Márton Domokos writes for “The Privacy Advisor” that On 18 July, the Hungarian Financial Supervisory Authority-PSZÁF (HFSA) issued a circular for Hungarian financial institutions on the use of cloud computing technologies. It is the first time in Hungary that a regulatory authority issued such an opinion. The document outlines detailed proposals for financial institutions on data classification, pre-contracting tasks and the contents of the service agreement with the cloud provider.
Regulatory considerations
The HFSA expressly reminds the management, IT internal audit, compliance and legal departments of financial institutions that if the company is willing to use cloud computing services, they shall pay particular attention to the following.
Obtaining cloud services is considered as “outsourcing” under the Hungarian sector-specific regulations which results in the application of certain additional rules; e.g., notification to the HFSA, specific data processing obligations.
It is important to continuously monitor the changes in the regulations of the EU affecting cloud computing services, practices and best practice recommendations.
It is also essential to keep an eye on the Hungarian and EU data privacy provisions and practices—in particular to practices and resolutions concerning cross-border data transfers or data transfers to third countries.
The relationship between the master services agreement to be concluded and the related SLAs shall be harmonised.
Data classification
According to the HFSA, it is important to classify the data processed by the financial institution before determining which data can be transferred to the cloud at all. The circular states that it is not recommended to process bank secrets, personal data or other sensitive data in the public cloud and reminds that the physical storage or place of procession of data in the public cloud in particular, e.g., outside of the European Economic Area or the Safe Harbor, substantially influence the possibility of compliance with the EU data protection regulations.
Read the whole text HERE.
pdpEcho 
Why blog about personal data protection?
I would rather not separate pdp from privacy issues and this is why my blog will also tackle privacy related subjects while concentrating on personal data protection legal developments around the world.
In order to answer the question in the title of this post, I will tell you why you should read pdp news and comments: because you need to know how to handle all your personal information shared knowingly or unknowingly with public authorities, governments, marketing companies, insurance agencies, social networks, telecommunication companies, schools and universities, banks, online stores and all the other public or private entities that store and manage any kind of information about you – starting with name and address, to health condition, ethnicity, photos, appearance, religion, phone calls you made, where you work and even what you like to eat.
Most of the information published here will have a legal approach because of who I am – a PhD student writing a thesis about personal data protection. But you will find much more than legal commentary. Enjoy!
Share this:
Like this:
Leave a comment
Posted in Comments
Tagged blog, blogging personal data protection, legal approach, personal data protection, privacy, private data, private entities, public authorities, telecommunication companies, writing a thesis