20260616 US Cloud-Act vs. EU DSA

Schufa-Data stored at AWS?

In order to meet “its high standards for data protection, security, and digital sovereignty” in the future, Schufa plans to store the data of 69 million Germans in the AWS (Amazon) cloud. Please, what exactly has Schufa failed to understand about the calls for European data sovereignty?

Although the AWS servers are supposed to be located in the EU, the content is subject to the U.S. Cloud Act. Even before the Cloud Act became law, Anton Carniaux, Director of Public Affairs and Legal Affairs at Microsoft France, had to admit before a Senate committee there that Microsoft — albeit only in response to legally unambiguous requests from U.S. authorities — would have to comply. In any case, he could not “guarantee under oath” that data on French citizens could not be transferred to the U.S. government without the express consent of the French government. An example of such a case is the disclosure of the names of Dutch officials by Microsoft and Meta to U.S. authorities, even before the U.S. Cloud Act was enacted. Their “crime,” in the eyes of U.S. authorities, was monitoring compliance with the EU Digital Services Act (DSA).

That is why France’s digital administration will operate on Linux desktops instead of Windows computers, breaking free from U.S. influence and regaining its digital sovereignty.

However, in the linked article, Telepolis.de also mentions Greece, which continues to rely heavily on U.S. tech companies. Other U.S. tech firms such as Google, Cisco, Microsoft, and Digital Realty have also been courted for investments in Greece, writes Telepolis.de. In this regard, we in Germany are a small step ahead, as “digital sovereignty” is supposedly the stated goal of government policy, at least in words.

Translated with DeepL.com (free version)