Once your data is in the cloud, legal and technical boundaries begin to blur.

In the first report to track year-over-year change in the international policy landscape for cloud computing, Business Software Alliance's (BSA) Global Cloud Computing Scorecard examined and ranked the 24 countries that account for 80 percent of the global information and communication technology (ICT) market, including the United States, Japan, and Germany. 

The seven areas reflected in the BSA index are data privacy, promoting security, battling cybercrime, protecting intellectual property, ensuring data portability and the harmonization of international rules, promoting free trade, and establishing necessary IT infrastructures.

Though the U.S. is the frontrunner in terms of the size of its public cloud services market and volume of active mobile broadband subscriptions, Japan and Australia edged ahead thanks to policy strides in data privacy, fighting cyber crime, and property rights. Japan ranked first in BSA’s ranking, followed by Australia. The U.S. came in third.

Japan did particularly well with the question of security, a section of the scorecard that examines ongoing testing of security criteria, as well as electronic signature laws, Internet censorship, and filtering requirements. While many countries have clear, technology-neutral electronic signature laws, some overly prescriptive security requirements have begun to appear, such as new legislation in Indonesia that requires service providers to locate data centers inside the country.

Australia and Japan both scored high in terms of privacy, thanks largely to comprehensive privacy regulation that doesn’t have overly complex regulation requirements. National privacy regimes, BSA said, should be predictable and transparent, avoiding unnecessarily burdensome restrictions such as registration requirements for data controllers and cross-border data transfers. Most countries have a framework for data protection and established independent privacy commissioners, but registration requirements for those who hold or process data may sometimes act as barriers to taking up cloud services.

Some countries have also implemented Internet filtering or censorship, generally with the goal of addressing criminal conduct such as the distribution of illegal material. But some also block sites that express political dissent, ultimately barring the expansion of cloud computing in those areas. Australia dropped plans for mandatory filtering in 2012, improving the country’s BSA ranking.

The U.S. improved its rank (over Germany, previously in the third slot) mostly thanks to advances in standards development for cloud computing and infrastructure improvements, rather than major policy improvements.