Cloud Computing and Personal Data Protection-A Comparative Study between Taiwan`s Personal Data Protection Act and European Data Protection Directive

Abstract

Cloud computing, which involves the storage by users of their information on remote data centers owned and operated by others and access through the Internet-is a fast growing business. However, while cloud computing allows its users to easily access to their information at anytime and anywhere, as long as there is internet connection, the technology brings serious data security and privacy concerns. From the personal data protection point of view, cloud computing service requires the study of legal relations among cloud computing providers, cloud computing service users, and data subjects. In addition, since relevant parties may not know where personal data is located geographically at any particular time, it is also worth considering whether this characteristic may have adverse impact on data protection, and how the law should respond. Thus, this paper aims to comprehensively review the related issues based on the newly enacted Personal Data Protection Act, and to provide suggestions for law enforcement and further discussion in this field.

雲端運算（cloud computing），亦即個人將其所擁有之資訊，儲存於由他人管理、運作的遠端資料中心上，並利用網際網路存取該等資訊之電腦資源利用方式，是目前政府及民間積極推動、發展之產業。然而，雲端運算服務讓使用者透過網際網路，不受時間、地點限制，隨意存取資料之便利性，卻同時對資料主體之資訊隱私產生嚴重衝擊。從個人資料保護的觀點出發，雲端運算服務可能涉及「雲端服務提供者」、「雲端服務使用者」與「資料主體」三方間的法律關係。此外，在使用雲端運算服務時，由於相關當事人未必清楚了解在特定時間，個人資料究竟儲存於何處（國）之遠端資料中心，此一特徵是否對個人資料之保護產生不利影響，在法制上又應如何因應，也值得加以研究。本文的目的即在於從新近通過的「個人資料保護法」的觀點，深入檢視雲端運算相關法律問題、提出建議，俾供將來相關討論或執法參考。