Cloud vs On-Premise - Confidentiality

Cloud vs On-Premise – Article 3

Confidentiality Issues

This is the third of six articles that analyse the risk around cloud and on-premises systems.  As I stated in the first article, my view is that the caution many people adopt when ‘going cloud’ should be applied as much to on-premises systems to obtain the best risk profile for a business’ information systems.

In this article we analyse confidentiality issues.  The previous articles discussed:

Future articles will discuss data security, resilience and provide a summary.

Confidentiality

Confidentiality is clearly important in business generally and even more so in some sectors, such as defence, health and education.  As much as possible, we want to limit the access of our confidential business data to third parties.

The use of cloud services does require the data to be disclosed to third parties, these being at a minimum the cloud service provider.  Although most cloud providers encrypt the data they store, they also possess the keys to decrypt the data and must do so to process the data and display it in the web services they provide.

However, the issue of third-party access also exists in the on-premises context.  Most businesses will engage an IT provider to look after their on-premises systems.  These service providers will invariably have full ‘administrator’ access to your IT systems and the data stored within them – your files, emails, CRM data and so-on.  Clearly, these providers are third parties, and they usually have unfettered access to your systems and your data.

It follows that third-party access issues arise in the on-premises context as well as in the cloud context.

However, risks arise in the on-premises context, especially with smaller businesses who may not possess enough IT expertise to regulate the activities of third-party providers.  Also, some providers may not be aware to the risks around confidential data leading to activities such as backing up client data unencrypted to a USB drive.  In general, local providers do not provide the same level of control over data as cloud providers, especially the larger providers. This could lead to a greater risk of unauthorised disclosure in an on-premises context than in a cloud context.

At a minimum, the confidentiality risk is at least as prevalent in on-premises as it is in cloud.

Another aspect of confidentiality is the destruction of data.  If you delete a file or an email, is it really deleted?

In cloud systems the effects of data ‘deletion’ vary depending on the service provider and the terms offered.  Dropbox, for example, may keep data that has been deleted for up to 30 days.  Google’s terms say that it may keep data for up to six months.  Microsoft 365 retains deleted emails for 30 days and files for 90 days. However, these periods can be configured by your IT administrator.

The long retentions in cloud services are usually a result of backup cycles.  Although data may be ‘permanently’ deleted on the service itself, there may be copies kept on backup media and it may take some time for data to percolate out of the service provider’s backup cycle.

On-premises data gives an impression of greater control, but still needs to be managed carefully.  Desktop and laptop computers contain ‘Recycle Bins’ that may never be emptied.  In addition, the backup issue also exists in the on-premises context.  Data permanently deleted from a computer system may still persist on backup media for some time. A 12 month backup cycle would be common amongst most businesses, although many would have longer retentions, possibly seven years or more.

Table 2: Confidentiality

  Confidentiality provisions in terms Third-party access to data Re-sell data Delete/destroy data
Dropbox Not specified Not specified Do not sell personal information 30 days
Dropbox Business Yes Subcontractors Use anonymised data for any purpose Default 180 days, option for permanent
Google Workspace Yes Subcontractors Do not sell data for advertising purposes Up to six months after deletion
Microsoft 365 Yes ‘Subprocessors’ No Up to 180 days, option for permanent
On Premises Depends on IT provider(s) Yes No Depends on backup cycle
Verdict

At first glance, one would think that on-premises would win the data destruction issue, but if it does, it doesn’t by much.  Overall, my preference would be for the cloud system.  The data disclosure risk is managed better and, while there may be less control over data destruction, data is likely to be retained for a shorter period than an on-premises system.

In the next article we discuss data security, an issue widely perceived to be a risk with cloud systems, but which we will see is potentially a greater risk with on-premises systems.

For more information and expert advice, ask to speak to Mark Ferraretto at Ezra Legal on (08) 8231 6100 or email markf@ezralegal.com.au

For information and articles on the range of  IT and data privacy advice and services that we provide, head to:

 

Mark Ferraretto

Solicitor – Information Technology & Data Privacy

Ezra Legal

Categories: Blog, Technology

Leave a Comment

Your email address will not be published.

Scroll to Top