The European Union is considering a plan to ensure cloud companies effectively store European data in data centers within the EU.

ENISA, the EU’s cybersecurity regulator, is working on stricter rules to protect European data from intrusion from countries outside the Union. This emerges from a first version of the proposal, which Bloomberg was able to see. This includes the plan to oblige cloud companies to store European data in data centers within the EU. This is necessary to qualify for the highest level of cybersecurity certification.

Practical

In practice, this means that American companies such as Amazon or Microsoft must ensure that their own government does not have access to cloud data in the EU. Businesses outside the Union basically have two options: they can store European data as part of a separate legal entity within the EU or as part of a joint venture with a European cloud company.

ENISA proposes two levels in this cybersecurity plan. The first is EL3, which primarily requires a certain level of data transparency; Most American cloud companies are already reacting to this. EL4 is one level higher and this level must therefore provide assurance that non-EU governments do not have access to the stored data. This is then applied to sensitive data from a member state, for example.

Issue

There are now concerns from a number of US companies that the EU may want to exercise some sort of ownership right over this European data, which France is already doing separately. In principle, however, it is not difficult for these companies to comply with the ENISA conditions. For example, Oracle would have no problem qualifying for LE4, according to two sources familiar with the facts.

An ENISA staffer pointed out that a final proposal still has to be approved by representatives of all member states anyway. In other words, the plan is far from complete.