EU cloud regulation opens new front with US tech giants

The EU’s battle with U.S. digital giants is reaching new heights: the cloud.

The European Commission already took legal action to raise technology companies’ tax bills and cracked down on how they use people’s personal data. Now it’s going after cloud computing, the online data storage business dominated by big American companies.

The move comes in a proposal due Thursday to regulate how EU banks and other financial companies use cloud services. The draft law seeks to address concerns about dependence on a small group of providers: chiefly Amazon Web Services, Google Cloud, IBM Cloud and Microsoft Azure.

The bill would create an oversight system designed “to preserving the Union’s financial system stability,” along with “monitoring of operational risks which may arise as a result of the financial system’s reliance on critical [outsourced services]” according to a draft of the proposal obtained by POLITICO.

While European rivals are mounting a business challenge for cloud services with their Gaia-X standards initiative, the financial legislation represents a first move to supervise the largely U.S-based companies directly.

Two-thirds of EU banks have moved at least some of their customer details and other information to cloud services, regulators reported last year. By distributing data around the internet, firms can increase their efficiency and computing power as they pursue online opportunities — all in keeping with the Commission’s strategy to spur digital finance.

While some experts say that’s safer than in-house server farms, the trend concentrates cybersecurity defenses in fewer hands.

The concern is what happens to all that information if one of the clouds evaporates. A catastrophic failure could cripple not just one bank but a swath of the industry.

Access, audits, inspections

The Commission aims to address that by empowering financial regulators to scrutinize the use of cloud services and require firms to introduce clauses into their contracts with providers to beef up safeguards.

Oversight includes “unrestricted rights to access and process all information deemed relevant,” the draft legislation says. EU watchdogs would also have the “right to conduct audits and inspections,” and to issue “mandatory instructions.”

In earlier discussions, Commission officials considered a further-reaching requirement for financial companies to rotate their cloud service providers, as they must do for auditors. While that idea hasn’t made it into the planned proposal, legislators could add it back in their amendments to come.

The cloud services meanwhile have to pay EU supervisors for the privilege of being regulated and face heavy fines if they refuse to cooperate, the 106-page draft said.

Moving on cloud companies could worsen Brussels’ relationship with the U.S. tech industry after competition cases against the likes of Google and Microsoft, as well as the Commission’s court fight over Apple’s tax bill in Ireland.

Amazon Web Services, Microsoft and IBM officials declined to comment. Google officials did not respond to requests for comment.

Package deal

Thursday’s proposal is part of a package of measures to help digitalize the financial sector and modernize the EU’s rulebook for the online market.

These include initiatives to harmonize companies’ online defenses and regulate digital financial assets. The package also includes policy strategies on retail payments and capital markets.

The EU measures on digital assets and payments could also add an irritant to tech relations. The legislation aims to regulate large-scale stablecoins,  aiming at Libra, the online payments venture dreamed up by Facebook with a coalition of tech companies, including European members such as Spotify and Iliad.

Even before the Commission introduces its legislation, the biggest eurozone governments — Germany, France, Italy, Spain and the Netherlands — called for stringent measures, to prevent any virtual currency challenging the sovereignty of the euro.

“It’s something that cannot be jeopardized or weakened by any kind of project, including the so-called Libra project,” French Finance Minister Bruno Le Maire said this month.

Melissa Heikkilä contributed reporting.

Click Here: Golf special