A big tech-backed report has criticised a proposed European Union cloud security label that could exclude non-EU service providers from the bloc.

EU cybersecurity agency ENISA's certification scheme (EUCS) recently introduced a provision that requires service providers to have their registered head office and global headquarters in the EU. Cloud service providers would also be required to store and process customer data from one of the 27 EU member states.

In light of this provision, the European Centre for International Political Economy (ECIPE) has published a critical report commissioned by the Computer and Communications Industry Association (CCIA) – a lobbying group which includes members such as Amazon, Apple, Google, Meta, BT and Red Hat.

The report, titled ‘Building Resilience? The Cybersecurity, Economic & Trade Impacts of Cloud Immunity Requirements’ calls on ENISA and the European Commission to abandon immunity requirements in the proposed EU Cloud Certification Scheme (EUCS).

In a summary note, report author Matthias Bauer, a German economist and director at the ECIPE, said: “With immunity requirements in the EUCS, the EU risks opening a Pandora’s box, paving the way for data localisation, foreign ownership restrictions, and local establishment requirements in digital industries globally leading to rising trade tensions.

Bauer also argues that the immunity requirements would increase cloud adopters' exposure to cybersecurity risks, and that "excluding these and other EU and non-EU companies from EU Member States could result in a long-lasting security deficit of EU cloud adopters vis-à-vis organisations that are still able to use reliable and often best-practice cloud services offered by providers from outside EU Member States."

The organisation also warned that the proposal could set a dangerous precedent, and potentially trigger retaliatory measures from EU trading partners.

In comments to Reuters, a spokesperson for ENISA said that it is waiting for an opinion from EU countries and that it "will then finalise the scheme by taking into utmost account this opinion and submit the final candidate scheme to the European Commission".

Share Story: