3.2.2 Analysis of survey outcomes

Figure 22 – Manner in which respondents were sought to complete the questionnaire

3.2.2 Analysis of survey outcomes 41 organisations completed online questionnaires were received by the closing date for the online survey (13th July 2016). This represented an eleven per cent response rate (from the 367 emails distributed). This is above average for a ‘cold calling’ online survey 33 . Obviously a sample size of only 40 self-selecting respondents should be treated with caution and extrapolations or conjecture about proportions of businesses with different characteristics must be avoided. A sample size of 2,000 is required to provide a confidence level of plus or minus two per cent.

This review will therefore simply focus on the characteristics of respondents and the different responses from those that had differing concerns about cross border data flow requirements.

90 per cent of respondents to this questionnaire described themselves as either an ‘expert’ or stated that they ‘knew a lot’ about their organisation’s use of cloud computing. Responses were received from 15 countries including 13 EU Member States. Respondents came from a range of organisation sizes with the largest organisation employing around 400,000 employees compared to the3 smallest with just one employee. The majority were SME’s (with less than 200 employees), however six respondents had more than 1,000 employees. These six were all from IT or technology related organisations, whereas the rest of the respondents were from varied industrial and sectoral organisations, such as creative industries, research and technology related companies, as well as some government sector representatives.

33 Nulty D. 2008. The adequacy of response rates to online and paper surveys. Assessment and Evaluation in Higher Education, 33, 3, 301-314.

Figure 23 – Location of online questionnaire respondents

United Kingdom 18

Switzerland 1 Austria 1

Belgium 3 Croatia 1 Denmark 1

Spain 3

Sweden 1 Finland 3 Germany 1

Italy 1

Netherlands 1

Poland 2

Portugal 2 Romania 1

Over three quarters of respondents reported that their organisation utilises cloud computing and the same amount reported that cloud computing was either ‘important’ or ‘very important’ in helping with their efficiency. Three quarters of respondents also considered the price of the cloud service to be an ‘important’ or ‘very important’ factor in the selection of a service provider. 25 respondents thought that the location of cloud servers was either ‘important’ or ‘very important’, with only six reporting server location was ‘unimportant’ or ‘very unimportant’. The relative unimportance to these six respondents was probably because they were SMEs were not using cloud computing. Four of the businesses were not IT or technological firms therefore cloud computing was not regarded as a necessity.

Regulations Just under half of respondents were aware of regulations, or knew that their organisation has encountered regulations or other requirements that hinder their organisations in cross-border flow of data within the EU.34

The main regulations known by the remaining respondents related to concerns about regulations regarding the use of personal data and data security. Six respondents reported personal data regulations, and four of these respondents from private sector organisations of different sizes and different locations across Europe all reported that their company has encountered the requirement for this regulation ‘frequently’. 15 out of 19 respondents who are aware of restrictions believed that regulations are ‘justified’ or ‘very justified’ in order to maintain privacy and security.

34 This is in reference to a question in the questionnaire that asks: in your country do you know of, or has your organisation encountered, any regulations or other requirements that hinder public or private organisations in the free flow of data across borders?

Respondents generally felt that knowledge and awareness of data regulations was more closely related to the size of a business or organisation than other factors, such as industry sector. Eleven respondents suggested that larger businesses were more aware; this was mainly due to their larger data holdings and the employment of dedicated roles, such as Data Protection Officers. In smaller businesses data was rarely overseen by a single employee and those involved were frequently not a data regulation or data management specialist.

One of the questions in the survey concerned the importance of the location of cloud servers to the respondents. 25 respondents stated that the location of servers were ‘Important’ or ‘Very Important’. These respondents were mainly IT Experts or from technical fields (Software Developer, etc.)

Conversely six respondents thought the location for the cloud server was ‘Unimportant’ or ‘Very Unimportant’. Amongst this later group of six respondents two companies stated their company does not use cloud computing. All the companies were small.

Another question asked whether they were aware of any regulations in their country for crossborder data. The 25 respondents that regarded server location as important were more aware of regulations concerning data regulations. Regulations frequently mentioned included personal data regulations, security and safety as well as specific regulations within their country. For example Spain has a Data Protection Law. The majority of this group thought regulations were sensible and justified.

The six respondents that thought the location of cloud servers were unimportant were generally unaware of regulations concerning data. The one respondent that was aware of regulations thought they were justified.

Overall the majority of respondents reported that their organisations were complying with regulations. More generally it became evident that larger organisations are more aware of cloud regulations than smaller organisations.

Estimating compliance costs in EU28 Member States Research undertaken by IDC for the European Commission35 estimated that in 2013 61.5 per cent of all businesses have at least one cloud based solution in their IT mix. This equates to more than 83 million EU28 businesses36 .

For some that might simply be their e-mail system or the use of a unified communications solution, for others it may be something more sophisticated such as a CRM solution, their accounting software or access to external computing power and storage upon which to run their own applications or store their data. By the end of 2015 IDC expected the number of businesses using cloud to reach almost 70 per cent of all business (over 93 million).

IDC highlighted that the Telecommunication/Media and Financial Services sectors were leading the use of cloud, both had close to 70 per cent usage levels by businesses in 2013 and reaching above 75 per cent by the end of 2015. By contrast the Public Sector was lagging slightly with only just over half of all Public Sector bodies using Cloud in 2013; this was expected to increase to just under 60 per cent in 2015. It further noted that on average it took about 2.5 person days (20 hours) for small businesses to consider and/or comply with regulations. For the 93.8 million cloud using businesses in

35 IDC. 2014. Uptake of Cloud in Europe. 36 Eurostat bd_9ac_l_form_r2.