Бикбулатова Ю.С_Summery (1138926), страница 2
Текст из файла (страница 2)
In8 particular, 30 various cloud computing services were analyzed along with theprovisions of agreements tied to them. We studied Russian and foreign judicialpractice, as well as official law interpretations, guidelines and recommendations,local regulatory and self-regulatory acts, non-regulatory and advisory documents,research works submitted by business community, as well as applied the author’spractical experience of participation in research and review projects.The theoretical basis of the research was formed by the works of nationaltheoreticians in the State and Law sphere and experts in constitutional,international, civil and administrative law: S.S.
Alekseev, L.F. Apt, S.N. Bratus,V.N. Vasin, A.B. Vengerov, V.B. Isakov, D.A. Kerimov, Yu.K. Krasnov, M.N.Marchenko, V.S. Nersesyants, I.B. Novitsky, M.M. Rassolov, E.A. Sukhanov,Yu.A. Tikhomirov, R.O. Khalfina, V.A. Chetvernin, V.E. Chirkin.The works of the following national legal scientists formed the foundation forthe study of information issues: V.V. Arhipov, I.L. Bachilo, I.Yu.
Bogdanovskaya,E.A. Voynikanis, A.S. Dupan, T.A. Polyakova, I.M. Rassolov, A.I. Savel'ev, A.A.Tedeev, L.K. Tereschenko, B.N. Topornin, M.A. Fedotov, A.I. Khimchenko andothers.The analysis of the international scientific and practical regulatory basicsrelated to the use of cloud technology required the study of the works of thefollowing scientists and experts: S. Barokas, S.
Bradshaw, J. Brenner, S.Kierkegaard, N. Carr, D. Koen, I. Lloyd, K. Kukie, V. Mayer-Schönberger, D.Noble, C. Millard, C. Reed, B. Franks, E. Schmidt, I. Walden and others.This research also involved the study of the works of the followinginformation technology experts: M. Van-Stein, G.I. Radchenko, V.O. Safonov, E.Tanenbaum, L.Z.
Shautsukova and others.The Scientific Novelty of the ResearchThis is the first comprehensive thesis focusing on regulatory aspects of therelationship between parties involved in the use of the cloud technology.9 Key Provisions to Be Defended1. Cloud computing is not a separate technology. It is an organizational model ofthe remote (network) use of the information system components (software,hardware and data), together or in part, at any time, in any volume and in anyconfiguration.
Thus, the subject of the cloud technology regulation is therelationship between the cloud service provider and a person who uses theinformation systems components (cloud technology user).2. The parties to the legal relationship around cloud computing are:1) the cloud service provider – a person who holds rights to all or severalcomponents of the cloud information system and provides users with an access tothe required components of that system;2) the cloud technology user – a person who uses cloud information systemcomponents, access to which has been granted by the cloud provider, to process hisown or third-party data.3. Specific features of the legal relationship forming around the cloud computing:1) The ‘information system operator’ status can belong to both parties (it isestablished separately in each case of cloud information system involvement).
Theinformation system involving cloud technology constitutes of the body of data,hardware and software of a both the cloud user and provider, which entails specificmutual responsibilities to ensure the data integrity and the information systemsecurity, and to perform other duties of the information system operator;2) The cloud technology service is essentially different and distinct from theregular communication service, whereby the cloud service provider is not requiredto have a telecom operator status. In spite of the fact that this type of technologydepends on the regular communication networks, any third party can provide thistype of service.4.
The object of legal relationship forming around the cloud computing is complexand includes both the information system elements (software, hardware and data)crucial for the cloud technology user, and the cloud service provider which givesaccess to the required components of the information systems.10 5. The cloud technology regulation should be based on the following principles:1) public-private cooperation: due to the complexity of such regulation, it isnecessary for the national government to withdraw from the detailed formulationof rights and obligations of the cloud computing parties and, instead, regulate thekey principles while granting the relevant nongovernmental institutions the rest ofthe regulatory load;2) technological neutrality of legislation: it is crucial to make the regulation asindependent from the technical features as possible so that its norms may becarried through by the parties regardless of technological advancement andchanges;3) international cooperation: the transboundary nature of cloud computingrelationships calls for achieving regulatory harmony with the existing internationallegislation.6.
The use of the cloud technology requires addressing the personal dataprotection issue by promoting responsible action among the legal entities involved:the user, the cloud provider, the operator, other professional parties to the legalrelations and their associations (public institutions and professional communities)and the government.7. The user as the personal data subject and/or operator (being the one whodetermines the ultimate goal of data processing and the necessity of datatransmission) is responsible for choosing the cloud information system andmaintaining its safe use which may entail the following activities:a) responsible assessment of the cloud provider before choosing him (takinginto account his reputation, transparency and data safety tests results);b) analysis of the purposes and conditions of the personal data processingbefore expressing consent to it;c) observance of precautionary measures during the cloud information systemuse (maintaining the password confidentiality, restricted access to theelectronic devices and proper information access settings, etc).11 8.
Entities engaged in the professional use of cloud technology are responsiblefor the following:1) the cloud technology provider should not justify incompliance withpersonal data processing principles by the technical features of cloud informationsystems. 8. The cloud technology provider is responsible for maintaining personaldata integrity in accordance with the Russian personal data protection law and forproviding the best practice in the context of the specific nature of the cloudinformation system operation.
The provider’s ongoing improvement of the internalmanagement and the technical advancement of data processing will bringfollowing results, inter alia:a) The adequate and accurate report on the processes going on within thecloud information system (transparency) including providing such report uponrequest;b) The data processing purposes and conditions are plainly, vividly,thoroughly and consistently articulated;c) Users are armed with the most effective personal safety means for theirmaximum control over their data privacy;d) Users are provided with an access to manage their personal data and obtaina copy of their personal data report, as well as information about their datasources;e) Transparent declaration of personal data processing purposes and theunrestricted access to the cloud computing in case of the user’s non-consent tothe secondary data processing purposes (i.e.
for research);f) Proactive steps for building user trust by increasing data security beyondthe requirements of law and providing user-friendly tools for personal dataprocessing (i.e. providing access to data on demand in the private onlineoffice);2) The communication service provider (as a distinct entity or a cloudtechnology provider) is responsible for users’ personal data privacy as part of his12 function of providing access to the cloud information system in accordance withthe Russian personal data protection law, communications law and best practice;3) Public institutions and professional communities formulate rules for theassessment of the cloud providers and the cloud information systems, and activelytest the integrity of cloud information systems and publish reports and materials toassist users in choosing the proper cloud information system;9.
At the governmental level, there is a need in a systemic policy, which isaimed both at increasing the overall information security and at promoting therelations formed around the cloud technology. With this aim in view, followingareas of regulation should be put in place:1) Adoption of a regulatory strategy concerning the relationships around thecloud computing;2) Adoption of a law with clear basic concepts: cloud technology, cloudservice provider, cloud technology user, cloud service agreement;3) Adoption of a law with the key rights and obligations of the cloudtechnology provider and user (including personal data safety requirements);4) Adoption of a law with specific requirements for cloud technologyproviders for processing governmental data, complete with the complianceconfirmation options (one or both), as follows;a) compliance assessment (accreditation or certification) of the cloudtechnology provider;b) mandatory participation of the cloud technology provider in a selfregulatory organization;5) Formulation of the guidelines (for legal entities) or concise road maps (forindividuals) with the input of professional communities to help the user make aninformed choice of a cloud technology provider with the best user data protection;6) Making out standard agreements between the cloud technology providerand user which would balance both parties’ interests;7) Raising the legal awareness of Internet users by spreading the informationabout the possible consequences of processing data in the clouds;13 8) Participation in the international regulatory work concerning the cloudtechnology while strengthening the digital sovereignty of our nation.The Theoretical Significance of the ResearchThe findings of this study will help ongoing regulatory work and research oflegal and information aspects of the relationship between parties using theinformation technology including clouds and Big Data processing.
Furthermore,they might enhance the development of the law doctrine on information processeswhich would regulate the rights of citizens of the Russian Federation to privacy inthe advanced contemporary digital technological circumstances.The Practical Significance of the ResearchThe conclusions and proposals formulated in this thesis might be applied inlawmaking to improve and structure the current legislation on information.Furthermore, this study may provide a scientific foundation for every stage of the‘Digital Economy in the Russian Federation’ Program approved by the decree ofthe Government of the Russian Federation on July 28, 2017 No.
![](https://s.studizba.com/z.php?f=/templates/si/i/noavatar.png&w=100&h=100&t=1"){kind=avatar}
