This deliverable presents the qualitative empirical findings of T:D-4.1 of Work Package 44 of the Cloud Accountability Project. This exploratory deliverable draws on qualitative interviews, documentary analysis and observation data to analyse how and why European data protection authorities (‘EU DPAs’) exercise one of their statutory enforcement powers, namely, investigations more frequently to determine the compliance of cloud providers with the relevant data protection laws. This deliverable presents four arguments. Firstly, regulating Cloud Providers through investigations is a complex process which involves different relationships of co-operation between various actors, such as DPAs operating under distinct data protection laws. In practice, manifold interactions and practices, such as facilitative instruments, are deployed to form and perform such collaborative tasks which are significant to ensure the consistent application and enforcement of common data protection principles (derived from distinct in an increasingly globalised context. Moreover, complexity can also manifest itself through several factors, such as budgetary constraints and pressures from stakeholders including the press, which impact on key aspects of Cloud Investigations. How such complexities are resolved during Cloud Investigations can often involve intricate and context-specific strategies, such as delegating action to a third-party. Secondly, regulation through Cloud Investigation is dynamic as it is a process which involves constant activities from multiple actors. In particular, Cloud Investigations can involve constantly evolving regulatory styles (e.g. from soft to hard to soft) and compliance attitudes which mean that the regulatory encounters between Cloud Providers and EU DPAs during an investigation often involve ceaseless change. Thirdly, Cloud Investigations can, at times, be contested as EU DPAs and Cloud Providers attempt to resist each other's attempts to direct the investigation in particular ways. Finally, we argue that many reasons including the benefits of rapport-building, and relocation of some of the operations of multinational Cloud Providers to Europe, can account for why Cloud Investigations are growing in frequency in Europe. Here we also underline how the construction of specific realities during some Cloud Investigations (e.g. compliance attitudes) can hamper the effectiveness of Cloud Investigations as regulatory tools in the sense of enforcing all the relevant data protection laws.
Read full abstract