+Information on how investigation enquiries from government authorities are handled

Information on how investigation enquiries from government authorities are handled

In the system description, the Cloud Service Provider provides comprehensible and transparent information on how investigation enquiries by government agencies for access to or disclosure of cloud customer data are handled. The information includes the following aspects:
• Procedures to verify the legal basis of such enquiries;
• Procedures for informing and involving the affected cloud customers upon receipt of such enquiries;
• the ability of the affected Cloud customers to object; and
• whether the Cloud Service Provider has the ability to decrypt encrypted data of the cloud customers in case of such requests and how this ability for access or disclosure is used.
The scope of the information corresponds to the needs of the subject matter experts of the Cloud customers who define specifications on information security, implement these or validate their implementation and assess the suitability of the cloud service from a legal and regulatory point of view (e.g. IT, compliance, internal audit).
The legal foundation on which these governmental services are based (e.g. law enforcement agencies, intelligence services) vary from region to region. In particular, the applicable jurisdiction at the locations where data of cloud customers is processed, stored, backed up and stored must be considered.
In Germany, such powers are governed by the laws of the German Federal Criminal Police Office (or the laws of the respective state offices), various procedural codes for courts and the laws for intelligence services (BNDG, BVerfSchG, respective laws on the constitutional protection offices of the federal states, MADG) and the G10 Act.
In other countries, other laws are relevant, and the cloud customer may only occasionally be aware of them from the media, e.g. the CLOUD Act ("Clarifying Lawful Overseas Use of Data Act") from the United States of America or the Cyber Security Law of the People's Republic of China. In conjunction with the other information on the cloud service, the cloud customer should be able to use this information to carry out a risk assessment assessing if and how these are relevant.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti