Tel: (860) 651-8544

Cloud Application Licensing

DDTC suggests that with “sufficient means” cloud application licensing may not be necessary, provided the recipient is a US person employed by US government or corporation

The State Department posted a response to a company’s recent post and subsequent clarification regarding a State Department advisory opinion. In the original opinion, the DDTC said that tokenization (the process of substituting sensitive data with a non-sensitive place-holding token, allowing one to substitute the original data back in when security can be heightened) could be used to process controlled technical data utilizing cloud-computing applications without a license, even if their servers were located outside of the US, provided that “sufficient means are taken to ensure the technical data may only be received and used by U.S. persons” employed by either the US government or US corporation.  The opinion went on to reiterate the necessity of licenses for transfers to foreign persons.

                The clarification reiterates the need of a license if the transfer of controlled data is to be directed to a foreign person.  Additionally, the DDTC clarified they were not implying that tokenization itself is a “sufficient mean” to assure that data would be secure or even if the necessary technology yet exists. The DDTC also addresses the limited scope of each advisory opinion, and clarifies that no precedent is set for future matters by this opinion.

Comments are closed.