E.U. flag with binary code background showing the new European cloud that could provide services which comply with data protection laws

Could the “European Cloud” Deliver Data Protection by Default?

On 4 June, French and German ministers unveiled the so-called “European cloud” infrastructure project, Gaia-X.

Geopolitical tensions and trade wars appear to be behind the project, which will function as a platform for businesses to search for data storage providers that comply with Europe’s data protection laws as well as its principles of “openness, interoperability, transparency, and trust.”

11 French and 11 German firms will initially be involved in offering “a secure environment for the cross-business sharing of data in Europe.” Essentially, the system will link-up various suppliers of cloud services into an interoperable data exchange.

When the scheme was first mooted in November 2019, chief among concerns seemed to be the U.S. CLOUD Act. This act, signed in 2018, would force United States storage providers to allow access to US law enforcement to information stored on their servers, regardless of where that data is physically located.

Despite EU fears that international tech giants such as Amazon, Google or Microsoft, have too much control over Europeans’ data, Gaia-X does not seem poised to rival their offerings.

Nonetheless, French Finance Minister, Bruno Le Maire, and German Economy Minister, Peter Altmaier, were keen to talk up the project’s potential.

“In my talk with American companies, there is a real chance that Gaia-X standards could become a gold standard in cloud services around the world,” said Altmaier.

But the door is still open to non-European companies to be involved in the project, so long as they adhere to EU rules and principles, “We are not China. We are not the United States. We are European countries with our own values,” said Le Maire.

But experts see reasons other than so-called “data sovereignty” at work. “While fears of surveillance will certainly be part of the reason for Gaia-X as a concept, placing Europe in the driver’s seat controlling its own data, it seems to me there are other factors at play,” said Damien Mason, Digital Privacy Expert at ProPrivacy.

“Fears are most certainly warranted, given that the biggest cloud providers are mostly based in the United States – a country that has been caught red-handed in its attempts to coerce companies into implementing backdoors and helping the state spy on anyone and everyone it can. We are likely to hear the term ‘data sovereignty’ several more times throughout the next few years. Thankfully, Gaia-X isn’t solely a government project, but it still needs to be fully transparent about its workings. If at all possible, independent third-party verification is preferred, but this seems unlikely,” he continued.

“Germany remains the biggest player in the European Union and the UK’s upcoming exit threatens its existence. Establishing Europe as a cloud superpower through collaboration with France and other participating countries seems to be an effort to help strengthen unification, deterring others from conducting their own Brexit.

“German Economy Minister Peter Altmaier is right when he says that ‘data will be the most important raw material of the future’ and Europe’s stance on privacy has drastically differed from the US and China’s more authoritarian stance. The introduction of Gaia-X allows Europe to attain data sovereignty, which eschews all fears of surveillance and is in the interest of its citizens that have enjoyed privacy-focused laws such as GDPR come into place over the past few years,” explained Mason.

The more countries that get involved in the project, the more likely it is that they will keep each other in check, but, pointed out Mason, “it’s important for the regular consumer to be informed about the inner workings of the project for it to be successful. It’s difficult to say whether Gaia-X will be popular among neighboring countries or respective populations, but many will want to escape the clutches of the information superpowers that already surround us.”

According to the project website: “Representatives from seven European countries are currently involved in the project. We want to invite other European partners to join the project and to contribute to its development. Many dialogues are already underway and will be further intensified. Furthermore, GAIA-X is in continuous exchange with the European Commission.”

This is not the first time Europe has tried to boost industrial policy: there was Quaero, the EU-subsidised motor of Franco-German research; Galileo, the European satellite alternative to GPS, which was affected by delays and cost increases; as well as Numergy and Cloudwatt France’s massively subsidized attempt at a local cloud. None of these ultimately succeeded.

To have control over European data could be one reason behind new #cloud project Gaia-X as biggest cloud providers are mostly based in U.S. #respectdataClick to Tweet

But Gaia-X may buck that trend. The project will be managed by a non-profit foundation in Belgium with companies including Deutsche Telekom, Orange, Atos, BMW and Siemens all set to be involved. The massive move to work from home caused by the COVID-19 pandemic may also focus CEO’s minds on where their data is currently stored and what specific safeguards are enshrined in law.