How should Swedish companies react to the rejection of Privacy Shield? The cloud expert answers!

The invalidation of Privacy Shield has raised many questions among Swedish companies about how to handle current and future storage of personal data in the cloud. Therefore, we asked our cloud expert Victor Souza five questions, which provide concrete tips on how you, as the person responsible for IT architecture, should act.

– The biggest problem right now is the legal aspects. Since GDPR is a binding law for all EU companies, you risk breaking the law if you store personal data in American cloud services now that Privacy Shield is no longer available as a certificate for an approved protection level. This, in turn, can have serious financial consequences in the form of fines.

– Currently, the only mechanism that can be used to regulate the transfer of data from the EU to the USA is an older mechanism called SCC (Standard Contractual Clauses). So in the short term, you should primarily do a thorough review of where you currently store personal data, which companies have access to this data, and then ensure that they are covered by an SCC. In the long term, you should consider how you can find a more sustainable solution for your data storage. You need to take into account that the legal power struggle between the USA and the EU is unlikely to be resolved within the next few years.

– The simplest answer is: keep everything related to personal data within the EU. That way you can be sure you have the highest level of protection. Then develop a well-thought-out set of requirements, where the cloud provider's geographic location within the EU should be the first qualification. Keep in mind that it is the company's domicile that counts, not the data centre's location. You can then require security level, encryption possibilities, algorithm strength, confidentiality management, etc.

From a security and personal data management perspective, it is best to use a cloud service provider based in the EU. Beyond that, it somewhat depends on the amount of internal resources and expertise available. If you can handle complexity, we recommend using different cloud services based on their strengths, so-called hybrid cloud services. There are many providers on the market, all with areas they are good at and areas that are less good. You get the best mix by choosing a cloud service and provider based on the specific task to be solved. If you are a smaller company with fewer internal resources, I would recommend gathering all data in one place as far as possible. This avoids complexity.

– The first tip is to think long term. When it comes to storage, remember that the Cloud Act still applies in the USA and that their policy continues to lean more towards mass surveillance than data integrity. So you need to be a bit smart there! Tip two is to sketch out a solid architecture. Get help from your IT department or a cloud expert who has carried out previous cloud journeys to, for example, find out how many layers you need, what should be stored where, what requirements you have for performance and security, etc. This gives you a good and clear picture of what you want to achieve! My third tip is not to throw everything in the cloud at once. Take it step by step. Start by moving the easiest parts to get some quick wins to show within the organisation. Then move on to the parts that are a bit more difficult and have greater performance requirements. These are often things that need to be handled in real time, such as streaming, image or data processing. Save those for last!