Cloud Computing Policy and Personal Data Protection in the Cloud among the European Union, the United States, Australia and ASEAN : A Thailand Perspective

Abstract

The purposes of this research were: 1) to study concepts and theories related to personal data protection; 2) to compare cloud computing policy and personal data protection laws among various countries; and 3) to examine problems and difficulties concerning Thailand’s data protection in the cloud. The methodology employed documentary research, analysis of interviews with 10 cloud computing and data protection experts, and group discussion with 20 stakeholders from government, private, academic and community sectors. Analyzes showed that; 1) all member countries of OECD and EU had enacted the data protection laws; 2) most APEC member countries had passed the data protections laws. Government policy, meanwhile, played an important role in the adoption of cloud computing; and 3) the General Data Protection Regulation’s extraterritorial scope had implications for personal data controllers and for personal data processors (cloud service providers) outside of the EU that were processing the personal data of EU residents. Thus, the current draft data protection law, applicable only to personal data controllers domiciled or located within Thailand was not sufficient for protecting personal data in the cloud. This finding suggested that Thailand should set up a data governance framework and classified data into discrete categories for the appropriate management and use of classified data stored in the cloud. The enactment of its personal data protection law and expanded its legal scope accelerated to enforce its personal data protection law for personal data controllers and personal data processors domiciled or located outside of Thailand who were collecting, using, or disclosing personal data within Thailand.