National foreword

This British Standard is the UK implementation of ISO/IEC 19944‑1:2020. It supersedes BS ISO/IEC 19944:2017, which is withdrawn.

The UK participation in its preparation was entrusted to Technical Committee IST/38, Cloud Computing and Distributed Platforms.

A list of organizations represented on this committee can be obtained on request to its committee manager.

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 October 2020.

Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents) or the IEC list of patent declarations received (see https://patents.iec.c).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see

www.iso.org/iso/foreword.html.

This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information Technology, Subcommittee SC 38, Cloud Computing and Distributed Platforms.

This first edition of ISO/IEC 19944‑1, along with ISO/IEC 19944‑21 cancels and replaces ISO/IEC 19944:2017, which has been technically revised.

The main changes compared to the previous edition are as follows:

provides additional material which principally deals with organizational data and the need to treat some organizational data in particular ways in order to ensure confidentiality, integrity and so on,
the new concept of data facets is introduced and data facets are used to extend the expressiveness of data use statements, including adding the concept of which individuals or organizations have control over data,
the new data use categories are introduced, including some that address the newer uses of data associated with artificial intelligence systems.

A list of all parts in the ISO/IEC 19944 series can be found on the ISO website.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

This document provides a description of the ecosystem of devices and cloud services and the related flows of data between cloud services, cloud service customers, cloud service users and their devices. These are necessary to provide guidance about how data are used on the devices in the context of the cloud computing ecosystem and the associated location and identity issues that emerge from such use.

This document proposes a scheme for the structure of data use statements that can be used by cloud service providers to help cloud service customers understand and protect the privacy and confidentiality of their data and their users’ data through increased transparency of policies and practices.

This document may be used in several ways including, but not limited to:

by cloud service providers and application developers to guide them in describing what they intend to do with data in their designs, so as to simplify privacy and data use reviews and to communicate this information to non-technical departments such as internal compliance, marketing and legal teams;
by organisations drawing up data use statements as part of drafting cloud service agreements and application contracts, privacy statements, etc., which could apply to documents internal to an organisation, in addition to public or legal documents;
by government regulators and agencies to advise on suitable ways of describing data flow and use;
by those preparing information on data flow and data use for communication to the press and the public.

This document cannot be used for compliance directly. Instead, it provides a set of concepts and definitions, including a data taxonomy and data use statement structure, that can be used for transparency about how data are used in an ecosystem of devices and cloud services.

This document also aims to improve the understanding of the data flows that take place in an ecosystem consisting of devices accessing cloud services. It does this through an extended cloud computing reference architecture (CCRA) (based on the architecture described in ISO/IEC 17789) that describes the impact of devices on cloud service ecosystems and the impact of cloud services on devices. It also describes the data flows that take place within the extended reference architecture.

To maintain a relationship of trust between the stakeholders of the ecosystem of devices and cloud services and also to meet the demands of laws and regulations, it is necessary for the device platform providers and the cloud service providers to be transparent about how they make use of the various data types that flow within the ecosystem.

There is a particular need to provide simple and clear statements to end users about what is done with data that relates to them. The data may be personally identifiable information (PII) and may be sensitive, in other words, this can be a privacy issue. Cloud service customers are likely to be concerned about how their data are used, even when the customer is an organization rather than an individual. The cloud service customer may be a data controller, holding personal data about their employees or their customers; in such a role, the cloud service customer has obligations relating to the processing of that data.

To assist cloud service providers and device platform providers in being transparent about their use of data, this document defines a simple language for making statements about data use, which can be used to create clear notification to end users and other interested parties.

This version of ISO/IEC 19944 contains additional material which principally deals with organizational data and the need to treat some organizational data in particular ways in order to ensure confidentiality, integrity and so on.

To assist with this, the new concept of data facets is introduced and data facets are used to extend the expressiveness of data use statements, including adding the concept of which individuals or organizations have control over data.

New data use categories are introduced, including some that address the newer uses of data associated with artificial intelligence systems.

1 Scope

This document

extends the existing cloud computing vocabulary and reference architecture in ISO/IEC 17788 and ISO/IEC 17789 to describe an ecosystem involving devices using cloud services,
describes the various types of data flowing within the devices and cloud computing ecosystem,
describes the impact of connected devices on the data that flow within the cloud computing ecosystem,
describes flows of data between cloud services, cloud service customers and cloud service users,
provides foundational concepts, including a data taxonomy, and
identifies the categories of data that flow across the cloud service customer devices and cloud services.

This document is applicable primarily to cloud service providers, cloud service customers and cloud service users, but also to any person or organisation involved in legal, policy, technical or other implications of data flows between devices and cloud services.

2 Normative references

3 Terms and definitions

3.1 Terms related to data categories

3.2 Terms related to cloud services and devices ecosystem

3.3 Terms related to privacy

3.4 Terms related to organizational data

3.5 Terms related to artificial intelligence

3.6 General terms

4 Abbreviated terms

5 Structure of this document

5.1 Document organization

5.2 Overview and reference architecture

5.3 Data taxonomies, data categories and data use statement structure

6 Overview of devices and cloud services ecosystems

6.1 Background and context — Impact of devices and personalized cloud services

6.2 Ecosystem of devices and cloud services

6.3 Devices and multiple user sub-roles

7 Extending the CCRA to the devices and cloud services ecosystem

7.1 Overview

7.2 Personal and organizational environments

7.3 Device impact on the CCRA: User view

7.4 Device impact on the CCRA: functional view

8 Data taxonomy

8.1 Overview

8.2 Data categories

8.3 Data identification qualifiers

8.4 Orthogonal facets of data

9 Data processing and use categories

9.1 Overview

9.2 Data processing categories

9.3 Data use categories

9.4 Scopes: Boundaries of collection and use of data

10 Data use statements

10.1 Overview

10.2 Data use statement structure

10.3 Use of orthogonal data facets in data use statement

11 Data lineage and data provenance

11.1 General

11.2 Tracing data lineage

12 Use of taxonomy and data use statement in other computing environments

13 Use of data taxonomy and use statements in Artificial Intelligence scenarios

Bibliography

BS ISO/IEC 19944-1:2020

Cloud computing and distributed platforms. Data flow, data categories and data use - Fundamentals

Current, Under Review

Published:

31 Oct 2020