The Office of the Data Protection Ombudsman launches an investigation into the use of cloud-based services in the public sector as a part of a coordinated action of European supervisory authorities

The Office of the Data Protection Ombudsman will participate in a coordinated enforcement action of the European Data Protection Board along with 22 other supervisory authorities. The purpose of the action is to investigate use of cloud-based services in the public sector. The action of the EDPB was launched on 15 February.

Supervisory authorities will focus on investigating challenges related to compliance with the GDPR in connection with use of cloud-based services by public organisations. Measures will address more than 80 public bodies, including EU institutions, covering sectors such as health, finance, tax, education and IT services.

The Office of the Da.ta Protection Ombudsman has selected three public sector bodies to address. These bodies will be sent a survey prepared in cooperation with other supervisory authorities. The organisations were chosen for the coordinated action particularly because they process significant amounts of personal data of Finnish citizens. The survey will be sent to the organisations within a week.

The action on cloud-based services is the first coordinated action of the European Data Protection Board implementing the EDPB’s strategic goal of promoting cooperation between European supervisory authorities.

The aim of the coordinated measure is to obtain information on processes of acquiring cloud-based services, challenges related to international transfer of data, use of safeguards and arrangements related to the controller-processor relationship, among other things. Through coordinated guidance and action, supervisory authorities aim to foster best practices and ensure adequate protection of personal data in the use of cloud-based services.

Supervisory authorities will analyse the results in a coordinated manner and will decide on possible further national actions. The aggregated results will also allow targeted follow-up measures at EU level. The EDPB will publish a report on the outcome of the analysis by the end of 2022.

Further information:

​​​​​​​Data Protection Ombudsman Anu Talus, anu.talus(at)om.fi, tel. +358 (0)29 566 6766

Press release on the website of the EDPB: ​​​​​​​Launch of coordinated enforcement on use of cloud by public sector (15.2.2022)