The issue of data sovereignty in the European Union is becoming increasingly important, and Microsoft’ s recent statement to the French Senate only heightens concerns. The conglomerate admitted that it could not fully guarantee that European customer data would not be shared with US authorities. This statement, while sincere, casts a shadow over the concept of the ‘sovereign cloud’ promoted by major US providers.
The problem lies in a conflict of jurisdictions. On the one hand, US tech giants such as Microsoft, AWS and Google are investing in European data centres, promising that their EU customers’ information will remain on the continent. Initiatives such as the ‘Microsoft Sovereign Cloud’ are supposed to ensure compliance with local regulations and protect against unauthorised access. On the other hand, these same companies are subject to the US CLOUD Act, which obliges them to make data available to US law enforcement agencies upon request, regardless of where it is stored.
Microsoft representatives emphasise that the company is not defenceless and can challenge unfounded demands. So far, the conglomerate says, there has been no case of data from European servers being handed over under the CLOUD Act. But for many privacy experts and European decision-makers, this is not enough. The risk, even if theoretical, is unacceptable, especially in the context of the processing of sensitive data by public institutions.
The European Union, aware of its dependence – around 72% of the cloud market in Europe is in the hands of three US companies – is looking for alternatives. Initiatives such as Gaia-X aim to create a federated European data infrastructure that would provide greater control and sovereignty. However, this is a lengthy and expensive process, and it is extremely challenging to match the scale and technological sophistication of the US leaders.
As a result, European companies and institutions are faced with a difficult choice. They can continue to work with US providers, accepting the legal risks, or seek local alternatives that may not yet offer such advanced and comprehensive services. Microsoft’s acknowledgement that it ‘cannot guarantee’ full sovereignty is an important voice in this debate that will certainly accelerate Europe’s drive towards digital independence.
