On Cloud Sovereignty: Should European Policy Favour European Clouds? 

Abstract

Recent calls for European digital sovereignty highlight concerns with the widespread use of cloud services operated by US providers. We examine how the US government's exercise of legal powers over US cloud providers can pose risks to the confidentiality and availability of European customer data. We explore how such risks relate to sovereignty, including the concepts of state sovereignty; 'data sovereignty'; and strategic autonomy. Lastly, we examine policy measures aimed at encouraging the use of European cloud services, including the proposals for a European federated cloud and a cybersecurity certification scheme.

Keywords: Cloud Computing, Information Technology, Digital Sovereignty, Data Sovereignty, Strategic Autonomy, Cybersecurity, Law Enforcement Access, Surveillance, US CLOUD Act, FISA Section 702, Data Protection, Privacy, European Union, Data Localisation, GDPR, Industrial Policy, Federated Cloud, Gaia-X

JEL Classification: F5, F52, H5, H54, H56, H57, H7, H77, K2, K20, K23, K33, K42, L5, L52, L8, L86, L88, O3, O33, O38