Бикбулатова Ю.С_Summery (Информационно-правовое регулирование отношений, формирующихся при использовании облачных вычислений (сервисно-ориентированных распределённых информационных систем)), страница 4

This is due,first of all, to the fact that the cloud computing requires simultaneous use of cloud17  software both by the provider and the user, each acting as an information systemoperator. Moreover, this term doesn’t cover other inherent rights, duties andresponsibilities (i.e. the software provision, processing capacity, etc.) leaving theentity artificially limited by its legal status.Web hosting and cloud service do not match in volume. Thus, the fact that thecloud technology provides access to other objects besides data processing itself,i.e. software, does not allow to call a cloud service providing entity a ‘hostingprovider’.Chapter Two ‘Legal Issues of the Cloud Computing’ consists of twoparagraphs.

They address the specific issues and risks tied to cloud technology andthe implementation of legal principles in personal data and Big Data processing incloud information systems.The first paragraph of the Second Chapter ‘Legal Issues and Risks Posed bythe Cloud Technology’, by showing the various issues and risks in this sphere,determines potential regulatory strategies of these legal relationships. Theconstantly changing data processing approaches and methods complicate theprediction of emerging rights violations of the involved parties and requireattention of the regulatory bodies working to this sphere. The aspects ofreidentification and profiling, inter alia, are urgent and critical to the personal dataprocessing security.This paragraph assesses the particulars of legal relations within the ‘Big Dataas a Service’ organizational model of providing useful properties of cloudtechnology, as well as complex risks caused by the deep Big Data analytics in thecloud.The second paragraph of the Second chapter ‘Regulatory Issues Concerningthe Relationships Formed by Personal Data Processing in Clouds’ focuses onprocessing limited access and sensitive data in the cloud.

The personal dataprocessing justifiably attracts the greatest attention of national regulators and lawanalysts.18  The paragraph studies the data processing legal relations correlated with cloudcomputing legal relations. The entity responsible for the data storage and therelevant compliance control method (i.e. the distribution of responsibilities amongentities) plays crucial role in regulating cloud relations.The international regulation, which establishes the procedure for personal dataprocessing, has been analyzed. Also, details of the implementation of theinformation security principles and values of the personal data processing in cloudinformation systems are studied.Each principle is to be implemented with a corresponding set of specificrights, duties and responsibilities of the parties of the emerging legal relationswhich, in their turn, should also be enhanced, clarified and revised.

Let’s take thetransparency principle as an example: a cloud provider should furnish a way toassess the cloud information system’s user-friendliness; the personal data holdermust be provided with any supplementary information necessary to guard hisrights, including notification of the data collection fact and purpose, list of partiesinvolved and locations of data processing technical facilities.

The transparencyshould be stipulated in the relevant agreements concerning every link of the chain:between personal data subjects and operators (entities using the cloud informationsystem) and between operators and data processors (cloud providers, especially ifmany of them are involved).In the Third Chapter ‘Issues of the Cloud Technology RegulationImprovement’ we analyze the international regulatory experience concerning therelations formed by the cloud technology to identify the existing approaches andprinciples.

This allowed us to formulate proposals and recommendations thatwould enhance the national regulation concerning cloud technology in the RussianFederation.The first paragraph of the Third Chapter ‘Regulatory Approaches andPrinciples of the Cloud Computing Relations’ states that the cloud technologyadvancement in an everyday life reveals the critical regulatory vacuum concerningthe emerging legal relationships in many countries. We studied the relevant19  regulatory principles and trends of the United States of America, the EuropeanUnion, Japan and other countries.Potentially, the cloud computing might be subject to government regulation,public regulation (‘self-regulation’ in terms of the Russian law) and the regulationthrough the agreements between parties (local or contractual).The starting point of the public regulation might be an adoption of a strategicdocument, a plan that recognizes the fact of the enormous cloud technologyadvancement rate in a present-day life, expresses the government’s position on theissue and establishes action benchmarks.

Further, a specific two-fold programmight be adopted (on public and private use of the cloud technology) containing alist of tasks (including particularities of cloud computing and its evaluation criteria,the legal status of the parties involved, the aspects of access, disclosure, transferand processing of data in the cloud, as well as the organizational and technicalsecurity requirements, etc.).The cloud provider operation standards, features and conditions should bedetermined by the professional communities of public-private partnership. Theoutcome of their cooperation will lay the foundation for the dispositive norms oflaw including public regulation (self-regulation) through certification and enablingthe user to perform his own assessment of the cloud provider.In the conclusion, we reinstate the value of creating conditions for an expertassessment of the cloud provider due to the existing practice of leaving little roomfor the review of the cloud technology agreement terms (as in most cases, standardagreements are used).

As the users rarely possess the special knowledgeindispensable for the effective review and evaluation, the government shouldprovide the sufficient support.In the second paragraph of the Third Chapter ‘Improving the CloudTechnology Regulation in the Russian Federation’, we analyze the regulatoryapproach concerning the cloud technology in the Russian Federation and suggestways of improving it.20  We found that the Russian Federation has no unified regulatory position onthe cloud technology, including its principles, approaches and content, and lacksthe proper comprehension of this phenomenon.The thesis’ Conclusion summarizes the results of the research and formulatestheir key theoretical and practical implications.The bibliography contains a list of legal acts and literature relevant to theresearch.III. The Following Publications Contain Key Findings of this ThesisAuthor’s articles in the leading peer-reviewed scientific journals approved bythe Higher Attestation Commission of the Ministry of Education and Science ofthe Russian Federation:1.

Bikbulatova, Yu. S., Osobennosti pravovogo regulirovaniya otnosheniy,formiruyushchikhsya pri obrabotke bol’shikh ob’yomov dannykh s ispol’zovaniemoblachnykh tekhnologiy [Peculiarities of the regulation of relations formed by bigdata processing through the cloud technology] 32 (1) Trudy po intellektual’noysobstvennosti [Intellectual Property Works] 17-39 (Russia, 2018).2. Bikbulatova Yu.

S., Oblachnye tekhnologii kak osnovnoe napravlenie razvitiyatsifrovoy ekonomiki v Rossii [Cloud technology as a key to the digital economydevelopment in Russia: regulatory models] 31 (4) Trudy po intellektual’noysobstvennosti [Intellectual Property Works] 27-42 (Russia, 2017).3. Kozhevnikova Yu.S., Problemy reglamentatsii otnosheniy, formiruyushchikhsyapriispol’zovaniiregulirovaniyaiinformatsionnykhsamoregulirovaniyaoblachnykh[Regulatorytekhnologiy:issuessochetanieconcerningtheinformation cloud technologies: compromise between the public regulation andself-regulation] 13 Jurist [Jurist] 30-35 (Russia, 2014).4. Kozhevnikova Yu.S., Alekseevskaya E.I., Informatsionnye tekhnologii kaktochkasoprikosnoveniyaorganovispolnitel’noyisudebnoyvlasti,osushchestvlyayushchikh nadzornye polnomochiya [Information technologies as apoint of contact between executive and judicial supervisory authorities] 921  Gosudarstvennaja Vlast’ i Mestnoe Samoupravlenie [State Government and theLocal Governance] 35-39 (Russia, 2013).Other publications:5.

Dupan A.S., Zharova A.K., Zhulin A.B., Elin V.M., Bikbulatova Yu.S.,Bikbulatov T.I., Novaya paradigma zashchity i upravleniya personal’nymidannymi v Rossiyskoy Federatsii i zarubezhnykh stranakh v usloviyakh razvitiyasistem obrabotki dannykh v seti Internet [The new paradigm of personal dataprotection and management in the Russian Federation and other countries due tothe development of Internet data processing systems] (Higher School ofEconomics Publishing House, Moscow, 2016).6.