from a good business concept in the best rising sectors of the IT industry. But more information on individuals and companies was put in the cloud, and concerns began to think about how secure the cloud environment was. Despite cloud surrounding structures, enterprise users still do not want to expand their business in the cloud. Security reduces the growth of cloud computing and continues to spread the market with complexity with data privacy and data protection. The security of cloud computing has constantly been an significant aspect of improved quality of service from cloud service providers. Data storage in the cloud has a problem related to data security. However, cloud computing construct many new security challenges which have not been well examine. In order to ensure that the user's data in the cloud is secure, we have proposed an effective mechanism with a distinctive feature of data integrity and privacy. This paper focusing on problems relating to the cloud data storage techniques and security in virtual environment. We recommend a method for providing data storage and security in cloud using public key Cryptosystem, which uses the concept of the modified RSA algorithm to provide better security for the data stored in the cloud. </span>

According to Cisco Global Cloud Index, cloud storage users will store 1.6 Gigabytes data per month by 2019, compared to 992 megabytes data per month in 2014. With this trend, it has been shown that more and more data will reside in cloud storage and it is expected to grow further. As cloud storage is becoming an option for users for keeping their data online, it comes with security concerns for protecting data from threats. This thesis addresses the need to investigate the security factors that will enable efficient security protection for data in cloud storage and the relationships that exist between the different security factors. Consequently, this research has developed a conceptual framework that supports security in cloud storage. The main contribution of this research is the development of a Cloud Storage Security Framework (CSSF) to support an integrative approach to understanding and evaluating security in cloud storage. The framework enables understanding of the makeup of security in cloud storage and measures the understanding of security in cloud storage. Drawing upon established theories and prior research findings, the framework indicates that security in cloud storage can be determined by nine factors: (1) security policies implementation in cloud storage, security measure that relates to (2) protecting the data accessed in cloud storage; (3) modifications of data stored; (4) accessibility of data stored in cloud storage; (5) non-repudiation to the data stored; (6) authenticity of the original data; (7) reliability of the cloud storage services; (8) accountability of service provision; and (9) auditability of the data accessed and stored in cloud storage. An example of CSSF application has been demonstrated through the development of a measuring instrument called Security Rating Score (SecRaS) and through a series of experiments, SecRaS has been validated and used in a research scenario. The instrument consists of several items generated using goal-question-metric approach. These potential items were evaluated by a series of experiments; the security experts assessed using content validity ratio while the security practitioners took part in the validation study. The validation study completed two experiments that look into the correlation analyses and internal reliability. SecRaS instrument was later applied in a research scenario; the validated instrument was distributed and a number of 218 usable responses were received. Using structural equation modelling, the data has revealed a good fit of the measurement analyses and structural model. The key findings were as follow: the relationships between factors were found to have both direct and indirect effects in the result. While establishing the relationship(s) among the factors, the structural model proposes three types of causal relationships in terms of how the security implementation in cloud storage could be affected by the security factors. This thesis presents a detailed discussion of the CSSF development, confirmation, and application in a research scenario. For security managers, CSSF offers a new paradigm on how stakeholders can make cloud storage security implementation successful in some depth. For security practitioners, the CSSF enables deconstruction of the concept of security in cloud storage into smaller, conceptually distinct and manageable factors to guide the design of security in cloud storage. For researchers, the CSSF provides a common framework in which to conceptualise their research and make it easier to see how the security factors fit into the larger picture.

A comparison of data protection legislation and policies across the EU

Click to increase image sizeClick to decrease image size Notes 1. "As a result of increasing interconnectivity, information systems and networks are now exposed to a growing number and a wider variety of threats and vulnerabilities. This raises new issues for security." OECD Guidelines for the Security of Information Systems and Networks, July 25, 2002, at p. 7, available at www.oecd.org/dataoecd/16/22/15582260.pdf. 2. Although not the subject of this article, it is important to note that countries are also enacting cybercrime legislation to make clear that certain online activities are illegal and to assist law enforcement in efforts to prosecute cyber criminals. To that end, the Privacy and Computer Crime Committee of the American Bar Association Section of Science & Technology Law has recently undertaken a project to develop a Model Cybercrime Law for the UN International Telecommunication Union's (ITU) Cybersecurity Work Programme to Assist Developing Countries. See also the International Guide to Combating Cybercrime published by this Committee, available at http://www.abanet.org/dch/committee.cfm?com=ST202003. 3. See the Appendix for a compilation of some of the key laws and regulations governing information security. 4. See, e.g., EU Data Protection Directive and HIPAA, cited in the Appendix. 5. See, e.g., E-SIGN, UETA, and UN Convention cited in the Appendix. 6. See, e.g., Kimberly Kiefer and Randy V. Sabett, Openness of Internet Creates Potential for Corporate Information Security Liability, BNA Privacy & Security Law Report, Vol. 1, No. 25 at 788 (June 24, 2002); Alan Charles Raul, Frank R. Volpe, and Gabriel S. Meyer, Liability for Computer Glitches and Online Security Lapses, BNA Electronic Commerce Law Report, Vol. 6, No. 31 at 849 (August 8, 2001); Erin Kenneally, The Byte Stops Here: Duty and Liability for Negligent Internet Security, Computer Security Journal, Vol. XVI, No. 2, 2000. 7. See, e.g., Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007); Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006); and Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005) (all affirming a negligence cause of action). See also, In Re TJX Companies Retail Security Breach Litigation, 2007 U.S. Dist. Lexis 77236 (D. Mass. October 12, 2007) (rejecting a negligence claim due to the economic loss doctrine, but allowing a negligent misrepresentation claim to proceed). 8. See, e.g., American Express v. Vinhnee, 2005 Bankr. Lexis 2602 (9th Cir. Bk. App. Panel, 2005); Lorraine v. Markel, 2007 U.S. Dist. Lexis 33020 (D. MD. May 4, 2007). 9. Available at www.pcisecuritystandards.org. 10. Available at www.cabforum.org. 11. ISO/IEC 27001, Information Technology—Security Techniques—Information Security Management Systems—Requirements (October 2005) (hereinafter "ISO/IEC 27001"), available for purchase at http://www.standards-online.net/InformationSecurityStandard.htm. 12. Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter "EU Data Protection Directive"). 13. See statutes listed in the Appendix. 14. See statutes listed in the Appendix. 15. Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), 42 U.S.C. 1320d-2 and 1320d-4, (providing that "each person … who maintains or transmits health information shall maintain reasonable and appropriate administrative, technical, and physical safeguards: (A) to ensure the integrity and confidentiality of the information; (B) to protect against any reasonably anticipated: (i) threats or hazards to the security or integrity of the information; and (ii) unauthorized uses or disclosures of the information; and (C) otherwise to ensure compliance with this part by the officers and employees of such person," at 42 U.S.C. 1320d-2(d)(2). 16. Gramm-Leach-Bliley Financial Services Modernization Act ("GLB"), Pub. L. No. 106-102, 113 Stat. 1338 (November 12, 1999), at §§ 501 and 505(b), 15 U.S.C. §§ 6801, 6805, providing that "[E]ach financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information." 17. See, Gramm-Leach-Bliley Act ("GLB"), Public Law 106-102, §§ 501 and 505(b), 15 U.S.C. §§ 6801, 6805, and implementing regulations at 12 C.F.R. Part 30, Appendix B (OCC), 12 C.F.R. Part 208, Appendix D (Federal Reserve System), 12 C.F.R. Part 364, Appendix B (FDIC), 12 C.F.R. Part 568 (Office of Thrift Supervision) and 16 C.F.R. Part 314 (FTC). 18. Final HIPAA Security Regulations, 45 C.F.R. Part 164. 19. There have also been efforts in the United States to pursue comprehensive federal privacy similar to the approach taken by many other countries. See e.g., Microsoft position paper at www.microsoft.com/presspass/download/features/2005/PrivacyLegislationCallWP.doc. Although it remains to be seen whether that approach will ultimately be adopted, it is clear that the combination of U.S. state and federal law has, in effect, imposed a comprehensive obligation of security with respect to all personal information held by all companies. 20. See, e.g., FTC enforcement actions regarding In the Matter of Sunbelt Lending Services, Inc.; In the Matter of Petco Animal Supplies, Inc.; In the Matter of MTS, Inc., d/b/a Tower records/Books/Video; In the matter of Guess?, Inc.; FTC V. Microsoft; and In the Matter of Eli Lilly and Company cited in the Appendix. 21. See, e.g., FTC enforcement actions regarding In the Matter of CardSystems Solutions, Inc.; United States v. ChoicePoint, Inc.; In the Matter of DSW Inc.; and In the Matter of BJ's Wholesale Club, Inc. cited in the Appendix. 22. See list in the Appendix. 23. See, e.g., Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006) and Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005). 24. 205 Mich. App. Lexis 353 at ∗16 (Mich. App. 2005). 25. 2006 U.S. Dist. Lexis 4846 at ∗9 (D. Minn. 2006). 26. Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007). 27. In Re TJX Companies Retail Security Breach Litigation, 2007 U.S. Dist. Lexis 77236 (D. Mass. October 12, 2007), at pp. 28–29. 28. Ibid. 29. The Homeland Security Act of 2002 defines the term "information system" to mean "any equipment or interconnected system or subsystems of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information, and includes—(A) computers and computer networks; (B) ancillary equipment; (C) software, firmware, and related procedures; (D) services, including support services; and (E) related resources." Homeland Security Act of 2002, Pub. L. 107-296, at Section 1001(b), amending 44 U.S.C. § 3532(b)(4). 30. See, e.g., Australia, Information Privacy Principles under the Privacy Act 1988, Principle No. 4, available at www.privacy.gov.au/publications/ipps.html; AICPA and the Canadian Institute of Chartered Accountants (CICA), Generally Accepted Privacy principles, Principle No. 8, available at http://infotech.aicpa.org/Resources/Privacy/Generally+Accepted+Privacy+Principles; APEC, Privacy principles, Principle No. 7, available at http://austlii.edu.au/∼graham/APEC/APECv10.doc; US-EU Safe Harbor Privacy Principles, available at www.export.gov/safeharbor/SHPRINCIPLESFINAL.htm; Direct Marketing Association, Online Marketing Guidelines, available at www.the-dma.org/guidelines/onlineguidelines.shtml. 31. Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter "EU Data Protection Directive"). 32. EU Data Protection Directive, Preamble at Para. 46. 33. EU Data Protection Directive, Article 17(1). 34. See statutes listed in the Appendix. 35. See statutes listed in the Appendix. 36. See generally, Bruce H. Nearon, Jon Stanley, Steven W. Teppler, and Joseph Burton, Life after Sarbanes-Oxley: The Merger of Information Security and Accountability, Jurimetrics Journal, Vol. 45, 379–412 (2005). 37. American Express v. Vinhnee, 336 B.R. 437; 2005 Bankr. Lexis 2602 (9th Cir. December 16, 2006). 38. Ibid., at p. 444. 39. Ibid., at p. 445. 40. Ibid., at pp. 446–447. 41. Ibid., at p. 449. 42. See, e.g., National Association of Corporate Directors, Information Security Oversight (2007). 43. Sarbanes-Oxley Act, Section 302. 44. See, e.g., GLB Security Regulations (Federal Reserve) 12 C.F.R. 208, Appendix D-2.III(A). 45. HIPAA Security Regulations, 45 C.F.R. Section 164.308(a)(2). 46. See, FTC Decisions and Consent Decrees listed in the Appendix, including Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of Discontinuance, Para. 27(a), p. 7; Eli Lilly Decision at II.A. 47. FISMA, 44 U.S.C. 3544(a). 48. E. Michael Power and Roland L. Trope, Sailing in Dangerous Waters: A Director's Guide to Data Governanc e , American Bar Association (2005), p. 13; Roland L. Trope, "Directors' Digital Fiduciary Duties," IEEE Security & Privacy, January/February 2005 at p. 78. 49. Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996). 50. Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005), at pp. 11–13 (noting that harm was foreseeable, but Board took no action). 51. Securing Cyberspace: Business Roundtable's Framework for the Future, Business Roundtable, May 19, 2004 at pp. 1, 2; available at www.businessroundtable.org/pdf//20040518000CyberSecurityPrinciples.pdf. The Business Roundtable is an association of chief executive officers of leading U.S. corporations with a combined workforce of more than 10 million employees in the United States. See www.businessroundtable.org. 52. Information Security Governance: A Call to Action, Corporate Governance Task Force Report, National Cyber Security Partnership, April 2004, pp. 12–13, available at www.cyberpartnership.org/InfoSecGov4_04.pdf. The National Cyber Security Partnership (NCSP) is led by the Business Software Alliance (BSA), the Information Technology Association of America (ITAA), TechNet, and the U.S. Chamber of Commerce in voluntary partnership with academicians, CEOs, federal government agencies, and industry experts. Following the release of the 2003 White House National Strategy to Secure Cyberspace and the National Cyber Security Summit, this public–private partnership was established to develop shared strategies and programs to better secure and enhance America's critical information infrastructure. Further information is available at www.cyberpartnership.org. 53. GLB Security Regulations (OCC), 12 C.F.R. Part 30, Appendix B, Part III.A and Part III.F. 54. See, e.g., Homeland Security Act of 2002 (Federal Information Security Management Act of 2002) 44 U.S.C. Section 3542(b)(1); GLB Security Regulations (OCC), 12 C.F.R. Part 30 Appendix B, Part II.B; HIPAA Security Regulations, 45 C.F.R. Section 164.306(a)(1); Microsoft Consent Decree at II, p. 4. 55. See, e.g., 44 USC 3532(b)(1), emphasis added. See also FISMA, 44 U.S.C. Section 3542(b)(1). Most of the foreign privacy laws also focus their security requirements from this perspective. This includes, for example, the EU Privacy Directive, Finland's Privacy Law, Italy's Privacy Law, and the UK Privacy Law. Also in this category is the Canadian Privacy Law. 56. Although they often focus on categories of security measures to address. See, e.g., HIPAA Security Regulations, 45 C.F.R. Part 164. 57. See, e.g., FDA regulations at 21 C.F.R. Part 11 (procedures and controls); SEC regulations at 17 C.F.R. 257.1(e)(3) (procedures); SEC regulations at 17 C.F.R. 240.17a-4 (controls); GLB regulations (FTC) 16 C.F.R. Part 314 (safeguards); Canada, Personal Information Protection and Electronic Documents Act, Schedule I, Section 4.7 (safeguards); EU Data Privacy Directive, Article 17(1) (measures) available at http://europa.eu.int/comm/internal_market/privacy/docs/95-46-ce/dir1995-46_part1_en.pdf. 58. See, e.g., HIPAA 42 U.S.C. 1302d-2, and HIPAA Security regulations, 45 CFR 164.306; COPPA, 15 U.S.C. 6502(b)(1)(D), and COPPA regulations 16 C.F.R. 312.8; IRS Rev. Proc. 97-22, sec. 4.01(2); SEC regulations 17 C.F.R. 257. See also UCC Article 4A, Section 202 ("commercially reasonable" security procedure), and Microsoft Consent Decree. 59. "Appropriate" security required by: HIPAA 42 U.S.C. 1302d-2, and HIPAA Security regulations, 45 CFR 164.306; EU Data Protection Directive, Article 17(1). 60. EU Data Protection Directive, Article 17(1) (emphasis added) 61. See, e.g., Belgium—Belgian Law of 8 December 1992 on Privacy Protection in relation to the Processing of Personal Data, as modified by the law of 11 December 1998 Implementing Directive 95/46/EC, and the law of 26 February 2003, Chapter IV, Article 16(4); Denmark—Act on Processing of Personal Data,; Act No. 429 of 31 May 2000 (unofficial English translation), Title IV, Part 11, Section 41(3); Estonia—Personal Data Protection Act; Passed February12, 2003 (RT1 I 2003, 26, 158), entered into force October 1, 2003, Chapter 3, Sections 19(2); Greece—Law 2472/1997 on the Protection of Individuals with regard to the Processing of Personal Data (as amended by Laws 2819/2000 and 2915/2001); Article 10(3); Ireland—Data Protection (Amendment) Act 2003; Section 2.-(1)(d) and First Schedule Article 7; Lithuania—Law on Legal Protection of Personal Data, January 21, 2003, No. IX-1296, Official translation, with amendments April 13, 2004, Article 24(1); Netherlands—25 892—Rules for the protection of personal data (Personal Data Protection Act) (Unofficial translation); Article 13; Portugal—Act on the Protection of Personal Data (transposing into the Portuguese legal system Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data), Article 14(1); Slovakia—Act No 428 of July 3, 2002 on personal data protection; Section 15(1); Sweden—Personal Data Act (1998:204); issued April 29, 1998, Section 31; and UK—Data Protection Act 1998, Schedule 1, Part I, Seventh Principle. 62. See, e.g., Finland—The Finnish Personal Data Act (523/1999), given on 22.4.1999, Section 32(1); Germany—Federal Data Protection Act as of January 1, 2003, Section 9; Hungary—Act LXIII of 1992 on the Protection of Personal Data and Public Access to Data of Public Interest, Article 10(1); Italy—Personal Data Protection Code, Legislative Decree No. 196 of 30 June 2003, Sections 31 and 33; Spain—Organic Law 15/1999 of December 13 on the Protection of Personal Data, Article 9. 63. 5 USC Sec. 552a. 64. 5 U.S.C. § 552a (d)(10) (emphasis added). 65. 42 U.S.C. 1320d-2(d)(2). 66. See, Gramm-Leach-Bliley Act ("GLB"), Public Law 106-102, §§ 501 and 505(b), 15 U.S.C. §§ 6801, 6805, and implementing regulations at 12 C.F.R. Part 30, Appendix B (OCC), 12 C.F.R. Part 208, Appendix D (Federal Reserve System), 12 C.F.R. Part 364, Appendix B (FDIC), 12 C.F.R. Part 568 (Office of Thrift Supervision) and 16 C.F.R. Part 314 (FTC) (emphasis added). 67. Cal. Civil Code § 1798.81.5(b). 68. See UN Convention at Article 9(3), 9(4), and 9(5). 69. ISO/IEC 27001, Information Technology—Security Techniques—Information Security Management Systems—Requirements (October 2005). See text at footnotes 157–169, infra. February 1, 12 C.F.R. Part 30, Appendix B (OCC), 12 C.F.R. Part 208, Appendix D (Federal Reserve System), 12 C.F.R. Part 364, Appendix B (FDIC), 12 C.F.R. Part 568 (Office of Thrift May 16 C.F.R. Part 44 U.S.C. Section 45 C.F.R. 164. See of the on by of the Technology and Homeland Security of the Committee on the United States 21, 2007 at p. (noting that FTC under the GLB Act as a for the obligation to maintain reasonable and appropriate available at See also, of the the on Information and the Committee on U.S. House of on April 21, 2004, at p. 5 (noting that is an of reasonable and appropriate measures in of the available at See, e.g., FTC Decisions and Consent Decrees listed in the Appendix. See, e.g., National Association of Insurance for Information Model available at in at See, e.g., Consent Decrees listed in the Appendix. 78. See, e.g., Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006) and Bell v. Michigan Council, 2005 Mich. App. 353 (Mich. App. February 15, 2005). Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006). Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005). Committee on available at See, e.g., Italy—Personal Data Protection Code, Legislative Decree No. 196 of 30 June 2003, B, § Act No 428 of July 2002 on personal data § the Appendix, Act, B, Section Act, Section the Appendix, Act, Article Act, Section Act, 16(4); Act, Section 41(3); Act, Section Act, Section 32(1); Act, Section 9; Act, Article 10(3); Act, Article 10(1); Act, Article 24(1); Act, Article 13; Act, Article 14(1); Act, Section 15(1); Act, Article 9; Act, Section 31; UK Act, Schedule 1, Part I, Seventh Act, Article 7. the Appendix, Act, Schedule 2, Section Act, Act, Schedule 1, 4.7 Principle 7, Act, Section Act, Section Act, B, Sections and Act, Sections 17 and the Appendix, Act, Section A Security § Act, Section Decree the Appendix, Decree the Appendix, Act, Section Principle 4; Act, Article Act, Article Act, Sections and Act, Section Act, Section Act, Section Act, B, Sections and Act, Sections 17 and Bruce & Digital Security in a & at p. See, e.g., HIPAA Security Regulations, 45 C.F.R. Section See, e.g., Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of Discontinuance, Para. p. Eli Lilly Decision at II.B; GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part See, e.g., Microsoft Consent Decree at II, p. 4; Eli Lilly Decision at See, e.g., FISMA, 44 U.S.C. Sections and GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part See, e.g., In Electronic July 30, Financial Council, 2; available at See, e.g., Microsoft Consent Decree at II, p. 4; GLB Security Regulations (OCC), 12 C.F.R. Part 30 Appendix B, Part Eli Lilly Decision at II.B; HIPAA Security Regulations, 45 C.F.R. Section Information Security Management Act of 2002 44 U.S.C. Section See, e.g., Microsoft Consent Decree at II, p. 4; GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section Information Security Management Act of 2002 44 U.S.C. Section See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Information Security Management Act of 2002 44 U.S.C. Section See, e.g., Microsoft Consent Decree at II, p. 4; GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section See, e.g., HIPAA Security Regulations, 45 C.F.R. Section See, e.g., United States v. Cir. See, e.g., Inc. v. also v. or of to with and of See, e.g., HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part and Part FISMA, 44 U.S.C. Sections and Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of HIPAA Security Regulations, 45 CFR Section and and on HIPAA Security of & Section of Science & Technology Law, No. April 2003, at p. 2, available at See, e.g., HIPAA regulations 45 C.F.R. Sections and GLB Regulations, 12 C.F.R. 208, Appendix and 12 C.F.R. Part 30, Appendix B, Part Microsoft Consent at p. 4. HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Sections and GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section and Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. p. 5 and Para. 25, p. 6. HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. 25, p. HIPAA Security Regulations, 45 C.F.R. Sections and Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section Ziff Davis Assurance of Discontinuance, and 26, pp. HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part See, e.g., FISMA, 44 U.S.C. Section HIPAA Security Regulations, 45 C.F.R. Section Ziff Davis Assurance of Discontinuance, Para. p. 5. Ziff Davis Assurance of Discontinuance, Para. p. 7. HIPAA Security Regulations, 45 C.F.R. Section Microsoft Consent Decree at II, p. 4. FISMA, 44 U.S.C. Section Eli Lilly Decision at GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. and p. 7; Eli Lilly Decision at HIPAA Security Regulations, 45 C.F.R. Section Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of Discontinuance, Para. and p. 7; Eli Lilly Decision at GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section and GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section Microsoft Consent Decree at II, p. 4; Eli Lilly Decision at Microsoft Consent Decree at p. 5. Ziff Davis Assurance of Discontinuance, Para. p. 7. See, e.g., of the of the of National on 21, at See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section and GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007). See Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005). See Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 at (D. Minn. February 7, 2006) that a was the to and a of a was not a of a of reasonable The Financial is a of U.S. federal agencies, that the Board of of the Reserve Insurance the National the of the of the and the of Thrift on on in an Internet 8, 2006 at p. available at on on in an Internet 8, 2006 at p. available at Guide for the Guidelines Information Security December available at Information Security July available at See National Institute of and Management Guide for Information Technology No. available at ISO/IEC 27001, Information Technology—Security Techniques—Information Security Management Systems—Requirements (October 2005) (hereinafter "ISO/IEC ISO/IEC § for is the and of International and is of a of the of with and a in that the The American National Institute the United States. See, The also in and in related to including The of make its with the United States. See ISO/IEC 27001, § (emphasis added). ISO/IEC 27001, § ISO/IEC 27001, § ISO/IEC 27001, § 164. ISO/IEC 27001, § ISO/IEC 27001, §§ and 6. ISO/IEC 27001, §§ and 8. ISO/IEC 27001, §§ ISO/IEC that with an International not in from legal p. 1. EU Data Protection Directive, Article 8. Article Data Protection on the processing of personal data to health in health February 15, at pp. available at (emphasis in See list of state laws in Report, Security and Laws of 15, 2005 at Appendix available at Code, § Rev. Stat. Available at www.pcisecuritystandards.org. See list in the Appendix. See, e.g., 16 CFR Section Health Insurance Portability and Accountability Act Security Regulations, 45 C.F.R. § HIPAA security regulations to in the Act Security Regulations, 12 C.F.R. Part 30 Appendix B, Part security regulations to information in the financial Homeland Security Act of 2002 § 1001(b), amending 44 U.S.C. § and § amending 44 U.S.C. § information and information systems from unauthorized and regulations, 21 C.F.R. Part 11. See, e.g., Cal. Civil Code § 1798.81.5(b). See April 2, the Matter of of the Act of of Information and Information Services, No. No. April 2, at available at (hereinafter Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007). in an Internet 12, 2005 available at This was by an on on in an Internet 8, available at of No. 25, The is an See, e.g., HIPAA Security Regulations, 45 C.F.R. § at p. 6. Ibid., at p. 3. Ibid. v. National 2007 U.S. App. Lexis 2007), at p. 13. See, e.g., on of Security Breach Personal of Privacy of April 2006 (hereinafter at pp. at note , at p. a of such in the United States and a of the number of individuals Privacy at IRS Rev. Proc. § See list of statutes in the Appendix. on for Access to Information and Part of A to Appendix, at 12 C.F.R. Part 30 (OCC), 12 C.F.R. Part (Federal Reserve System), 12 C.F.R. Part (FDIC), and 12 C.F.R. Part 568 (Office of Thrift 29, Vol. No. 29, at p. (hereinafter the maintains personal information that the not in the laws the to the or of the information, than the individuals of any of the security of the See, e.g., Code § Rev. Stat. § Code, § Stat. § Code § 2007 The also any combination of of information that to or the such as and or and See, e.g., Breach to the of & Financial Services, December 15 USC Section This that with the of at 15 USC Section and are of in this and are of in this See, and of a Duty to Information Security Computer & L. See and to Law the Protection of Personal BNA Privacy & Security Law Report, 19, p. May See at on the of the Framework for Electronic and Services, with focus on the 26, available at Science and Technology Committee, House of Internet of July 24, at Para. of the Privacy of Canada, for in to Privacy available at See Privacy Breach of the Privacy available at Privacy available at See, of the Privacy to the Law of February at available at Available at Available at to information to state

Purpose – The purpose of this paper is to make a case for the recognition of privacy and personal data protection as species of consumer rights in Nigeria in line with the revised United Nations Guidelines for Consumer Protection (UNGCP) by amending existing laws or enacting a new law to provide for personal data protection regime for consumers. Methodology/Approach/Design – The study follows a structured review of relevant extant legislation on consumer protection and personal data protection, namely the Federal Competition and Consumer Protection Act 2018 (FCCPA) and the Nigeria Data Protection Regulation 2019 (NDPR). Findings – The paper identifies that the provisions of Nigeria’s foremost consumer protection legislation, FCCPA, does cover electronic commerce (e-commerce) or consumer privacy and personal data protection while the NDPR, subsidiary legislation on personal data protection, which is yet to be effectively implemented is too general as to provide the consumers the much-needed privacy protection in their dealings with businesses. Practical Implications–Given the importance Recognition of data privacy and personal data protection as a species of consumer rights helps in understanding consumer protection in online transactions and opens opportunities for future research on consumer privacy and data protection. Originality/Value – Given the importance attached to the protection of consumer privacy and the various ramifications of transactions involving exposure of consumers’ personal data, recognition of privacy consumers’ rights to privacy is vital in consolidating knowledge of consumer rights and identifying paths for future research.

Reeta Sony A.L - National Law University, New Delhi, India. E-mail:reeta.sony@nludelhi.ac.in.Sri Krishna Deva Rao - Professor, National Law University, New Delhi, India. E-mail: psrikrishnadevarao@gmail.com.Bhukya Devi Prasad - Council of Scientific and Industrial Research, New Delhi, India. E-mail: bdeviprasad@csir.res.in. Cloud computing refers to anything that involves delivering hosted services over the Internet. It is fast, cheap, flexible and elastic in nature. In spite of its benefits, cloud computing raises risks for data protection and privacy. One key issue presented by cloud computing is the fact that it changes our thinking of what we consider to be "our data" Data is no longer physically stored on a specific set of computers or servers, but is rather geographically distributed. The globalised nature of cloud computing poses a challenge for personal data protection, which requires a clear location for personal data, an identification of the processor and a responsible individual for data processing. Cloud data can be misused and/or shared with third parties without prior knowledge or consent of the data owner. The direct participation of an individual in transborder data transfer, third party participation in data storage, the processing and transmission of dataand, finally, negligence of data protection due diligence from cloud service providers, makes data protection and privacy laws more relevant. The recent PRISM surveillance programme scandal at the US National Security Agency (NSA) demonstrated the privacy risks that citizens around the world take on when their personal informa­tion is stored and processed in the cloud. This situation requires awell-established techno-legal solution along international standards. India, unlike the European Union, has no dedicated regulatory framework to deal with privacy and personal data protection. Although cloud computing is still in its initial stages in India, existing laws for people who are currently using facilities offeredby cloud service providers are extremely inadequate. However, cloud computing requires legal protection in India under the country's data protection laws, privacy laws and data breach laws, which must meet "international standards'! It is the right time for the Indian government to enact appropriate regulatory frameworks to protect personal data and privacy in the cloud era. The overall objective of this paper is to understand the impact of cloud computing on privacy and personal data protection and to analyse present legal frameworks governing privacy and personal data protection in India and Europe.

The article examines the current state of legislation governing the protection of personal data, the challenges arising in its implementation, and the prospects for improving the protection mechanism through the use of blockchain technology. Frequent cases of unlawful dissemination of personal data in Kazakhstan are directly linked to unresolved issue of cybersecurity and the need to address vulnerabilities in the existing legislation, which underscores the relevance of the chosen research topic. The purpose of this study is to establish a legal framework for the protection and security of personal data through the use of digital technologies. The scientific novelty of this work lies in the fact that, for the first time since the formation of the legislative framework governing personal data in the Republic of Kazakhstan, legal norms regarding personal data have been defined, as well as areas of legal regulation for the circulation of certain types of personal data. Measures to improve existing legislation governing the circulation of personal data have been proposed. The above constitutes a national scientific doctrine in the field of personal data protection. New practical conclusions have been summarized, allowing for the improvement of existing national legislation and, consequently, their application in legislative activity. The research methods used include a general logical approach (induction, deduction), systematization, analysis, formulation, scientific methods, and empirical methods. Ensuring the security of personal data is a state obligation arising from the duty to protect individual human rights; therefore, the authors emphasize the particular importance of strengthening control over digital threats and introducing a procedure for assessing their impact on human rights in accordance with international standards. The study concludes that the Republic of Kazakhstan should accede to international instruments establishing standards for the protection of personal data. A potential pathway for strengthening the legal framework on personal data protection lies in establishing systemic safeguards that restrict unauthorized access to information. Such mechanisms should operate across all levels of data governance, ensuring consistent compliance among data holders, processors and supervisory entities. Based on the results of the research, it is proposed to adopt a legal norm regulating continuous control and monitoring by data owners, operators, and persons responsible for organizing the processing and storage of personal data.

This study focuses on the data protection of Indonesian citizens in transborder personal data transfers between Indonesia and Japan, which is increasingly relevant in the era of global connectivity and digital advances. Concerns about protection of personal data and security of personal data is increasing following existing progress. This research uses a comparative juridical approach, which allows for a comparison between the legal and regulatory frameworks protecting personal data in the two countries and conducts a comparative study of the two principles. The findings from this study show that Indonesia and Japan have implemented laws to protect the personal data of their citizens. Although there are similarities in the protection of personal data, there are differences in the mechanisms governing the requirements for transborder transfers of personal data between the two countries. This study uses a descriptive-analytic method to provide an overview and analysis of the application of regulations based on applicable legal provisions. The main objective is to analyze the differences and similarities between the two laws to draw general conclusions regarding the approaches and rules applied to the protection of personal data in Indonesia and Japan. Thus, this research provides important insights into the safeguarding of personal data in the context of transborder data transfers between the two country.This study focuses on the data protection of Indonesian citizens in transborder personal data transfers between Indonesia and Japan, which is increasingly relevant in the era of global connectivity and digital advances. Concerns about protection of personal data and security of personal data is increasing following existing progress. This research uses a comparative juridical approach, which allows for a comparison between the legal and regulatory frameworks protecting personal data in the two countries and conducts a comparative study of the two principles. The findings from this study show that Indonesia and Japan have implemented laws to protect the personal data of their citizens. Although there are similarities in the protection of personal data, there are differences in the mechanisms governing the requirements for transborder transfers of personal data between the two countries. This study uses a descriptive-analytic method to provide an overview and analysis of the application of regulations based on applicable legal provisions. The main objective is to analyze the differences and similarities between the two laws to draw general conclusions regarding the approaches and rules applied to the protection of personal data in Indonesia and Japan. Thus, this research provides important insights into the safeguarding of personal data in the context of transborder data transfers between the two country.

The General Data Protection Regulation (GDPR), enacted in the European Union in 2018, has significantly transformed the landscape of personal data management and protection. This article provides an overview of GDPR's impact, focusing on its applicability, fundamental principles and influence on data management practices, particularly within the European Society of Thoracic Surgeons (ESTS) database. GDPR's reach extends to all entities collecting and processing personal data of European Union residents, regardless of their location. It encompasses various data types, emphasizing meticulous handling and protection of identifiable information. Special categories of data, such as health and sensitive attributes, require even more stringent protection. The regulation sets legal, fair and transparent data processing principles, emphasizing accuracy, purpose limitation and data minimization. It also stresses accountability, leading to the appointment of Data Protection Officers and significant penalties for non-compliance. The ESTS database, designed to enhance thoracic surgical research and care, collects data on European procedures. It follows GDPR principles by pseudonymizing data, ensuring secure data transmission and providing clear instructions for data submission. The database contributes to research, policymaking and practice improvement in thoracic surgery by offering a comprehensive dataset for analysis. Here, we aim to shed light on the complexities of GDPR implementation and emphasize the need for comprehensive data management strategies to ensure compliance and enhance privacy protection with the contribution to the ESTS database. GDPR compliance comes with challenges, including potential human dignity and privacy rights violations. Data breaches can result in unauthorized disclosures, and non-compliance can lead to substantial fines and reputational damage. The implementation of GDPR encourages organizations to prioritize ethical data practices, security measures and transparent data handling. In conclusion, GDPR has revolutionized personal data protection by emphasizing accountability, transparency and individual rights. It has impacted organizations globally, promoting responsible data management practices. Adhering to GDPR ensures privacy protection, trust-building and overall enhancement of data management in today's data-driven environment.

The presence regulations related to personal data protection in Indonesia, provide a new task for the Indonesian government.Power in terms of personal data protection Still not yet given space maximum movement related to handling model processing of personal data, including the institution given authority.This research targets existence ecosystem model formulation protection of personal data by institutions processing of personal data.The model was obtained by conducting a comparison law between Indonesia and Malaysia.This is due to Because The Personal Data Protection Law in Malaysia has enacted since 2010.Another thing worth noting apply in the Indonesian PDP Law, namely regarding articles that regulate the duties and functions of the Data Protection Officer (DPO) in terms of his obligation protect personal data in a company.In addition, adjustments and arrangements overlap the overlap understanding from the concept of personal data must aligned.Because this concept is the key decomposer overlap the overlap rule Because the ambiguity of the concept of personal data protection in each regulation legislation.Previous research only conducted research to the extent of personal data protection, not yet leading to the DPO.There is room open to conduct further research related to the role of the DPO.This research uses socio-legal research methods, by linking various discipline science to answer his research.Related to DPO regulations in the ecosystem this personal data protection , Indonesia can be called late realize the rules are different from Malaysia which has own a system personal data protection and plans to improve to keep up with developments This personal data protection system.Malaysia's protection system is in accordance with OECD regulations so that the system formed has apply well.

The new development trends including Internet of Things (IoT), smart city, enterprises digital transformation and world's digital economy are at the top of the tide. The continuous growth of data storage pressure drives the rapid development of the entire storage market on account of massive data generated. By providing data storage and management, cloud storage system becomes an indispensable part of the new era. Currently, the governments, enterprises and individual users are actively migrating their data to the cloud. Such a huge amount of data can create magnanimous wealth. However, this increases the possible risk, for instance, unauthorized access, data leakage, sensitive information disclosure and privacy disclosure. Although there are some studies on data security and privacy protection, there is still a lack of systematic surveys on the subject in cloud storage system. In this paper, we make a comprehensive review of the literatures on data security and privacy issues, data encryption technology, and applicable countermeasures in cloud storage system. Specifically, we first make an overview of cloud storage, including definition, classification, architecture and applications. Secondly, we give a detailed analysis on challenges and requirements of data security and privacy protection in cloud storage system. Thirdly, data encryption technologies and protection methods are summarized. Finally, we discuss several open research topics of data security for cloud storage.

In Indonesia, the most recent case of personal data leakage of e-commerce consumers was the personal data leak of the Tokopedia marketplace which occurred in early May 2020. Around 91 million Tokopedia user account data were hacked and sold on the dark web for US$ 5,000. This personal data leak case a lawsuit was filed against the Minister of Communication and Informatics and PT Tokopedia and has been decided by Decision Number: 235/PDT.G/2020/PN.JKT.PST. Protection of personal data in Indonesia deserves to be studied and the problem must be resolved immediately. In this study, a normative juridical method was used and it was found that problems related to regulation also contributed to the fact that the protection of personal data of online application consumers in Indonesia was not maximized. This is due to the fact that existing laws regarding the protection of consumer personal data are still deemed unable to overcome the problems. In addition to regulatory issues, there are also problems regarding the government's lack of oversight of online applications that surf in cyberspace that collect personal data of application users. In this case, it is necessary to immediately pass the Bill on Personal Data Protection.

According to Eric Schmidt, Google CEO, the quantity of data which is now generated in only two days, equals the quantity of data which was generated since the beginning of civilization until 2003. Aggregation of technologies which are used for storing and the analysis of huge quantity of data are called Big Data, and are used in many aspects of human activity. Since both structured and non-structured sources of data are used in Big Data technology, there is a question of personal data and privacy protection. Are and in what ways various companies, agencies and services collecting and analyzing personal data from social networks in order to increase their efficiency, make profit or to increase general safety of citizens? Law on Protection of Personal Data regulates the protection of personal data of citizens as well as the supervision of the collection, processing and use of personal data in the Republic of Croatia. Provisions of this Law are applicable to the processing of personal data by state authorities, local authorities, as well as legal entities and private persons who process personal data. Has personal data which is stored and analyzed on daily basis become commodity without our consent?

One of the fundamental human rights protected by various international conventions is the right to the protection of privacy, or as defined in the European Convention on Human Rights, the right to respect private and family life. Affiliated to this right is also the right to data protection, which is described by various authors as a modern derivation of the right to privacy protection. The protection of personal data in the context of privacy protection was jeopardized by the rapid and widespread of information technology, automated data processing and the risk of access to this data by unauthorized persons on the network. The legal regulation for the non-violation of the right to respect private life by the processing of personal data with automated systems was one of the challenges of many states which had to allow the use of artificial intelligence for the benefit of further economic and social development, at the same time they had to ensure the protection of the personal data of their citizens. In this context, the EU has issued another regulation on personal data protection (General Data Protection Regulation (EU) 2016/679). The purpose of this paper is to highlight the impact of artificial intelligence on the right to respect private life and the legal protection of personal data from misuse through artificial intelligence.