On the hearing of the Chief Legal Officer of Microsoft France: Commentary by Jerome Evans
German data center operators, in particular, know firsthand how much importance their customers attach to the integrity and security of their data. But by now it should be clear to everyone that security is an illusion as long as European companies and public bodies rely on cloud services from US providers – and yes, that also applies when providers advertise with data centers in Europe.
US clouds offer no data security
With unusual clarity, Microsoft has now confirmed once again what many do not want to believe: There is no protection against access by US authorities to data stored in Europe if it is held by US companies. The Chief Legal Officer of Microsoft France, Anton Carniaux, recently had to admit this in a hearing before the French Senate: There is no guarantee that European users’ data will not be passed on to US authorities. Despite GDPR and technical measures, Microsoft says it cannot rule out access by US institutions, and this explicitly also applies to data that is stored exclusively in the EU.
Classification of the legal situation
The Cloud Act obliges US providers to release data upon a corresponding order, even if this would violate European data protection law. However, customers often receive no information about this. This situation clearly shows that Europe’s legal control and data sovereignty end where US law takes effect. This is the case with every US provider, regardless of where the servers are physically located. I therefore consider it urgently necessary to refocus on European solutions. Because only European data center operators are exclusively subject to the European legal framework. Only they can guarantee that data from business, research and public administration is not under the influence and access of foreign legal systems.
There is no alternative to European providers when it comes to data sovereignty
It is therefore important to no longer conduct the debate around technical facades, but to clearly name where genuine digital sovereignty begins: namely with the choice of infrastructure. Anyone who wants to protect personal and sensitive data must rely on European providers. Everything else remains a compromise at the expense of security and self-determination over our data.
About Jerome Evans
Jerome Evans is the founder and managing director of firstcolo GmbH. He has been involved in IT services and especially data centers for 20 years. He takes care of the construction and operation of data centers, but increasingly also of cloud-based server infrastructures. Jerome Evans is also an expert in blockchain technologies and actively contributes to shaping the future of firstcolo GmbH with his management skills.
