German and French IT business user associations’ position on the European certification scheme for cloud services

27 juin 2022 | ACTUALITÉS, Cigref in english, Communiqués

For an ambitious certification scheme that protects the sensitive data of European organisations in the cloud from non-European legislation with extraterritorial reach.

Ce communiqué existe aussi en français

Ce courrier est également téléchargeable en français

In a letter sent to Commissioner Breton on 23 June 2022, Cigref welcomes the draft European data regulation and expresses its ambitions for the future certification scheme, which is an essential instrument for making operational the mechanisms designed to promote the free movement in Europe of sensitive data of European public and private organisations.

As the debate intensifies between the advocates of a legalistic approach and a lesser scheme, and the advocates of an ambitious policy, VOICE and Cigref call on the European institutions and ENISA to adopt a certification scheme that will allow the establishment of a harmonised regulatory framework guaranteeing the protection and security of information systems and data within the European Union. This high level of certification is an opportunity to create the framework of trust in the cloud that European companies currently lack. It is a trajectory, a goal to be achieved collectively.

The free flow of data requires a trustworthy framework to ensure the security of sensitive corporate and public administration data in the cloud. Currently, many public and private organisations are obliged to maintain data hosting, and associated processing, on their premises because of the sensitivity of this data to unlawful international access by non-European administrative and judicial authorities through legislation with extraterritorial reach.

The European Union must face the consequences of the judgment of 16 July 2020 of the Court of Justice of the European Union in the so-called « Schrems II » case, which invalidated the Privacy Shield adequacy agreement, and equip itself with mechanisms commensurate with this judgment and enabling it to guarantee the free circulation of sensitive personal and non-personal data of European public and private organisations under conditions of verifiable and enforceable trust.

VOICE and Cigref welcome the draft Data Act which aims to implement horizontally applicable safeguards to strengthen the protection of non-personal data hosted in Europe from international access. In addition to these ambitious provisions, our associations call for a European certification scheme for cloud services (EUCS) to guarantee the highest level of immunity to non-European legislation with an extraterritorial scope for certain cloud service offerings on the European market. VOICE and Cigref believe that the implementation of an ambitious certification scheme stems from the spirit of the Cybersecurity Act, the objective of which is to establish a harmonised regulatory framework guaranteeing the protection and security of information systems and data within the European Union.

The letter addressed to Commissioner Thierry Breton, in French and its courtesy translation into English, is available as an attachment to the press release.


About us – Who we are 

We are the French and German CIO associations; communities of Chief Information Officers (CIOs) and other senior leaders who are responsible for digital technologies and digital transformations within private or public organisations. These are all business users of digital technologies. We do not represent ICT suppliers and consultants.

Cigref – France

VOICE – Germany

Press contact : Baptiste Chauveau, Communication & PR Officer – Cigref

Saisir les opportunités de l’IA pour un numérique responsable : nouveau rapport disponible !

Numeum, l’Institut G9+, le Cigref, Planet Tech Care et le Hub France IA, ont dévoilé un rapport inédit intitulé « Green AI & AI for green ». Fruit d’une étude qualitative menée auprès de 72 professionnels – Directeurs des Systèmes d'Information (DSI), Chief Data...

Anticiper les cyberattaques : de la surveillance à la gestion de crise

Dans un monde de plus en plus connecté, les entreprises, grandes ou petites, se retrouvent désormais exposées à des cyberattaques de toutes sortes. La numérisation rapide des organisations a considérablement étendu leur surface d'attaque, créant ainsi un défi majeur...

Le Cigref et ses partenaires européens publient un Manifeste pour les élections européennes.

Nos quatre associations, Beltug en Belgique, Cigref en France, CIO Platform Nederland aux Pays-Bas et Voice en Allemagne, qui représentent collectivement plus de mille grandes entreprises européennes utilisatrices de technologies numériques, ont identifié quatre...

Metaverse: Demystification and the road ahead

This report on metavers, produced by the Cigref working group led by Malika Mir, Director of Information Systems at GROUPE BEL, and Olivier Le Garlantezec, Digital Tech Partnerships Director at LVMH Group, explores the various issues facing organisations and society...