In a hearing, the Legal Director of Microsoft France was forced to admit that there is no guarantee that EU data is safe when transferred to the US.
Microsoft makes no guarantee that EU data will never end up in the hands of the US government:
Anton Carniaux, General Counsel of Microsoft France, testified at a hearing before the French Senate about data Microsoft receives from the Union des Groupements d'Achats Publics (UGAP), the central public sector procurement body for schools, town halls and municipal administrations.
When asked whether the company would never pass on its information to the US government without the express consent of the French authorities, Carniaux replied that he could not guarantee this under oath.
However, he added that such a situation has never arisen. Carniaux explained that Microsoft can only reject requests for information from the US if they are formally unfounded. Therefore, Microsoft will very carefully check the validity of all requests, and the US government cannot make requests that are not clearly defined.
However, in the event of legitimate requests, Microsoft should still fulfill its obligation and hand over the requested data. The company wants to inform affected customers about this, but first it will have to seek permission from US authorities to do so.
Obviously, the significance of Carniaux's statements at the hearing does not only concern UGAP and France: there is uncertainty across the EU regarding the use of US cloud services.
In addition to Microsoft, other major cloud companies like Amazon AWS are certainly affected. Critics are focusing on the CLOUD Act and the Patriot Act, which allow the US government to request information from providers, among other things.
Global companies Amazon are establishing new subsidiaries in Europe that promise independence from the American parent company. AWS promises that it is technically impossible to transfer data. Microsoft, on the other hand, wants to place the cloud infrastructure directly on the customer's premises, so that services such as M365 remain completely under their control. The systems will continue to be maintained by Microsoft, but by local employees. However, it is questionable how successful these promises will be: providers such as Nextcloud have seen a significant increase in demand since the beginning of the year.
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
