Police cloud arrangements highlight difference between location and sovereignty
Questions have been raised about the protection of highly sensitive information held by more than 40 UK police forces on Microsoft’s Azure cloud platform.
According to a Guardian investigation, the information includes criminal records, victim testimony and internal police documents. A police assessment produced in 2017 reportedly warned that the data could be vulnerable to compromise by cybercriminals, foreign actors or insiders connected with the US government.
Microsoft and police representatives said that the information is held in UK-only data centres and would not be shared without permission. The reported concerns nevertheless illustrate that storing information physically within the UK does not necessarily resolve every issue concerning overseas access.
A cloud provider headquartered in another jurisdiction may be subject to legislation requiring it to disclose information or assist authorities. The US CLOUD Act, for example, can apply to information within a provider’s possession, custody or control even where the relevant servers are located overseas.
Data residency should therefore be distinguished from legal and operational sovereignty. The former concerns where information is stored, while the latter also encompasses which entities and governments may obtain access, who controls encryption keys and whether the customer can detect and challenge a disclosure.
Controllers considering cloud services for sensitive information should conduct a documented assessment of the laws applicable to the provider and its group companies. That assessment should address the likelihood and consequences of overseas demands, rather than relying only on the supplier’s chosen hosting region.
For particularly sensitive processing, organisations may need additional safeguards such as customer-controlled keys, confidential computing, segregation between workloads or a provider subject only to the intended jurisdiction. The appropriate measures should reflect the sensitivity, volume and consequences of unauthorised access.
