Fragmented Data Sovereignty Microsoft Confirms U.S. Access to EU Data Even With Local Hosting

Related Vendors

Microsoft Deutschland GmbH

Taiwan Machine Tool & Accessory Builders' Association (TMBA)

Wuxi InfiMotion Technology Co., Ltd.

Microsoft admitted during a hearing in the French Senate that the company cannot reliably protect EU data from access by U.S. authorities. This undermines the promise that European cloud data is safe with U.S. providers.

Locally stored data is not automatically protected from access by U.S. authorities—this was openly confirmed by Anton Carniaux, Chief Legal Counsel of Microsoft France, in early June.

"No, I cannot guarantee that the data of French citizens will never be transferred to U.S. authorities without the consent of the French authorities," said Carniaux during the Senate hearing under oath.

Microsoft's Transparency Remains Limited

The statement carries more weight because Microsoft has so far promoted its so-called "EU Data Boundary" as a solution for European customers to guarantee data processing within Europe. However, the technical safeguards apparently reach their limits where U.S. law applies.

According to Microsoft's own statements, data must be disclosed when U.S. authorities make formal requests. In many cases, the company is not even allowed to inform its customers about the access—Carniaux also confirmed this before the committee.

The French government refers to the incident as part of a broader investigation into digital sovereignty. This includes examining whether public institutions should continue relying on U.S.-based cloud services.

Experts See A Structural Problem

Security and privacy experts point out that the structural dependencies of European authorities and companies on U.S. service providers persist even under new frameworks like the Transatlantic Data Privacy Framework.

The developer and privacy advocate Ben Werdmuller commented: "When the provider's promise meets a court order, the court order always wins." For him, it's clear: the only reliable protection lies in client-side encryption, if necessary combined with EU-based hosting providers.

Dennis-Kenji Kipker, professor of IT security law, emphasizes that Microsoft's admissions are unsurprising but unequivocal: "It is now clear that these flowery marketing promises, discussions about data borders, and semi-sovereign clouds do not constitute effective protection mechanisms," he said in an interview with heise.de and concludes: "As a U.S. company, Microsoft must comply with U.S. jurisdiction—regardless of what the marketing promises say."

At the same source, attorney Stefan Hessel disagrees and explains that a European subsidiary of a U.S. cloud provider is not bound by U.S. law: "According to Article 28(3) of the GDPR, cloud providers as data processors may only process data based on the instructions of the customer. An exception to this principle only applies if they are obliged to process the data under EU law or the law of an EU Member State," Hessel is quoted as saying by Heise. Accordingly, Microsoft in Europe would not be allowed to comply with U.S. information requests.

US Sanctions Override Legal Principles

It was only in May of this year that Microsoft caused a stir when the U.S. company temporarily blocked email access to the International Criminal Court (ICC) in The Hague. The reason was a sanction imposed by the Trump administration against individual ICC investigators who had come under scrutiny for their work on alleged U.S. war crimes in Afghanistan. Access to official communications was cut off without prior warning.

The reactions from Europe were correspondingly clear. Microsoft made efforts to mitigate the damage afterwards and promised that in the future it would no longer block accounts solely based on U.S. directives but would first review legal options. The case exemplifies how political decisions in Washington can fully impact European IT structures—even when the data is physically located in the EU.

Consequences for Industry And Administration

European companies and authorities must once again weigh how sustainable their trust in U.S. cloud providers like Microsoft, Google, or Amazon is—especially when it comes to critical infrastructures or personal data.

Brussels is becoming increasingly impatient. The EU is advocating for greater independence and is exploring new approaches to promote European cloud ecosystems. Projects like Gaia-X, which long operated in the shadow of major hyperscalers, could gain new momentum as a result. For example, Nextcloud, the self-hosted open-source cloud solution, has reported a tripled growth since the start of the year, which it attributes to concerns over digital sovereignty. (mc)

Smart-Factory

Access solutions for the Smart Factory - Industry 4.0