Protection of Personal Data in Clouds and Rights of Individuals

Abstract

Abstract This chapter focuses on the rights and remedies that individual users of cloud computing services may enjoy under the EU's General Data Protection Regulation (GDPR). It begins by considering the concept of the individual as 'data subject', which is inextricably linked to the concept of 'personal data'. The term 'data subject' is not defined explicitly in the GDPR. Instead, it is referenced in parenthesis within the definition of personal data. The definition of personal data is purposefully broad so as to include the vast range of information from which an individual may be identified. The chapter then explores the rights afforded to data subjects, including the right to be informed; the rights of access, rectification, and erasure; the right to data portability; the right to object to processing; and the right not to be subject to automated decision making, including profiling. Finally, it looks at the remedies and compensation available to data subjects. One of the biggest challenges to data subjects knowing and being able to exercise their rights is a potential lack of transparency with regard to how and by whom their personal data are collected and further processed in the cloud.