Background

• Scope and aim: analysing the restriction under Arts.25–6, EU Data Protection Directive (Directive 95/46/EC) on ‘transfer’ of personal data ‘to’ ‘third countries’ outside the European Economic Area (Restriction), as a barrier to EEA controllers’ processing of digital personal data using public cloud computing. • Physical ‘data localization’ approach of EEA data protection authorities and others. • Basic concepts and terminology regarding cloud computing (service and deployment models, characteristics of infrastructure cloud and layered cloud services). Cloud use in the EU. • Overview of EU data protection laws under the Data Protection Directive, objectives, data controllers, processors, processing, exemptions, national law implementations, supervision, and fundamental data protection principles. • Key aspects of the Restriction. Mechanisms for allowing transfers: adequate protection, adequate safeguards. Derogations. • GDPR’s version of the Restriction. Keywords: cloud computing, Data Protection Directive, General Data Protection Regulation (GDPR), international transfers, third countries, data localization