3.1 Introduction to Accountable Organisations

Operating in an accountable manner is not simply a matter of deploying tools to implement technical controls and to report on their behaviour. It actually starts at the very top of the organisation, with the Board of Directors, is embedded in the foundation values of the organisation (organisational DNA), and is transmitted through the whole organisation through governance. In the following sections, we will explore the practices required to operate in an accountable manner.

The Accountability for Cloud Conceptual Framework [1] defines an accountable organisation as being one that takes an accountability-based approach, implying the adoption of the entire set of the accountability practices. The Conceptual Framework then expands on accountability at an organisational level, focusing on the ways it could be implemented in practice. For the benefit of the reader, these conclusions are listed below:

The Galway project [8] has defined the central elements that an accountable organisation (in the context of data protection) needs to address as being:

1. Organisation commitment to accountability and adoption of internal policies consistent with external criteria.
2. Mechanisms to put privacy policies into effect, including tools, training and education.
3. Systems for internal, ongoing oversight and assurance reviews and external verification.
4. Transparency and mechanisms for individual participation.
5. Means for remediation and external enforcement.

Influenced by this approach, the Canadian privacy commissioners have specified the measures that an accountability management program (for the data protection domain) would ideally include [9]:

1. establishing reporting mechanisms and reflecting these within the organisations privacy management program controls
2. putting in place privacy management program controls, namely:
   • a Personal Information Inventory to allow the organisation to identify the personal information in its custody, its sensitivity and the organisations authority for its collection, usage and disclosure
   • policies relating to: collection, use and disclosure of personal information (including requirements for consent and notification); access to and correction of personal information; retention and disposal of personal information; privacy requirements for third parties that handle personal information; security controls and role-based access; handling complaints by individuals about the organisations personal information handling practices
   • risk assessment mechanisms
   • training and education
   • breach and incident management
   • procedures for informing individuals about their privacy rights and the organisations program controls
3. developing an oversight and review plan that describes how the organisations program controls will be monitored and assessed
4. carrying out ongoing assessment and revision of the program controls above

Furthermore, the proposed EU General Data Protection Regulation (GDPR) [10] includes many accountability elements including, in Article 22, a list of a Data Controller's accountability instruments:

• Policies
• Documenting processing operations
• Implementing security requirements
• Data Protection Impact Assessments
• Prior authorisation/consultation by Data Protection Authorities (DPAs)
• Data Protection Officer
• If proportional, independent internal or external audits

While we have adopted a focus on the data protection domain and on accountability of organisations rather than individuals [1], one of our main concerns is accountability in the context of IT supply chains based on the use of cloud services. End-to-end accountability, which is further analysed in section 3.5, requires all actors of the provisioning chain to be accountable organisations to a certain degree. However, the domain for which these organisations need to be accountable is not necessarily the data protection domain. For example, when an organisation implements a service which is handling sensitive data (in regards to the data protection regulations) through the use of an IaaS cloud service provider, the latter is typically accountable for providing adequate security, and not for implementing an accountability-based data protection program.

It should be noted that, even if the focus as stated above is on organisations, the role of individuals involved is also essential and that accountability must be ensured down to the employee level. Accountable organisations must provide individuals with the necessary tools and procedures to be individually accountable.

In the remainder of this section, we have defined the control objectives and associated measures that should be implemented by an accountable organisation in a manner which remains agnostic to the domain. The recommendations have been identified based on work done for both the data protection domain, such as CNIL[11], ICO [12]], and Nymity [13]. These have been augmented by more general organisational standards, such as COBIT [14] and ISO 27001 [15]. We have also leveraged the HP Security Handbook [16] as well as the professional experience of the authors.