Cloud Act: risks and alternatives for European companies

With the rise of cloud computing, the confidentiality and security of data have become paramount. Information stored and processed in an American cloud falls under United States law, and under the Cloud Act in particular. For European companies, that brings new challenges and new risks around storing and transferring their data.

Where the Cloud Act came from

Born out of a dispute between Microsoft and the United States government, the Cloud Act (Clarifying Lawful Overseas Use of Data Act) is a US federal law passed in 2018. It governs access by American service providers to data held in storage, even when that data sits outside the United States.

Like many American laws with extraterritorial reach, the Cloud Act takes precedence over local legislation. It gives the US government latitude to reach the data of individuals and companies abroad. Subject to certain conditions, it requires neither informing the parties concerned nor following local judicial procedure.

The risks and the stakes for European companies

The Cloud Act runs counter to the GDPR

The Cloud Act raises sharp concerns around privacy and the sovereignty of confidential documents. The European Union's GDPR (General Data Protection Regulation) grants strong protection to individuals' personal data. The Cloud Act, by contrast, allows the American authorities to obtain sensitive information without necessarily meeting those same standards.

What it means for European companies

A great many companies fall under the Cloud Act because of their pervasive ties to the United States. Sometimes they are not even aware of it. Escaping the extraterritorial reach of American law is difficult today, chiefly because of how dominant the American tech giants (Google, Apple, Facebook, Amazon and Microsoft) have become in our personal and working lives. We covered this in a webinar on the risks of storing data with the American tech giants.

Seen in that light, the Cloud Act represents a real threat to the sovereignty of French companies. France wants to put in place a mechanism that would let French companies know when their data held on American servers is accessed. Since the law was signed by Donald Trump, the alarm has been raised, underlining concerns about the rights the American government holds over the management of European companies' data.

Alternatives and good practice

Choosing sovereign, secure partners

European companies can take steps to stay compliant with the GDPR. They can, for instance, choose cloud providers based in France such as NetExplorer.

Since 2007, NetExplorer has supported more than 300,000 users day to day. As a French software vendor, we have built secure, sovereign solutions for sharing and storing files. Your documents are hosted and managed in France across two data centres. Certified ISO 9001, ISO 27001 and HDS (Health Data Hosting), our security requirements guarantee that your data is protected.

Making sure your data is encrypted

Encrypting data is an effective measure against the effects of the Cloud Act. It makes data unreadable to the American authorities and so protects European companies' interests. Companies can encrypt sensitive data before placing it in their storage. At NetExplorer, we protect your information with AES encryption.

Building in contractual clauses against the Cloud Act

Companies can also put specific contractual clauses in place to protect themselves from the Cloud Act, and strengthen the measures that prevent attacks on their security.

In an increasingly interconnected world, it is essential that users of cloud services understand what is at stake with the Cloud Act, and are able to assess its implications and explore the alternatives open to them. Choosing your subcontractors and deciding where your data is hosted are crucial decisions if data is to be protected while everyone's rights and interests are respected.