In times of digitalization, public sector companies and those operating as part of the free economy must observe two basic rules to guarantee data security:
- IT infrastructure must be secure, flexible, and up to date at all times
- Data sovereignty over customer, user, and business data must be guaranteed.
Once appropriate safeguards and contractual arrangements are in place, companies can protect trade secrets and process personal data in accordance with EU data protection directives. Companies should always know how third-party service providers handle data and what rights of use they have. Since there are also legal uncertainties and gray areas when it comes to data sovereignty, it should be contractually regulated what happens to data and how it is stored, processed, and transferred.
An example:
If a production company wants to increase its performance, it can use the cloud and web services of a managed service provider. Via data analysis, this provider could, for example, make forecasts on maintenance tasks and determine the company’s optimization potential.
Although the commissioning company should have data sovereignty in this case, this does not mean it necessarily has access to all data analyses of the commissioned company. Unless otherwise contractually agreed, parts of the data could also be reused or sold to third parties. Here, a lack of data sovereignty creates a security risk and a competitive disadvantage for companies.
