On June 27th, 2022, the Romanian Government approved the Government Emergency Ordinance on implementing the Government Cloud Platform (Cloud GEO).
The Cloud GEO creates the legal framework enabling the setting up, management and development of a national hybrid-cloud infrastructure (the Platform).
The public entities responsible for the implementation, management, security, and development of the Platform are the Ministry of Research, Innovation and Digitalization (MCID), the Romanian Digitalization Authority (ADR), the Special Telecommunication Services (STS), the Romanian Intelligence Service (SRI) and the National Cybersecurity Authority (DNSC).
The Cloud GEO imposes a cloud-first policy for the public entities whose systems can be migrated in cloud services. Moreover, the Cloud GEO enables the public entities to use private cloud infrastructures, where needed, if such private clouds have in their technical structure elements such as:
- Basic cloud infrastructure;
- Infrastructure as a service (IaaS);
- Platform as a service (PaaS);
- Software as a service (SaaS).
For the private cloud infrastructures to be able to provide services for public entities, the requirements to be set out in (i) the guidelines on Cloud Governance and (ii) the standards on cloud services security need to be met. Such guidelines and standards will be set out in the secondary legislation to be issued by the relevant public entities – MCID, ADR, STS SRI and DNSC.
The purpose of the Cloud GEO is to continue the digitalization of the public administration. One of the key instruments in order to achieve this purpose is allowing private software developers to enter the Platform’s marketplace, where the public entities can choose from a wide variety of digital services provided by private companies.
With respect to the security concerns, the Cloud GEO provides that any inquiry carried out by a public entity with respect to citizens data will be duly recorded on blockchain technology, thus ensuring an adequate level of transparency. Moreover, the citizens will be immediately notified when public authorities access their data.
The Romanian version of this digest is available here.