How to Achieve Compliance with GDPR Article 17 in a Hybrid Cloud Environment

Abstract

On 25 May 2018, the General Data Protection Regulation (GDPR)Article 17, the Right to Erasure (‘Right to be Forgotten’) came into force making it vital for organisations to identify, locate and delete all Personally Identifiable Information (PII) where a valid request is received from a data subject to erase their PII and the contractual period has expired. This must be done without undue delay and the organisation must be able to demonstrate reasonable measures were taken. Failure to comply may incur significant fines, not to mention impact to reputation. Many organisations do not understand their data, and the complexity of a hybrid cloud infrastructure means they do not have the resources to undertake this task. The variety of available tools are quite often unsuitable as they involve restructuring so there is one centralised data repository. This research aims to demonstrate compliance with GDPR’s Article 17 Right to Erasure (‘Right to be Forgotten’) is achievable in a Hybrid cloud environment by following a list of recommendations. However, 100% retrieval, 100% of time will not be possible, but we show that small organisations running an ad-hoc Hybrid cloud environment can demonstrate that reasonable measures were taken to be Right to Erasure (‘Right to be Forgotten’) compliant.

Legal Protection of Revenge and Deepfake Porn Victims in the European Union: Findings From a Comparative Legal Study

“…Therefore, when analyzing the map of the Union in terms of legislative solutions for “revenge porn” and “deepfake porn,” one should first examine whether any of the Member States has decided to criminalize them and, if not, what provisions are applied in the case of the assertion of rights by their victims. In the latter case, I predominantly refer to the “revenge porn” and non-consensual dissemination of intimate images (NCII) laws, which form the legal basis for the settlement of “deepfake porn” cases (Kelly et al, 2020).…”

Software-defined data protection

“…A vast majority of companies today rely on cloud services providers, for their infrastructural needs, making GDPR compliance in cloud environments a necessity. Therefore, rich related work proposes frameworks enabling cloud users to develop GDPR-compliant applications [35], GDPR-compliant databases [25,37], along with studies that outline the compliance challenges faced by cloud users [11,21,41]. Other works propose benchmarks [40] and tools [29] that test GDPR-compliance, and explore the benefits of trusted hardware to prove compliance [31].…”