Cloud sovereignty: Europe's laws as leverage against US providers
Brussels has long had the tools in its hand. It only lacks the courage to use them.
European authorities store their data with Amazon, Microsoft and Google. Three American corporations therefore control the majority of European cloud infrastructure.
This is not a new insight, but it carries more weight since Washington can, under the Cloud Act, demand access to data residing on these companies' servers at any time, regardless of where in the world they are located.
Laws instead of lip service
The European Data Act and the Digital Markets Act already provide levers to reduce dependencies. Companies can switch cloud providers more easily, data must be portable, and gatekeepers such as the large US platforms are subject to stricter rules. The problem is not a missing legal framework, but the hesitant implementation by national authorities, which remain with established providers out of convenience.
Austria shows this exemplarily: several federal ministries use Microsoft cloud services for sensitive administrative data. A 2023 study by the Austrian Institute of Technology highlighted the risks, but concrete consequences have not followed.
The reference to costs and the effort of migration apparently weighs heavier in ministries than the question of who would have access to citizen data in case of doubt.
Speed and substance are not mutually exclusive
The debate is often framed as an either-or: rapid digitisation or careful building of own structures. This juxtaposition is wrong. Gaia-X, the European cloud project, does not suffer from too high a pace, but from too little political backing and fragmented national interests. Germany, France and other member states pursued their own priorities instead of enforcing a common line.
The solution is closer than it seems. Public contracts could be linked to criteria of data sovereignty, as some German federal states are already demonstrating in IT tenders.
European providers such as OVHcloud from France or the German IONOS show that technical alternatives exist. The problem is not a lack of capacity, but a lack of political will to rethink existing contracts.
Conclusion
Europe does not have to choose between speed and sovereignty. The legal tools are ready, the Data Act came into force in 2024. What is missing is the consistent application by those authorities that still stick to US providers out of habit.
A column by the YANUS editorial team.
Source: POLITICO | Original Article