Mr Chris Chapman, chairman of the Australian Communications and Media Authority has flagged continued concerns about cloud security and data sovereignty during a presentation at the University of New South Wales in Sydney.

Mr Chapman, speaking at the launch of a new white paper, “Data Sovereignty and the Cloud” said the developing nature of cloud services has attracted new service providers into Australia.

“Many are not traditional communications market players, as they are currently defined in existing legislation—such as internet providers, telecommunications companies or device manufacturers.”

As with other dynamic industries, many new participants may not be familiar with existing regulatory obligations, such as consumer safeguards and protections.

“Unquestionably, there is obvious risk that particular providers and users of cloud services are uncertain about whether specific obligations apply, or do not apply, to their activities.”

Pre-internet data protection

Existing personal data protections were developed in a pre-internet age, Mr Chapman noted. “From the ACMA’s perspective, the evolution of the information economy will of necessity drive Australia’s cloud industry itself to be more active in managing this transition.“

But there is limited understanding about how cloud computing works. Additionally, there is insufficient clarity about the safeguards needed to create, store, use and share personal data across different jurisdictions.

Cloud standards

The absence of commonly-agreed technical standards between cloud computing services means that users may risk losing their content and media where they change service providers.

“For some business and consumers, this is an increasingly high barrier as social and professional lives move on-line. So, we can readily anticipate the development of standards to better operationalise compliance of data management and privacy rights.”

Data sovereignty

Concerns revolve around data sovereignty – the ownership of data and access to data stored in countries, other than the one where the end user resides.

Australia needs “relevant redress mechanisms” and citizens being able to act on, or seek remedies against cloud providers in other jurisdictions, where needed. Mr Chapman noted.

Consumer confidence

Among recent findings, ACMA research showed that 52 per cent of Australians have a low level of confidence in the privacy settings of on-line providers. Another 35 per cent said they would withhold personal information where a site is not based in Australia.

The ACMA, however, acknowledges that security concerns arise in a complex environment, spanning national and international law. The agency is flagging a unified and coherent regulatory framework to tackle domestic and cross-border concerns.

“We believe that consumers, including providers and users of cloud services, would best be protected by a single coherent regulatory framework,” Mr Chapman added

“But it is starting to dawn on everyone—government and policy-makers alike—that this is likely to mean a pretty broad, potentially all-consuming framework. “