I read an excellent article in The Register that, for me, was a leap forward in understanding the issue of data sovereignty. The author, Aaron Milne, makes the killer point that it doesn't matter who owns the data but "who has supreme power and authority over your data."
He asks the question:
"How can we protect our client’s data when it’s subject to the sovereignty of a foreign power? Especially if we believe the hype surrounding PRISM, when that foreign power has carte blanche access to our data without advising us it has done so, and gagging the cloud service provider from telling us?"
After reading Aaron's piece in The Register, and the readers’ comments, I could see a clear trend of organizations being concerned about the data security that a cloud service provider can provide. The readers’ comments were most indicative of this concern:
"I wouldn't recommend hosting any commercially sensitive data on services where a foreign government may have the ultimate say over who gets to see it. "
"I have been working through similar issues for clients and the interesting one that keeps popping up is who owns and runs the data centers and comms links. "
"We have seen an increase in customers wanting local EU or UK data sovereignty and showing mistrust of the vendors hosting the data in the USA or even hosting on EU shores but owned by a USA firm!"
For now concerns about data security are making organizations look more carefully at control and enhanced security that a private cloud offering would provide them, as an important requirement. For example, the London Borough of Camden chose a private-cloud deployment of Accellion while acknowledging their data storage policies might change in the future. They liked that they could move to a hybrid or even pure cloud Accellion deployment if and when the time was right.
The cloud debate is a debate that is bound to rage on. The cloud-only service providers will try to convince the market that their way is the only way, and for some organizations that may be right. Each enterprise needs to assess what is right for them today. This will depend on geography, how sensitive their content is, and how and where that content will be used.
Just remember, when the cloud advocates shout “jump,” make sure you know where you want your data to land.