German and French IT business user associations’ position on the European certification scheme for cloud services

27 juin 2022 | ACTUALITÉS, Cigref in english, Communiqués

For an ambitious certification scheme that protects the sensitive data of European organisations in the cloud from non-European legislation with extraterritorial reach.

Ce communiqué existe aussi en français

Ce courrier est également téléchargeable en français

In a letter sent to Commissioner Breton on 23 June 2022, Cigref welcomes the draft European data regulation and expresses its ambitions for the future certification scheme, which is an essential instrument for making operational the mechanisms designed to promote the free movement in Europe of sensitive data of European public and private organisations.

As the debate intensifies between the advocates of a legalistic approach and a lesser scheme, and the advocates of an ambitious policy, VOICE and Cigref call on the European institutions and ENISA to adopt a certification scheme that will allow the establishment of a harmonised regulatory framework guaranteeing the protection and security of information systems and data within the European Union. This high level of certification is an opportunity to create the framework of trust in the cloud that European companies currently lack. It is a trajectory, a goal to be achieved collectively.

The free flow of data requires a trustworthy framework to ensure the security of sensitive corporate and public administration data in the cloud. Currently, many public and private organisations are obliged to maintain data hosting, and associated processing, on their premises because of the sensitivity of this data to unlawful international access by non-European administrative and judicial authorities through legislation with extraterritorial reach.

The European Union must face the consequences of the judgment of 16 July 2020 of the Court of Justice of the European Union in the so-called « Schrems II » case, which invalidated the Privacy Shield adequacy agreement, and equip itself with mechanisms commensurate with this judgment and enabling it to guarantee the free circulation of sensitive personal and non-personal data of European public and private organisations under conditions of verifiable and enforceable trust.

VOICE and Cigref welcome the draft Data Act which aims to implement horizontally applicable safeguards to strengthen the protection of non-personal data hosted in Europe from international access. In addition to these ambitious provisions, our associations call for a European certification scheme for cloud services (EUCS) to guarantee the highest level of immunity to non-European legislation with an extraterritorial scope for certain cloud service offerings on the European market. VOICE and Cigref believe that the implementation of an ambitious certification scheme stems from the spirit of the Cybersecurity Act, the objective of which is to establish a harmonised regulatory framework guaranteeing the protection and security of information systems and data within the European Union.

The letter addressed to Commissioner Thierry Breton, in French and its courtesy translation into English, is available as an attachment to the press release.

About us – Who we are 

We are the French and German CIO associations; communities of Chief Information Officers (CIOs) and other senior leaders who are responsible for digital technologies and digital transformations within private or public organisations. These are all business users of digital technologies. We do not represent ICT suppliers and consultants.

Cigref – France

VOICE – Germany

Press contact : Baptiste Chauveau, Communication & PR Officer – Cigref

Métiers du numérique : sens et appétence – Recommandations pour orienter les cursus de formation au numérique

Alors que l’écosystème numérique est le plus demandeur de professionnels formés pour ses métiers, les organismes d’enseignement et de formation qui délivrent les connaissances et suscitent les talents sont souvent vus comme de simples éléments du secteur de la...

Convergences numériques : construire une Europe numérique et compétitive.

Les principales organisations et associations professionnelles du numérique s’associent pour mettre le numérique au cœur de la campagne européenne. Télécharger notre manifeste commun...

Saisir les opportunités de l’IA pour un numérique responsable : nouveau rapport disponible !

Numeum, l’Institut G9+, le Cigref, Planet Tech Care et le Hub France IA, ont dévoilé un rapport inédit intitulé « Green AI & AI for green ». Fruit d’une étude qualitative menée auprès de 72 professionnels – Directeurs des Systèmes d'Information (DSI), Chief Data...