Sovereignty requirements remain in cloud certification scheme despite backlash
The draft Cybersecurity Certification Scheme for Cloud Services (EUCS) includes sovereignty requirements on European data localisation and foreign law immunity, even though member states and tech industry representatives strongly advised against it.
The European Commission had asked the European Union Agency for Cybersecurity (ENISA), responsible for developing and maintaining the EUCS, to add sovereignty requirements to the scheme.
This approach would mirror requirements recently introduced in France’s national cybersecurity certification scheme, known as SecNumCloud, and would affect cloud service providers operating in the EU market, ensuring that EU law is primary and that maintenance, operations and data must be located within the EU.
Immunity from non-European access would also be guaranteed by demanding that providers of cloud services be headquartered in Europe and not be controlled by any non-EU entities.
Source: Sovereignty requirements remain in cloud certification scheme despite backlash – EURACTIV.com
