The CLOUD Act: why store your data in France?

The arrival of the CLOUD Act in the American legal arsenal has caused a great deal of concern. Around the world, companies worry about the security of their data held with American providers. What is the CLOUD Act? What is at stake with this piece of legislation? And if you have to host data in the cloud, how do you avoid the negative effects of this federal law on your business? This article sets out everything you need to know.

The CLOUD Act extends the reach of American law

CLOUD Act stands for Clarifying Lawful Overseas Use of Data Act. Passed in March 2018, against the background of a dispute between the American government and Microsoft, this law makes it easier for the United States to reach data stored on servers located outside the United States. The CLOUD Act applies to companies that entrust their data to American providers. It can be used in two situations.

First, in the course of a criminal investigation, with a warrant or simply by order of an authorised court, American law enforcement can reach data hosted abroad.

The United States can also enter into bilateral arrangements with other states. Under those arrangements, the American authorities can request access to data hosted in foreign countries by companies under American jurisdiction.

The concerns this law raises affect businesses and individuals alike. And they are well founded when you remember that 65% of the global online data storage market is held by Amazon, 15% by Microsoft and 5% by Google. The grip American companies such as the big tech giants (Google, Apple, Facebook, Amazon and Microsoft) have on the collection of personal data is not in doubt.

Cloud with an American provider: what are the risks?

The GDPR came into force on 25 May 2018 across the European Union. Its purpose is to protect the personal data of European users. With the CLOUD Act, however, American digital operators and IT providers with servers in Europe are now subject to American jurisdiction. That weakens the application of the GDPR and blunts its effectiveness.

The impact of the CLOUD Act on companies using American hosts can show up in different ways. Among the possible consequences are leaks of sensitive data tied to national sovereignty, and a loss of public trust.

Leaks of sensitive data and harm to national sovereignty

With the CLOUD Act, the confidentiality of data stored with American providers is no longer a solid guarantee. What makes the concern sharper still is that hosts subject to American law can hand data over to the authorities without telling its owners, whether they are individuals or companies.

It is therefore easy to imagine, without stretching into fiction, scenarios in which sensitive data is collected without your knowledge. In 2018, a worrying report indicated that over the previous two decades the United States had brought legal proceedings against a number of European companies competing directly with American firms. In most cases, the proceedings and the penalties handed down were questionable or disproportionate. There would therefore appear to be a genuine desire on the part of the United States to favour American companies in order to strengthen its sovereignty and its influence in the world.

When you consider that data from sensitive sectors such as industry (automotive, aerospace and so on), defence and the economy is increasingly stored online, it is easy to conclude that the CLOUD Act is a tool that does nothing for the sovereignty of other countries such as France.

Loss of public trust and legal proceedings

Recent statistics show that Europeans care more and more about how their data is secured and protected. In France, for instance, fewer than 4,000 complaints a year were recorded by the CNIL in the early 2000s. In 2019, after the GDPR came into force in 2018, more than 14,000 complaints were filed with the authority. What is more, according to an IFOP survey carried out in April 2019, more than 7 French people in 10 say they are concerned about the protection of their personal data.

All of these statistics are clear signals for companies that want to win their public's trust and keep it. Taking reliable steps to protect your data, and that of your clients and partners, will certainly improve how your brand is seen. It is also a necessary step if you are to avoid legal proceedings and the substantial costs and fines that can follow. Everyone who entrusts you with data trusts you to protect it.

A French host, the choice of security and peace of mind

To avoid American interference and the risks set out above, choosing French hosting is the best answer. The advantages can be summed up in two key points: better data security and more responsive after-sales support.

French providers with data centres in France cannot have the CLOUD Act applied to them. They only have to bring their operations into line with frameworks such as the GDPR in order to offer quality services. Turning to them is therefore a calm way of protecting sensitive and personal data. Among these professional hosting services, and depending on what you need, you can choose providers certified ISO 27001, PCI DSS or HDS, as NetExplorer is. Beyond general data, health data and banking data are therefore protected too.

A French provider also generally offers far more responsive support, whether you have a simple question or a technical difficulty. It is therefore not only the most reliable option but also the one that saves you a considerable amount of time.

In the end, with the CLOUD Act in place, company data hosted in the cloud with American providers is not necessarily in good hands. Without being an outright obstacle, the law strengthens American supremacy and can harm the sovereignty of other nations while damaging companies' reputations. To protect sensitive data in genuinely secure IT environments, it is better to choose French hosts with data centres located on national soil. It is a question of digital sovereignty and of the security of users' personal information.

Keen to move to a secure, certified cloud solution? Discover NetExplorer, the entirely French solution that is simple to use.

Try our solution free of charge: https://www.netexplorer.fr/demonstration

https://www.journaldunet.com/solutions/cloud-computing/1488080-comment-remedier-aux-ravages-du-cloud-act/

https://www.celge.fr/article-conseil/cloud-act-quelles-consequences-pour-particuliers-entreprises

https://www.cnetfrance.fr/produits/cloud-computing-connaitre-les-risques-et-savoir-l-utiliser-39762624.htm

https://www.data.gouv.fr/fr/datasets/plaintes-recues-par-la-cnil/