銀行業與保險業運用雲端服務與個人資料保護之合規研究

Abstract

雲端運算自2010年開始商業化迄今已逾10年的發展，隨著資訊技術在軟硬體方面的革新、網際網路效能提升和新興行動科技的問世，無論是在雲端服務的模式(如SaaS、PaaS、IaaS)或是架構(如公有雲、私有雲、混和雲與社群雲)上都逐漸成熟，也使雲端運算在各領域(例如:公部門、醫療、金融、物流等)的運用漸成為趨勢。銀行業與保險業在雲端運算的運用上之前多以私有雲來進行 (例如巨量資料分析、區塊鏈的智能合約、智能客服等)，主因是考量法規依據與個資保護等議題，所以對於委外雲端服務大多在評估階段。2019年9月30日完成「金融機構作業委託他人處理內部作業制度及程序辦法」修訂後，銀行業與保險業在委外雲端的運用上有較明確的法規依據。日後便可依照相關辦法中所規範的原則建立委外雲端服務的系統架構。\n金融機構運用雲端服務的個資保護議題除了與「個人資料保護法」及「個人資料保護法施行細則」有關外，「金融機構作業委託他人處理內部作業制度及程序辦法」、「金融監督管理委員會指定非公務機關個人資料檔案安全維護辦法」、「保險業辦理資訊安全防護自律規範」等都是需要遵守的法規規範。在委外雲端服務的運用上若要符合個資保護的相關規範，就必須在委外雲端服務的合約中訂立適當的條款。合約中對於委外雲端作業的風險控管、委託者的最終監督義務、主管機關和委託者的實地查核權力、查核方式、資料保護機制、受託者權限管理、資料儲存地點及緊急應變計畫等都應在委外雲端服務合約中載明，以利個人資料保護的執行。本篇論文以此想法為出發點，並以目前委外雲端服務中較具規模業者的合約為討論對象，說明一般委外雲端服務合約對於相關法規的涵蓋程度。

Cloud computing has been commercialized in 2010 and developed for more than 10 years until now. With the innovation of information technology about software and hardware, the improvement of Internet performance and the advent of emerging mobile technology, both the model of cloud service (such as SaaS, PaaS, IaaS) and the architecture of cloud service (such as public cloud, private cloud, hybrid cloud and community cloud) are gradually matured. It is a trend that cloud service will gradually be used in various fields (such as public sector, healthcare, finance, logistics, etc.). Banking and insurance industries used private clouds as cloud computing for business purpose (such as big data analysis, blockchain smart contracts, smart customer service, etc.) during the past decade. The major reason is to consider the issues about legal requirement and personal information protection. Therefore, outsourcing cloud service is in the evaluation stage. After completed the regulation revision of the "Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation" on September 30, 2019, banking and insurance industries have more confirmed regulations to obey for the usage of outsourcing cloud service. In the future, a system architecture with outsourcing cloud services can be established in accordance with the principles specified by the relevant regulations.\nBesides the Personal Data Protection Act , banking and insurance industry using outsourcing cloud service also need to complied with the “Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation”, the insurance industry also have to abide the insurance industry self-regulatory regulations for information security protection and the security maintenance of personal data files for non-public organization regulations by the Financial Supervisory Commission (FSC). Therefore, the use of outsourcing cloud services must comply with the relevant regulations for personal data protection, it is necessary to establish appropriate terms in the outsourcing cloud service contract. In the contract, the risk control of the outsourcing cloud operation, the final supervision obligation of the client, the on-site inspection powers of the competent authority and the client, the inspection method, the data protection mechanism, the trustee`s authority management, the data storage location, and emergency response plans, etc. all should be stated in the outsourcing cloud service contract to facilitate the implementation of personal data protection. This paper uses this idea as the starting point to compare the contracts by the major outsourcing cloud services vendors with the regulation. To analysis the regulation coverage of the general cloud service contract.