Placing the state in the cloud: Issues of data governance and public procurement

Abstract

This paper examines certain aspects of the legal framework that can make an impact on the public sector take-up of cloud services in the EU. The paper poses two questions that governments or public sector bodies will commonly ask themselves when considering moving data or operations into cloud: what public data sets or operations should or could be put into cloud; and how should cloud services be procured? The paper examines the legal framework surrounding both questions and identifies practices and potential barriers in the current framework. The first issue for public sector take-up of cloud concerns data governance and requirements concerning access to, and the security of, public sector data. Public bodies are subject to data governance obligations that distinguish them from other cloud users and can make an impact on the decision-making process for cloud adoption. At one end of the spectrum, there are freedom of information laws that render public sector data ‘open’ or ‘accessible’ by default; while at the other, states have fundamental obligations to protect data that can impact national security. As such, public bodies will generally need to operate some form of procedure capable of distinguishing the sensitivity of the data they hold. The development and deployment of robust data classification schemes can offer public bodies a tool for decision-making when handling public data, to enable them to decide whether cloud solutions are suitable and, if so, whether special conditions should be required of the cloud solution. The second issue for public sector take-up of cloud concerns the extent to which EU public procurement legislation is adapted to a cloud environment. One aspect of this is the need to fund innovative new cloud services for the public sector and the requirement to use procurement models that do not infringe state aid rules. This paper concludes by assessing whether new or different EU legislation or guidance is needed for public sector data classification or for public procurement in order to facilitate to public sector cloud take-up.