OVH and personal data protection
The General Data Protection Regulation (GDPR) is the new legal framework of data protection law across the EU, and is due to come into force on 25th May 2018. Contrary to Directive 95/46/EC, which governed this processing prior to this point, the GDPR has direct effect within the Union and does not need to be transposed at national level. In this way, it will aim to harmonise laws governing the processing of personal data across Europe. Even better, the GDPR enshrines a principle of extraterritoriality, which means that, in certain circumstances, the scope of its application can be extended beyond the frontiers of Europe.
If you are an organisation that processes personal data, you are highly likely to be governed by the provisions of the GDPR. In this regard, you are subject to obligations and must abide by them. The same is true of OVH, which, in view of its situation, is bound by different obligations, in its capacity as a processor and as a data controller.
Understanding the real, specific issues at stake in European regulations is not always an easy task, especially when the regulation in question contains 99 articles, 173 recitals and numerous lines of guidance on how it will apply. Understanding these issues is nonetheless essential in order to avoid any risks that may arise from an excessively broad or imprecise interpretation of your organisation’s regulatory obligations. A proper understanding of the terms defined below is therefore essential:
- Personal data: any information relating to an identified or identifiable real person. An identifiable real person is defined as any real person who can be directly or indirectly identified.
- Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collecting, recording, transmission, storage, conservation, extracting, consultation, use, disclosure by transmission and so on.
- Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
- Processor: the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
OVH as a processor
It is undoubtedly in this last scenario that you will deal the most frequently with OVH. OVH is classed as a "processor" when it processes personal data on behalf of a data controller. This will typically be the case when you use the services of OVH and you store personal data on an OVH infrastructure. Within the limit of its technical restrictions, OVH may process any data stored solely in accordance with your instructions, and on your behalf.
OVH's commitments as a processor
As a processor, OVH commits to:
- Processing personal data solely for the purposes of carrying out the services correctly: OVH will never process your information for any other purposes (marketing, etc.).
- Keeping your data inside the EU and only in countries recognised by the European Union as offering a sufficient degree of protection, provided that you do not select a datacentre located in a geographical area outside the EU.
- Informing you if we have enlisted a subcontractor to process your personal data: to date, no services involving any access to data you have stored as part of the service have been subcontracted outside the OVH Group.
- Applying strict security standards to provide a high level of security for our customers.
- Reporting any data breach to you without "undue delay".
- Helping you meet your regulatory obligations, by providing you with comprehensive information on our services.
OVH's initiatives across Europe
As a testament to its commitments, OVH was one of the companies behind the creation of the CISPE association (Cloud Infrastructure Services Providers in Europe). This association drafted a code of conduct intended to promote the proper application of the GDPR by providers of Infrastructure as a Service (IaaS). By participating in this initiative, OVH is showing its intention to standardise the rules for personal data protection throughout Europe, and is being very demanding in this respect.
More info on OVH as a processor
Who owns the personal data used and stored by the customer as part of the services?
When may OVH access the data stored and used by the customer as part of its services?
Is the data belonging to OVH's European customers transferred outside the European Union?
OVH as a data controller
OVH is classed as a "data controller" when we determine the purpose and method of "our" personal data processing.
This is typically the case when OVH collects data for billing, managing accounts receivable, improving the quality of services and performance, sales prospecting, commercial management, etc. But it is also the case when OVH collects personal data on its own employees.
In this scenario, 'your' data - the data that you store on OVH's services - is not affected. On the other hand, certain information concerning you or concerning your employees (the identity and contact details of your contact person at OVH as part of a request for technical assistance, for example) may be. This is why OVH is keen to explain the guarantees put in place to ensure that this personal data is protected. OVH commits to:
- Limiting data collection to what is strictly necessary: as part of these efforts, when you order a service, you only enter the details needed for OVH to provide invoicing and support services, and to fulfil our own legal obligations concerning data retention (notably pursuant to Law 2004-575 of 21st June 2004, on confidence in the digital economy).
- Not using gathered data for any purposes other than those for which it was collected.
- Conserving personal data for a limited and proportionate time. So as an example, the data processed in order to manage the relationship between the customer and OVH (surname, first name, postal address, email address, etc.) is retained by OVH for the entire duration of the contract and thirty-six (36) months afterwards. At the end of this period, the data is deleted on all platforms and backups.
- Not transferring this data to third parties other than companies associated with OVH and acting as part of the performance of the contract. In the context of this intra-Group data sharing, certain data may be transferred outside the European Union, based on binding corporate rules implemented by OVH Group.
- Implementing appropriate technical and organisational measures to ensure a high degree of security.