Data Protection Hanging by a Thread Why European Data Spaces Do Not Exclude US Access

Related Vendors

Connect4Video GmbH

FAULHABER Drive Systems

dataTec AG

Wuxi InfiMotion Technology Co., Ltd.

Amazon, Microsoft, and Google have recently started promoting their "sovereign cloud." This concept aims to allow customers to host and process their data exclusively within Europe. However, the current political situation could jeopardize this initiative. Companies are therefore well-advised to rethink their cloud strategy in a timely manner.

The European Commission has tied the classification of the USA as a "safe third country" for data exchange under this framework agreement to certain conditions. These conditions include effective data protection oversight and binding legal guarantees, as provided by Executive Order (EO) 14086. In January 2025, US President Donald Trump dismissed three members of the Privacy and Civil Liberties Oversight Board (PCLOB), responsible for data protection oversight. "The transatlantic data protection agreement has since been hanging by the thin thread of a single presidential order," commented Dr. Stefan Volck, CPO of Vistameet at Connect4Video, a German cloud video conferencing provider.

Among CIOs in Europe, he says, there is growing fear that the US President might take the next step and revoke EO 14086. If Trump annuls "Executive Order 14086," the Transatlantic Data Privacy Framework between the European Union and the United States would permanently lose its legal basis. Volck adds: "If this scenario unfolds, companies would no longer be adequately protected in data transfers between the European and US legal jurisdictions—as was already established after the end of the 'Privacy Shield' agreement in 2020." For European companies whose digital infrastructure is anchored in the tool ecosystems of Microsoft, Google, and Amazon, substantial risks would arise.

Narrative of the So-Called Sovereign Cloud Does Not Hold Up

The Big Tech companies Microsoft, Google, and Amazon, which supply the majority of the European cloud market, have already responded by announcing sovereign cloud offerings. Volck explains: "Microsoft, provider of the widely-used Office 365 suite, promises a data boundary (EU Data Boundary) for a 'sovereign cloud' and a 'Data Guardian,' as well as multibillion-dollar investments in European data centers. The narrative seems plausible: if corporate data from Bucharest to Lisbon does not leave the European legal jurisdiction, it should remain beyond the reach of the U.S."

But this narrative does not hold up: The Clarifying Lawful Overseas Use of Data (CLOUD) Act grants U.S. authorities extensive access to European customer data, including extraterritorially. The law also obligates legally independent subsidiaries of major cloud providers to release data. Advanced technical security concepts like "bring your own key" do not offer sufficient protection in this regard.

"That Microsoft has already blocked the account of the Chief Prosecutor of the International Criminal Court in the course of U.S. sanctions is an alarm signal and demonstrates that American interests can arbitrarily override European data security in individual cases," adds Volck.

The potential termination of data protection security guarantees by the American government, according to Volck, poses a strategic risk for European companies. Therefore, they should critically evaluate the use of American tech tools in their digital infrastructure. These developments particularly affect German companies. "Many of them are currently working intensively to integrate AI workflows and cloud services into their business processes," says Volck. For responsible IT planning, this situation results in three important fields of action:

• Make data flows transparent: First, it is advisable to systematically review all international data transfers. In particular, data flows to third countries—primarily the USA—should be identified based on the record of processing activities in accordance with Article 30 of the General Data Protection Regulation (GDPR). Indirect access options via data interfaces, support requests, or connected software services within the meaning of Articles 44 ff. GDPR can also be included.
• Considering alternative legal instruments: CIOs should also consider alternative transfer mechanisms such as standard contractual clauses under Article 46(2)(c) of the GDPR. However, these require a so-called Transfer Impact Assessment (TIA), which examines whether the clauses could actually be enforced in the third country.
• Develop and test an exit strategy: CIOs should already prepare an exit plan for a scenario in which the transatlantic data protection agreement is revoked— regardless of whether Washington or Brussels is responsible. Alternative solutions, particularly for real-time workloads such as video conferencing, contact center integrations, or automated chat assistants that process conversation data in fractions of a second, should be tested during current normal operations before they replace existing tools and workflows.

Digital Sovereignty is No Longer Solely Within the IT Department

How complex such exit processes are depends on many factors such as the size of the company, internal use cases, and digital infrastructure. According to Volck, one thing is clear: building digital sovereignty within a company is no longer solely the responsibility of the IT department. It has become a central issue of corporate due diligence.

In light of the changing political climate, many companies have already begun preparing to switch to European cloud providers, transition to local data processing, or, for example, limit or suspend certain processing activities. European cloud providers are currently experiencing significantly increased demand, driven by substantial security concerns and "Go-European" initiatives.

It remains to be seen whether these initiatives will, in the long term, lead to a local cloud industry capable of meeting the rapidly growing demand for legally secure and reliable digital infrastructure. Such a scenario would likely only be realistic if the EU and its member states create the necessary political framework to comprehensively support local providers.

In conclusion, Volck advises: "Here and now, it is crucial for companies to move digital sovereignty out of the realm of abstract strategy papers and establish it as a fixed parameter in business decision-making. Those who prepare thoroughly today will avoid the shock of having to recalibrate the legal foundations for operations, compliance, and competitiveness overnight tomorrow."

Smart-Factory

Access solutions for the Smart Factory - Industry 4.0