US Law Mandates Data Handover, Prompting European Agencies to Seek Alternatives

A cross-border investigation found that the US CLOUD Act requires US-connected cloud providers to hand over stored information to American authorities when served with a valid warrant. This obligation applies regardless of where the information is physically stored or what privacy assurances were made. Consequently, France's domestic intelligence service and Germany's domestic intelligence agency concluded the risks were structurally irresolvable and chose European-owned replacements.

The US law makes information processed by US-connected providers accessible to Washington without consent, even when stored in Europe. This has led major European government institutions to abandon existing architectures and seek European-owned alternatives to maintain data sovereignty.