Schufa Data on Amazon AWS: The Risk to European Digital Sovereignty
Schufa, Germany’s largest credit agency, is migrating the credit and personal data of approximately 69 million private individuals and 6.6 million companies to Amazon Web Services (AWS) servers. While the agency cites high standards for security and digital sovereignty, the move exposes European data to the US Cloud Act, which may grant US authorities access to stored information regardless of whether the servers are physically located in Europe.
Why does the US Cloud Act threaten European data sovereignty?
The primary conflict lies between the EU’s General Data Protection Regulation (GDPR) and the US Cloud Act. According to the source, the Cloud Act allows the US government and its agencies to access data held by US-based companies, irrespective of where the servers are located.
This creates a legal loophole where the physical location of AWS servers in Europe may not prevent US government access. While the GDPR should theoretically exclude such arrangements, the source notes that EU member states currently view this issue with varying degrees of urgency.
How do EU nations differ in their approach to US tech?
European responses to US cloud dependency are fragmented. France has taken a defensive stance, with the state adopting Linux desktops over Windows to reduce US influence and regain digital sovereignty.
This distrust was highlighted during a June 10 Senate committee hearing. Anton Carniaux, Director of Public Relations and Law at Microsoft France, could not guarantee under oath that French citizens’ data would not be transmitted to the US government without the express consent of the French government.
The Netherlands has also acted to protect critical infrastructure. The Dutch government stopped a US company from taking over essential parts of the DigiD state identification platform, which citizens use for tax returns and medical appointments.
In contrast, Greece has embraced US infrastructure. Since 2021, the Greek Digital Ministry has used AWS for state digitalization. Premier Kyriakos Mitsotakis celebrated AWS’s investment in Greece’s Local Zone infrastructure, and the country used AWS servers to manage its pandemic vaccination campaign.
What may happen next for European data independence?
The future of European cloud sovereignty may depend on more than just legislation like the planned Cloud and AI Development Act. IT veteran Jörg Schieb suggests that a fundamental shift in “mindset” is required, similar to the collaborative effort that created Airbus.
There is a possibility that more EU nations could follow the Dutch model of blocking US takeovers of critical IT services. Conversely, if the Greek model of deep integration continues to be viewed as a success, other states might prioritize rapid digitalization over strict data isolation.
Additionally, tensions may rise regarding the Digital Services Act (DSA). Because the US administration views EU law as “censorship,” officials monitoring the DSA—such as those in the Netherlands—could potentially face US entry bans, similar to risks faced by former EU Commissioner Thierry Breton.
Frequently Asked Questions
How many people’s data is Schufa moving to AWS?
Schufa is storing credit information for roughly 69 million private individuals and 6.6 million companies in Germany.
What is the US Cloud Act?
It is a US law that allows US government authorities to access data stored by US companies, regardless of whether the servers are located in the US or abroad.
Which EU countries are resisting US cloud dependency?
France is implementing Linux desktops to reduce US influence, and the Netherlands blocked a US company from acquiring parts of its DigiD identification platform.
Do you believe the convenience of global cloud infrastructure outweighs the risks to national data sovereignty?