[MacTUG] fyi: Cloud privacy: would UW be informed if an UW person's data has been accessed by law enforcement?

[Marlon A Griffith]

Ed,

I don't seem to have your email in my thunderbird database.

cheers.

-------- Forwarded Message --------
Subject: RE: Cloud privacy: would UW be informed if an UW person's data 
has been accessed by law enforcement?
Date: Wed, 31 Aug 2022 17:31:36 +0000
From: Group Freedom of Information and Privacy Protection 
<fippa at uwaterloo.ca>

Hi Marlon,

Thanks for your question: would UW be informed if an UW person's data 
has been accessed by law enforcement?

I cannot speak for all cloud companies of course....but generally 
speaking, there is usually a contractual agreement that will outline how 
such cases are treated (with often seeing the wording along the lines 
that the University, if allowed by law, is to be informed if the 
third-party vendor receives a request for access to information). 
Companies' websites (such as through their published user agreement 
and/or privacy policy) are also other places that these things, 
including caveats, are outlined.

Aside from your question, I would recommend that your sysadm ensure to 
touch base with Information Security Services (Jason Testart) to further 
discuss what you may be contemplating.  They can point you to existing 
cloud resources, or assist with assessing alternatives if you are 
considering those. There is a privacy and security review process for 
new initiatives https://uwaterloo.ca/privacy/information-risk-assessment.

Kathy

Kathy Winter, Ph.D., C.Psych.
Privacy Officer and Assistant University Secretary
Secretariat, University of Waterloo
3060 Needles Hall
200 University Ave​ West
Waterloo ON N2L 3G1
Phone: 519-888-4567 Ext 36101
Fax: 519-888-4327


The information in this message, including any attachments, may contain 
confidential or personal information intended only for the person(s) 
named above and that may be subject to the provisions of the Freedom of 
Information and Protection of Privacy Act or other applicable privacy 
legislation. Any other distribution, printing, copying or disclosure 
which is not necessary and proper in the discharge of the University's 
functions is strictly prohibited.  If you are not the intended recipient 
or have received this message in error, please notify us immediately by 
reply e-mail and permanently delete the original transmission from us, 
including any attachments, without making a copy.  Thank you.



-----Original Message-----
From: Marlon A Griffith <m3griffi at engmail.uwaterloo.ca>
Sent: Tuesday, August 30, 2022 11:04 AM
To: Group Freedom of Information and Privacy Protection <fippa at uwaterloo.ca>
Subject: Cloud privacy: would UW be informed if an UW person's data has 
been accessed by law enforcement?

Hello Kathy,

This is on behalf of a sysadm who is considering moving computer 
accounts to the cloud.

We know that:
* the cloud company can not say no, if law enforcement has a warrant
* IST prefers companies with Canadian data centres.

tia (thanks in advance),
Marlon