EU plans to restrict US cloud providers for sensitive data

The European Commission is preparing to restrict EU government use of US cloud providers for sensitive data, signalling a dramatic shift in European digital strategy. According to officials familiar with the talks, the Tech Sovereignty Package announced May 27 will include proposals limiting financial, judicial, and health data processing to European cloud infrastructure.

Europe’s dependence on US cloud hegemony has hit an important crossroads. Under the US Cloud Act of 2018, US authorities may demand access to data hosted by US corporations no matter where that data physically resides, which raises security fears for the European government as they process sensitive data belonging to European citizens.

As tensions rose between Europe and America during the Trump administration, EU countries ramped up efforts toward digital sovereignty.

As one Commission official explained the logic succinctly: “The basic premise is to identify certain sectors that must be hosted in European cloud capacity.” While the proposal would not explicitly block US companies, they would be barred from accessing government data.

Among other laws contained in the package are the CADA and the Chips Act 2.0, which are laws formulated to encourage European clouds and AI via procurement policies and market mechanisms.

The bills focus on government financial records, health care data, and judicial information, with private organisations not being affected at all. As a result, Europe is free to choose any cloud vendor in its region.

France seems to have been the first to act on the matter, releasing the Visio government-sponsored video conferencing software aimed at replacing Microsoft Teams and Zoom by 2027. In April, a contract worth 180 million euros was signed by the Commission for four sovereign European cloud projects.