I’m currently managing director of Content and Business Planning at The Korea Times. Before I took the current position in early 2024, I served as managing editor in charge of both paper and online for over three and a half years. In 2015-2018, I worked as Singapore correspondent covering ASEAN nations.
Cloud services call for bigger accountability
By Kim Jae-kyoung
By Robert Kim
With ever-growing concerns regarding cloud computing, there is an increased need for collaboration among industry, regulatory bodies and third parties to create and implement more consistent and comprehensive approaches for accountability related to cloud services.
Greater clarity on accountability would accelerate the adoption of cloud computing among potential users who are currently reluctant to entrust mission-critical services to cloud services. Users want to know who is accountable if service levels are unsatisfactory, if they are unable to access data they put in the cloud provider or if it is accessed by unauthorized persons or government agencies. Particularly, users want clarity on accountability for service delivery in situations where providers leverage subcontractors, get acquired or go out of business.
Efforts to clarify accountability for legal compliance ― such as the development of data privacy and security compliance programs by cloud users or providers ― are hindered by unclear and sometimes inconsistent regulations.
It is therefore important to achieve clarity on whether cloud providers are considered data processors or data controllers, what the respective obligations of both parties are and which country’s laws apply to certain data when a cloud provider has data centers in multiple jurisdictions.
Possible technological approaches to the third point include tagging data with a specific jurisdiction code or encrypting all data before they move to cloud computing (although this is expensive and not foolproof).
Government stakeholders indicate that voluntary industry moves to clarify accountability and establish corporate compliance programs could reduce the need for regulatory intervention. There is an opportunity for third-party certification schemes to play an important role, and potential for further industry involvement in existing initiatives such as the Data Privacy Accountability Model, Privacy-by-Design and Binding Corporate Rules.
Industry players and government stakeholders need to agree on the extent to which it is possible to establish general principles regarding accountability, as some cloud providers expressed their views that accountability needs to be negotiated only with individual clients.
Robert Kim is a senior manager at Accenture Korea. He can be reached at robert.c.kim@accenture.com