.png)
The European Union is considering a plan that would require cloud providers to store all their data within the bloc in order to obtain the highest cybersecurity certification.
ENISA, the EU cybersecurity regulator, is developing new, stricter requirements to ensure that no foreign government can interfere with EU data, according to a draft proposal seen by Bloomberg.
In practice, this would mean that US cloud providers such as Amazon.com Inc., Microsoft Corp., and Alphabet Inc. would need to find a way to guarantee that the US government cannot access European cloud data in order to comply with the rules. Non-EU cloud companies would either have to operate an EU legal entity separately from their parent company or form a joint venture with a European cloud provider.
An Amazon AWS spokesperson declined to comment on the draft proposal. Representatives of Microsoft, Alphabet, and ENISA did not immediately respond to requests for comment.
The higher standard could be used to select companies eligible to compete for contracts to store sensitive government data. The draft proposal, first reported by Euractiv, would be voluntary and is still subject to change.
ENISA is proposing a two-tier “high-level” cybersecurity classification. Most US cloud providers could already meet the proposed “EL3” standard, which requires a certain level of data transparency. The highest level—EL4 certification—would require that data be stored within the EU and not be subject to interference from foreign governments.
US companies have been concerned that ENISA might introduce ownership rules for cloud data in the EU—similar to those already in place in France—to achieve the highest certification. ENISA’s proposal would be more flexible for US companies. According to two people familiar with the matter, Oracle’s Sovereign Cloud offering would likely meet the proposed EL4 requirements.
Source: Bloomberg