European Union flags fly in front of the European Parliament.
Philip von Ditfurth dpa | Image Alliance | Getty Images
The European Union is considering legislation to do so limit its member governments’ use of US cloud providers to manage sensitive data, sources familiar with the negotiations told CNBC.
The European Commission – the EU’s executive branch – is expected to present the “Technological Engineering Package” on May 27, which will include a series of measures aimed at strengthening the bloc’s independence in key digital areas.
As part of the preparations for that package, discussions are taking place within the Commission about limiting the disclosure of sensitive public sector data on social media provided by companies outside the EU, two Commission officials, who asked not to be identified as they are not authorized to discuss private matters, told CNBC.
As tensions with US President Donald Trump’s administration have intensified, there have been calls for Europe to break away from American cloud providers, which currently dominate the European market, and hand over its most important work to domestic providers.
“The main idea defines the sectors that should be handled by the European cloud,” said one of the officials. They added that companies providing cloud solutions from third countries, including the US, could be affected.
The proposals would not ban offshore companies’ cloud platforms from government contracts entirely, but limit their use for processing sensitive data in public sector organizations, depending on the level of sensitivity, they added. Officials said negotiations are ongoing but are yet to be finalized.
“American cloud providers could face restrictions in certain sensitive and strategic sectors” within EU member states as a result of the proposals, one official said.
Officials told CNBC that there are discussions about suggesting that financial, judicial and health data processed by governments and public sector organizations require higher levels of cloud infrastructure.
The talks are not related to private companies and the “Tech Sovereignty Package” will not impose regulations on their use of cloud platforms, one of the officials said.
Once presented by the Commission, the package will need to be approved by all 27 member states. The “Technology Sovereignty Package” will include the Cloud and AI Development Act (CADA) and the Chips Act 2.0, bills aimed at promoting domestic solutions and products in both areas.
When asked for comment, a Commission spokesperson told CNBC that the package is “about Europe waking up and getting its act together.”
They added that it will “enhance opportunities for private cloud offerings, including public procurement, and support the market entry of a diverse set of cloud and AI service providers.”
Growing calls for diversity
Public sector organizations that are members of the EU can currently use cloud platforms provided by overseas companies – usually based in the US due to the country’s dominance in this sector. — processing highly sensitive data, including health and financial data, as long as they comply with the rules.
But scrutiny of that dependence has grown as transatlantic relations have soured in recent months. Under the Cloud Act of 2018, US law enforcement can request user data from US companies, regardless of where the data is stored.
European governments told CNBC in February that they are exploring domestic and open alternatives to US technology bases and the growing budget of digital sovereignty.
France announced that it will launch Visio in January – a video conferencing tool developed by the government – which it said will be available in all state services by 2027, replacing American tools such as Microsoft Teams and Zoom.
In the same month, the EU said it was facing “a serious problem of dependence on non-EU countries in the digital sector … which could create fragility, including in key sectors.”
In April, the Commission awarded a tender of 180 million euros to four European cloud projects to provide institutions and agencies of the EU, one of which involves a partnership between the French Aerospace company Thales and Google Cloud.
