Several major EU companies, including Deutsche Telekom, Orange, Airbus, and 15 others, have voiced their concerns over a proposal allowing tech giants like Amazon, Google’s Alphabet, and Microsoft to compete for sensitive EU cloud computing contracts.
The proposal, put forth by Belgium, the current holder of the rotating EU presidency, outlines a certification scheme (EUCS) aimed at ensuring the cybersecurity of cloud services. This scheme intends to assist EU governments and businesses in selecting secure and reliable vendors.
The new draft eliminates the previous requirement for US tech giants to form a joint venture with an EU-based company for storing and processing customer data within the EU to qualify for the EU cybersecurity label.
The Belgian proposal will undergo discussions among cybersecurity experts from the 27 EU countries on March 15. This could potentially lead to the European Commission adopting the cybersecurity scheme in the upcoming northern hemisphere autumn.
In a joint letter addressed to their respective national authorities and senior Commission officials, Deutsche Telekom, Orange, Airbus, and the other companies urged EU countries to reject the latest proposal lacking sovereignty requirements.
They emphasized the necessity of including EU headquarters and European control requirements in the primary scheme to mitigate the risk of unauthorized data access based on foreign laws.
Without these requirements, they cautioned that European data could be accessed by foreign governments under laws like the US Cloud Act or the Chinese National Intelligence Law.
While Big Tech aims to tap into the lucrative government cloud market for growth, the EU is concerned about potential illegal state surveillance and the dominance of US cloud providers.
The EU companies argued that the EU cybersecurity label should emulate the Gaia-X cloud computing platform. Gaia-X was created to lessen the EU’s reliance on Silicon Valley giants and includes sovereignty requirements.
The absence of sovereignty clauses could also hinder emerging EU cloud providers compared to their larger US counterparts.
“Omitting such requirements from the scheme would seriously jeopardize the feasibility of sovereign cloud solutions in Europe, many of which are either in progress or already available in the market,” the companies stated.
The joint letter’s signatories encompass various entities, including French power group EDF, French cloud services provider OVHcloud, Italian peer Aruba, Dassault Systemes, Germany’s Ionos, Telecom Italia, Austria’s Exoscale, French tech company Capgemini, and Eutelsat.