Head Out of the Clouds: What the United States May Learn from the European Union's Treatment of Data in the Cloud

Abstract

"Every cloud has its silver lining but it is sometimes a little dfficult to get it to the mint. " An attorney is awakened at 3:00 a.m. by a phone call from police. There has been a break-in at his firm, and a laptop filled with hundreds of client files containing sensitive data of payment records, client addresses and phone numbers, and trial strategies was stolen. Fortunately, the attorney has back-up files, knows what is missing, and who potentially has been affected. Later that morning, the hundreds of clients who have sought confidential advice from that attorney are alerted that their information has been stolen. It is a nightmare for many of the firm's attorneys, but the physical evidence immediately alerted the staff that there had been a security breach, and the office was able to respond to the situation quickly and effectively. The attorney decides that the solution to preventing the risk of having sensitive data stolen off the hardware from the office is to move all client data "to the cloud." Only those with authority would be able to access the data on the remote server, so even if a laptop were to go missing, nothing would be compromised. The problem, though, is that there may not be the same physical evidence of a breach, and an attorney or client may never know of a security threat because the information is stored on a remote server. The paradox of moving to the cloud is that personal data is, in many ways, more secure and less secure than it has ever been. Cloud computing has been growing in size and momentum in informational technology's collective conscience ever since the phrase was first used in its current context in 1997.2 The concept itself, though, is not really new, dating back at least to the 1960s. The name derived from telecommunication companies who changed their services from point-topoint circuits to Virtual Private Networks in the 1990s, and subsequently