Overview of Cloud Computing: Data Embassies and Jurisdiction
The rapid adoption of cloud computing is fundamentally altering the management of data and resources. Cloud computing is empowering infrastructures of business operations, expanding their potential to grow without the usual costs or risks.
What is Cloud Computing?
Simply put, cloud computing grants a faster and more flexible method for individuals, businesses or the government to store and access data from anywhere at any time, as long as the internet is accessible. Files usually stored on hard drives can be saved on the cloud, ensuring quick and easy access to any file with enhanced security measures.
The delivery of computing services over the internet is not only constricted to data storage; networking, computing power, computer system resources and other technological benefits are additional rewards of cloud computing services. The overall aim is to ease the flow of information, ensuring on-demand access, business continuity and scalability.
How is Cloud Computing Regulated in Bahrain?
Cloud computing is regulated for the public and private sectors in Bahrain. The Cloud-First Policy provides a framework for the adoption of cloud technology for the public sector and various laws regulate cloud computing in the private sector, directly and indirectly, such as the Cloud Computing Services to Foreign Parties Law No. 56 of 2018 (the “Cloud Computing Law”) and the Personal Data Protection Law No. 30 of 2018.
(For more information regarding the Cloud-First Policy, please refer to a previously written article by Zu’bi & Partners linked here).
This article will provide an overview of the Cloud Computing Law as it relates to data embassies, governing laws and the jurisdiction of data.
What is a Data Embassy?
Hosting servers and storing data outside the physical space of an entity may lead to jurisdiction issues, specifically when considering cross-border cloud computing services that are located in a different country to the customer.
The concept of data embassies was initially established by the government of Estonia which underwent a series of cyberattacks rendering various public authorities and banks inoperable. Subsequent to the cyberattacks, a bilateral agreement was signed between Estonia and Luxembourg to establish Estonia’s data center in Luxembourg, deeming the country the first data embassy location internationally. As such, Estonian data is stored physically through cloud computing in Luxembourg, and yet the law and jurisdiction of the data remain governed by Estonia, similar to how foreign embassies work.
The Cloud Computing Law
The Kingdom of Bahrain took a step further and regulated cloud computing and data embassies for the private sector through the Cloud Computing Law, the purpose of which is to encourage foreign parties to use and invest in cloud computing services of data centers located in Bahrain.
Similar to the data embassy in Luxembourg, customers to cloud computing service providers (“Service Providers”) in Bahrain are subject to the governing law and exclusive jurisdiction of the country in which the customer is (i) domiciled, (ii) constituted, or (iii) established (“Foreign Country”). Thus, the competent courts and public authorities of the Foreign Country will have the power to issue binding orders executable on Service Providers in Bahrain. The legislation obliges the Service Providers to inform the Attorney General of Bahrain if an order is issued against the Service Provider from a competent court or public authority in a Foreign Country.
Resolution No. 67 of 2021, as amended, specifies the Foreign Countries that are included in the provisions of the Cloud Computing Law. These countries include, but are not limited to, the United States of America, the United Arab Emirates, the Kingdom of Spain, the Federative Republic of Brazil and others.
Cloud computing technologies are developing at an accelerated pace, providing enhanced cybersecurity, on-demand accessibility and economies of scale. The simultaneous growth of legislation we are witnessing today is crucial to avoid disputes, mitigate risk and protect the rights of all parties involved.
