The EUs battle with U.S. digital giants is reaching new heights: the cloud.
The European Commission already took legal action to raise technology companies tax bills and cracked down on how they use peoples personal data. Now its going after cloud computing, the online data storage business dominated by big American companies.
The move comes in a proposal due Thursday to regulate how EU banks and other financial companies use cloud services. The draft law seeks to address concerns about dependence on a small group of providers: chiefly Amazon Web Services, Google Cloud, IBM Cloud and Microsoft Azure.
The bill would create an oversight system designed “to preserving the Unions financial system stability,” along with “monitoring of operational risks which may arise as a result of the financial systems reliance on critical [outsourced services]” according to a draft of the proposal obtained by POLITICO.
While European rivals are mounting a business challenge for cloud services with their Gaia-X standards initiative, the financial legislation represents a first move to supervise the largely U.S-based companies directly.
Moving on cloud companies could worsen Brussels relationship with the U.S. tech industry.
Two-thirds of EU banks have moved at least some of their customer details and other information to cloud services, regulators reported last year. By distributing data around the internet, firms can increase their efficiency and computing power as they pursue online opportunities — all in keeping with the Commissions strategy to spur digital finance.
While some experts say thats safer than in-house server farms, the trend concentrates cybersecurity defenses in fewer hands.
The concern is what happens to all that information if one of the clouds evaporates. A catastrophic failure could cripple not just one bank but a swath of the industry.
Access, audits, inspections
The Commission aims to address that by empowering financial regulators to scrutinize the use of cloud services and require firms to introduce clauses into their contracts with providers to beef up safeguards.
Oversight includes “unrestricted rights to access and process all information deemed relevant,” the draft legislation says. EU watchdogs would also have the “right to conduct audits and inspections,” and to issue “mandatory instructions.”
In earlier discussions, Commission officials considered a further-reaching requirement for financial companies to rotate their cloud service providers, as they must do for auditors. While that idea hasnt made it into the planned proposal, legislators could add it back in their amendments to come.
The cloud services meanwhile have to pay EU supervisors for the privilege of being regulated and face heavy fines if they refuse to cooperate, the 106-page draft said.
Moving on cloud companies could worsen Brussels relationship with the U.S. tech industry after competition cases against the likes of Google and Microsoft, as well as the Commissions court fight over Apples tax bill in Ireland.
Amazon Web Services, Microsoft and IBM officials declined to comment. Google officials did not respond to requests for comment.