Interests at stake: The interplay of digitization, cloud computing, and data security classification within the Icelandic government

Abstract

Iceland is among the leading nations in digital services. Steps in this journey include a comprehensive agreement with Microsoft for software and operational solutions, a cloud computing policy, and data security classification by the Icelandic state. Concurrently, public institutions must comply with the legal and regulatory framework of the National Archives of Iceland. In this article, this interplay is studied with a focus on its possible effects on daily information management practices in the public sector, an under-explored territory.

The purpose of this research is to examine the experiences of information management professionals regarding information security during accelerated use of cloud computing, alongside the implementation of Data Security Classification. We present survey data on information security from the Icelandic Records Management Association, as well as in-depth interviews on security classification and cloud computing with various information professionals.

Our results indicate that digitization has increased radically, while modifications of information and record management systems are limited. The general attitude towards cloud computing and Office 365 is positive despite somewhat deficient implementation processes. Few public entities had taken measures to provide guidance, set rules, or ensure data security regarding data storage in cloud computing. The research sheds light on concerns and potential shortcomings related to technological overconfidence. The results also indicate uncertainty regarding long-term preservation of records outside systematic information management systems. The effects could include fragmented preservation of digital data as well as a disconnect between digital development in information management and the legal framework.