According to a draft document seen by Reuters, Amazon, Alphabet’s Google, Microsoft, and other non-European Union (EU) cloud service providers seeking to handle sensitive data and secure an EU cybersecurity label will need to form a joint venture with an EU-based company.
The cloud service must be operated and maintained from the EU, and all customer data stored and processed in the EU, with EU laws taking precedence over non-EU laws regarding the cloud service provider.
The draft proposal from the EU cybersecurity agency ENISA is for an EU certification scheme that will vouch for the cybersecurity of cloud services and determine how governments and companies in the bloc select a vendor for their business.
The document also stated that US tech giants and others involved in the joint venture could only have a minority stake, and employees that have access to EU data would have to undergo specific screening and be located in the 27-country bloc.
The latest draft could fragment the EU single market, and the US Chamber of Commerce has previously said that the plan puts US companies on an unequal footing. EU countries will review the draft later this month after which the European Commission will adopt a final scheme.
The draft proposal from EU cybersecurity agency ENISA requires that non-European Union cloud service providers seeking to handle sensitive data must do so through a joint venture with an EU-based company, and must operate and maintain the cloud service from the EU, with all customer data stored and processed in the EU.
The rules will also apply to personal and non-personal data of particular sensitivity where a breach may have a negative impact on public order, public safety, human life or health, or the protection of intellectual property.
While these measures aim to strengthen EU regulations, norms and values, they are likely to spark criticism from U.S. tech giants who may feel shut out of the European market. It remains to be seen how this proposal will evolve and be implemented in practice, and what the ultimate impact will be on the cloud services industry and the EU single market.