Challenges of Cloud Data Privacy in Surveillance: Legal, Technical, and Ethical Implications

Abstract: The migration of surveillance systems to cloud infrastructure has improved scalability and analytics capabilities but introduces distinct privacy challenges: jurisdictional conflicts between GDPR and the CLOUD Act, expanded attack surfaces from third-party integrations, mandatory retention that conflicts with data minimization, and function creep enabled by centralized data lakes. Using case law from Schrems II, breach reports from ENISA, and technical evaluations of federated learning and differential privacy, this paper systematizes core risks of cloud surveillance. We contribute: 1) a taxonomy of seven cloud-surveillance privacy challenges, 2) an end-to-end architecture with privacy controls, 3) a STRIDE+LINDDUN threat model, and 4) a four-layer mitigation framework. Evaluation shows federated learning reduces raw video egress by 98% with 4% F1 loss, while geo-fenced encryption satisfies Schrems II supplementary measures. We argue that technical safeguards alone are insufficient without multilateral legal harmonization and independent oversight.

Keywords: Cloud surveillance, data privacy, GDPR, CLOUD Act, differential privacy, federated learning, STRIDE, cross-border data, immutability.