Articles on Digital Sovereignty, the GDPR, and the CLOUD Act

Open Source

Official statements

Investigation into IT contracts: stronger cooperation to better protect rights

2019-10-21 / EDPS / Link to article

• In April 2019, the European Data Protection Supervisor (EDPS) launched an investigation into the use of Microsoft products and services by EU institutions.
• Though the investigation is still ongoing, preliminary results reveal serious concerns over the compliance of the relevant contractual terms with data protection rules and the role of Microsoft as a processor for EU institutions using its products and services.
• The Hague Forum aims to discuss both how to take back control over the IT services and products offered by the big IT service providers and the need to collectively create standard contracts instead of accepting the terms and conditions as they are written.

DIGG makes policy decision on open source

2019-05-15 / DIGG News / Link to article

• A policy decision has been adopted that software developed and/or procured for the agency’s operations should primarily be published as open source.
• “We want to be open and accessible and make it easier for our partners both here in the country and across borders to benefit from the knowledge we have built up, not least in cross-border e-identification carried out within eIDAS,” says Anna Eriksson, Director General at DIGG.
• By being open with our source code, we can make things easier for our partners and together increase the pace of digitalization without compromising security, she continues.

European data sovereignty

Official statements

Cloud services in essential public functions – risks, suitability and the way forward

2019-11-22 / Försäkringskassan / Link to white paper

• On November 22, the Director General of Försäkringskassan, Nils Öberg, writes on DN Debate about public cloud services in the public sector.
• “Sweden’s national and municipal administration must have sovereign control over its information,” says Nils Öberg.

EU - U.S. Privacy Shield - Third Annual Joint Review report

2019-11-12 / EDPB / Link to article

• The European Data Protection Board (EDPB) has published its report from the third review of the Privacy Shield.
• The EDPB notes a long list of problems. The EDPB also notes the cases pending before the Court of Justice of the European Union where these questions are being examined.

News articles

Gaia-X - Europe Is Starting to Declare Its Cloud Independence

2019-10-30 / Fortune / Link to article

• Tired of its businesses turning to foreign cloud-computing providers such as Google, Microsoft and Amazon, the German government is leading the push for a European cloud network called Gaia-X. France is also on board.
• “Data will be the most important raw material of the future,” said German Economy Minister Peter Altmaier in a statement this week. “The European economy urgently needs an infrastructure that ensures data sovereignty.”

What’s driving Europe’s new aggressive stance on tech

2019-10-29 / Politico / Link to article

• President Ursula von der Leyen is determined to bolster the EU’s ability to compete head on with the United States and China on all things digital.
• That strategy includes taking a tougher stance on foreigners scooping up European tech firms, using government contracts as a “strategic” tool to allow local rivals to compete with international firms like Amazon, and super-charging the bloc’s industrial policy to fuel innovation in fields such as artificial intelligence and quantum computing.
• She’s even come up with a name for it: technological sovereignty.

France recruits Dassault Systemes, OVH for alternative to U.S. firms

2019-10-03 / Euro news / Link to article

• France has enlisted tech companies Dassault Systemes and OVH to come up with plans to break the dominance of U.S. companies in cloud computing
• Dassault Systemes is a French software company and OVH is a privately held French cloud computing company.
• Paris is concerned a 2018 U.S. law called the Cloud Act lets any U.S. agency access European corporate data that is stored on the data centres of U.S. companies without telling them.

Germany’s plan to control its own data

2019-09-12 / Politico / Link to article

• Berlin aspires to become a world leader in industrial or business-to-business data technology, a goal that senior industrialists argue will be difficult to achieve if foreign powers control the storage of sensitive data and can use their supremacy to pressure Germany.
• The strategy, which includes a project to develop a European cloud-hosting service named Gaia-X, aims to address growing alarm over the reliance of large firms, government services and even police forces on hosts such as Amazon to store their data.

Debates and discussions

DigiPlex: Heavy cloud cover in the public sector – no one has an overview of data centers

2019-11-03 / Finansavisen / Link to article

• The public sector’s handling of data centers is completely in the dark, says Gisle M. Eckhoff at DigiPlex.
• The public sector in Norway probably has just under 200 data centers. Exactly how many there are, where they are located, how the security works, or how much energy they use—no one has an overview. Both the environment and taxpayers would benefit from a cleanup.

Lars Strand, NSM: Critical infrastructure

2019-10-27 / Finansavisen / Link to article

• ICT services for Norwegian public and private companies are increasingly delivered from abroad. These underpin important societal functions, writes Lars Strand of NSM.

GDPR

News articles

The EU Court takes up a GDPR case – hundreds of thousands of companies affected

2019-07-19 / Dagens Industri / Link to article

• Schrems 2.0 (lawsuit against Facebook) is being taken up by the Court of Justice of the European Union.
• The result may be that SCCs and the Privacy Shield could be invalidated.
• Thousands of companies may need to look for new solutions for data transfers, or switch cloud service provider.

eSam on Cloud Act criticism

2019-07-12 / Vioster / Link to article

• Interview with Johan Bålman, lawyer at eSam’s legal unit.
• eSam stands by the statement from November 2018. It was not too hasty, as some claim.
• “If you continue to look at the issue from an EU perspective, the Cloud Act may also be incompatible with the GDPR. The GDPR contains provisions that information may not be disclosed to a third country, that is, a country outside the EU and EEA.”

How did it turn out – are Swedish companies following the GDPR rules?

2018-11-05 / Dagens Industri / Link to article

• The knowledge and software company Björn Lundén Information conducted a survey in which nearly a thousand small and medium-sized companies answered how they perceive and have acted as a result of the new data protection regulation, GDPR.

Swedish authorities spread sensitive data abroad

2018-11-02 / Göteborgs-Posten / Link to article

• EDITORIAL Swedish authorities continue to procure cloud services where sensitive data risks ending up in the wrong hands. Even the City of Gothenburg has entered into agreements where sensitive data about Swedish citizens may go astray.

Your work phone can cause trouble: “App ban” from the boss is a possible solution

2018-08-28 / NRK / Link to article

• Do you have a work phone that you also use privately? New rules may mean that the employer has to pay potentially high fines if you use the phone indiscriminately.

GDPR now enters into force in Norway

2018-07-20 / NRK / Link to article

• On Friday, the EU’s new data protection rules enter into force in Norway. Hefty fines may result for companies that shirk their obligations.

GDPR – what is it?

2018-05-11 / SVT Nyheter / Link to article

• During the spring, companies and authorities have struggled to adapt to the EU’s new data protection regulation, GDPR.

I get that GDPR is a regulation, but why does it exist?

2018-05-11 / SVT Nyheter / Link to article

• SVT Nyheter gives you 20 years of recent history in four minutes! SVT Nyheter

GDPR may be the EU’s most complicated law to date

2018-05-11 / SVT Nyheter / Link to article

• Stronger protection for citizens’ personal data and stricter requirements on those who collect and process it. That is how GDPR, the EU’s new data protection regulation, can be summarized. It enters into force on May 25.

Debates and discussions

Collaboration and open source accelerate municipal digitalization

2019-06-19 / Computer Sweden / Link to article

• Proposes introducing a national app store for software based on open source.
• Solutions based on open source can be improved and complemented by many actors, including the citizens themselves, and therefore it is essential that all improvements benefit everyone, whether you live in Luleå or Malmö.

CLOUD Act

Official statements

Joint Response to the LIBE Committee on US Cloud Act

2019-07-19 / EPDB / Link to article

• “We also stress the need for an EU-level approach. In this specific context, as massive amounts of electronic communication data are processed and stored by operators falling under US jurisdiction and since direct access requests sent by US authorities are likely to affect any Member State, an EU-level approach is essential here in order to avoid the potential negative consequences of a fragmented patchwork of non-harmonised bilateral executive agreements between the US and EU Member States that would be concluded under the US CLOUD Act”.

European Data Protection Board - Twelfth Plenary session

2019-07-11 / EPDB / Link to article

• The CLOUD Act allows US law enforcement authorities to require the disclosure of data by service providers in the US, regardless of where the data is stored. The EDPB and EDPS emphasize that a comprehensive EU-US agreement regarding cross-border access to electronic evidence, containing strong procedural and substantial safeguards for fundamental rights, appears the most appropriate instrument to ensure the necessary level of protection for EU data subjects and legal certainty for businesses.

eSam sees risks with cloud services in the public sector

2018-11-12 / eSam / Link to article

• A group within eSam has, since spring 2018, worked on how the public sector can use cloud services based on security and confidentiality legislation and what recommendations eSam can give its members and other actors in the public sector.

News articles

Risky when healthcare is digitalized by large American companies

2018-11-05 / Dagens Nyheter / Link to article

• Counties and regions are currently procuring health information systems for an extensive digitalization of Swedish healthcare. The risk is that Sweden’s healthcare will be completely dependent on American system providers for a long time.

And after GDPR comes the CLOUD Act…

2018-05-25 / Dagens Juridik / Link to article

• Just as European companies are starting to get the hang of GDPR (General Data Protection Regulation) — which enters into force today and includes rules intended to strengthen EU citizens’ privacy protection and provide instructions for how companies may process personal data — the next dark cloud arrives, the CLOUD Act. Dagens Juridik

AWS on the new Cloud Act: “We will comply with the law”

2018-05-14 / Computer Sweden / Link to article

• AWS will soon open data centers in Sweden. But the new cloud law, the Cloud Act, has changed the conditions.

New U.S. law shakes up the cloud industry

2018-05-04 / Computer Sweden / Link to article

• In the shadow of GDPR, a new law has been passed that can have major consequences for cloud use worldwide. It means that American cloud providers are forced to disclose data to U.S. authorities regardless of where it is stored.

Debates and discussions

#3 Microsoft changes its mind “Incorrect interpretation of the CLOUD Act”

2019-09-22 / André Catry / Link to article

• In 2013, Microsoft argued that they could not disclose information stored in Ireland to U.S. authorities. Today that does not seem to be a problem.

#2 Continuation “Incorrect interpretation of (CLOUD Act)”

2019-09-17 / André Catry / Link to article

• In this second document I will analyze the Comity Analysis process, which Microsoft refers to in its document “Cloud services and security, December 13, 2018.” There, Microsoft refers to the Clarifying Lawful Overseas Use of Data (CLOUD Act).

#1 Incorrect interpretation of (CLOUD Act)

2019-09-14 / André Catry / Link to article

• “Now I intend to respond to writers who are experienced jurists and even, in some cases, attorneys. Moreover, I am doing it on their home turf—the interpretation of legal text. However, I feel that the writers have somehow gone wrong or chosen to interpret the factual circumstances in such a way that I perceive it is intended to fit a particular purpose.”