The European Data Protection Board (EDPB) has kicked off its first coordinated enforcement action, taking a long, hard look at the use of cloud-based services by the public sector.
The EDPB is concerned that the services obtained might not comply with rules concerning the protection of personal data. Hence, the requirement that Supervising Authorities (SA) “explore public bodies’ challenges with GDPR compliance when using cloud-based services.”
“Regardless of whether the cloud provider is a processor or independent data controller, If the cloud is outside the UK or EEA then the data transfer provisions of the GDPR need to be followed through. The French regulator, CNIL, has begun enforcement action against Google Analytics.”
See https://www.theregister.com/2022/02/15/edpb_cloud/
#technology #cloudstorage #EU #datasovereignty