German and French IT business user associations’ position on the European certification scheme for cloud services

27 juin 2022 | ACTUALITÉS, Cigref in english, Communiqués

For an ambitious certification scheme that protects the sensitive data of European organisations in the cloud from non-European legislation with extraterritorial reach.

Ce communiqué existe aussi en français

Ce courrier est également téléchargeable en français

In a letter sent to Commissioner Breton on 23 June 2022, Cigref welcomes the draft European data regulation and expresses its ambitions for the future certification scheme, which is an essential instrument for making operational the mechanisms designed to promote the free movement in Europe of sensitive data of European public and private organisations.

As the debate intensifies between the advocates of a legalistic approach and a lesser scheme, and the advocates of an ambitious policy, VOICE and Cigref call on the European institutions and ENISA to adopt a certification scheme that will allow the establishment of a harmonised regulatory framework guaranteeing the protection and security of information systems and data within the European Union. This high level of certification is an opportunity to create the framework of trust in the cloud that European companies currently lack. It is a trajectory, a goal to be achieved collectively.

The free flow of data requires a trustworthy framework to ensure the security of sensitive corporate and public administration data in the cloud. Currently, many public and private organisations are obliged to maintain data hosting, and associated processing, on their premises because of the sensitivity of this data to unlawful international access by non-European administrative and judicial authorities through legislation with extraterritorial reach.

The European Union must face the consequences of the judgment of 16 July 2020 of the Court of Justice of the European Union in the so-called « Schrems II » case, which invalidated the Privacy Shield adequacy agreement, and equip itself with mechanisms commensurate with this judgment and enabling it to guarantee the free circulation of sensitive personal and non-personal data of European public and private organisations under conditions of verifiable and enforceable trust.

VOICE and Cigref welcome the draft Data Act which aims to implement horizontally applicable safeguards to strengthen the protection of non-personal data hosted in Europe from international access. In addition to these ambitious provisions, our associations call for a European certification scheme for cloud services (EUCS) to guarantee the highest level of immunity to non-European legislation with an extraterritorial scope for certain cloud service offerings on the European market. VOICE and Cigref believe that the implementation of an ambitious certification scheme stems from the spirit of the Cybersecurity Act, the objective of which is to establish a harmonised regulatory framework guaranteeing the protection and security of information systems and data within the European Union.

The letter addressed to Commissioner Thierry Breton, in French and its courtesy translation into English, is available as an attachment to the press release.

About us – Who we are 

We are the French and German CIO associations; communities of Chief Information Officers (CIOs) and other senior leaders who are responsible for digital technologies and digital transformations within private or public organisations. These are all business users of digital technologies. We do not represent ICT suppliers and consultants.

Cigref – France

VOICE – Germany

Press contact : Baptiste Chauveau, Communication & PR Officer – Cigref

Auditer la gouvernance du numérique : les évolutions majeures du Guide d’audit de la gouvernance du numérique

Les organisations constatent aujourd’hui, qu’avec l'accélération des évolutions technologiques, la softwarisation des produits et des chaînes de production, et la numérisation de l’ensemble des processus des organisations, la contribution du numérique à la...

Cigref publishes its third version of the trusted cloud reference document

Cigref's "trusted cloud" referential expresses the generic trust needs of Cigref members as users of cloud services. It summarizes Cigref's work carried out since 2019 by the "trusted cloud" working group, led by Vincent Niebel, CIO of the EDF Group. This version,...

Rapport d’orientation stratégique 2023 du Cigref : « 10 ruptures à l’horizon 2030-2040 ».

À l’occasion de sa 53ème Assemblée générale, le Cigref a dévoilé l’édition 2023 de son Rapport d’orientation stratégique, « 10 ruptures à l'horizon 2030-2040 ». Ce rapport d'orientation stratégique (ROS) répond aux inquiétudes et au besoin d’anticipation et de...