Protection of Personal Data in Clouds and Rights of Individuals

In this paper we explore the rights that individuals have under the EU’s General Data Protection Regulation (‘GDPR’) when their data are processed in clouds, and the remedies that might be available to them if those rights are breached. The complex nature of cloud ecosystems can make it difficult for appropriate information to be provided to individuals to enable them to understand what data will be collected, how their data may be used, and by whom. Moreover, some of the specific rights established by the GDPR are themselves inherently complex. Among other examples, we explore the right to move personal data from one service provider to another, and the practical impact in cloud environments of the right not to be subject to certain automated decision-making processes