Cloud service (Ceren)

A cloud service that is being utilized by EU customers, for example Microsoft, would be governed by the below institutions, this list not being exhaustive. The governance mechanisms touched upon in this entry were fueled by a concern over sovereignty/jurisdiction. The data stored and transported through cloud services could be monitored by non-EU actors (namely US hyper scalers and through these the US government (e.g. Snowden revelations)), thereby potentially giving rise to the compromise of EU data. The race to govern through the below mentioned legal instruments and institutions aim to address sovereignty concerns.

1. The European Union Agency for Cybersecurity' 'ENISA (public)

• Source of authority and Governing instrument: Regulation (EU) 2019/881 on the European Union Agency for Cybersecurity and on information and communications technology cybersecurity certification (Cybersecurity Act) (CSA) empowers ENISA 
• Interest/value: in the NIS360 report published by ENISA, it is stated that ENISA is “the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe” and that ENISA “contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges”.
• Weakness: ENISA's capacity to resist geopolitical and commercial pressure is being questioned, as US hyperscalers continue to dominate global cloud service markets

2. National Cybersecurity Certification Authority of the Netherlands' '(Dutch NCCA) (public)

• Source of authority and Governing instrument: EU Cybersecurity Act (Article 58),  and the Dutch Cybersecurity Regulation Implementation Act which implemented the Cybersecurity Act nationally. This entity is the national cybersecurity certification authority int he Netherlands.
• Interest/value: as described on their website, the NCAA has the following mandate:    
  • “Oversee the issuing of EU cybersecurity certificates at the CSA’s assurance level High;
  • Authorise Conformity Assessment Bodies (CABs) for the CSA certification schemes;
  • Supervise certificates issued throughout the lifecycle of certified ICT products and services;
  • Contribute on European level to the development and maintenance of CSA certification schemes.
  • Market trust, consumer protection, and national security through verified cloud security standards” 
• Weakness: Heavily dependent on the EU-level EUCS framework, where if that scheme is weak or delayed, the NCCA's certification work lacks a solid foundation.

3. European Data Protection Board (EDPB) (EU — public, supranational)

• Source of authority: GDPR (Regulation 2016/679)
• Governing instrument: GDPR; EDPB Guidelines (e.g. Guidelines 01/2020 on processing personal data in cloud services)
• Interest/value: Privacy and data protection; ensuring cloud providers processing EU personal data comply with fundamental rights obligations
• Weakness: Enforcement of the GDPR is left to national DPAs, which vary in resources and willingness to act (Ireland's DPA has been widely criticised for slow enforcement)

4. Gaia X (non-state, international)

• Source of authority: Voluntary membership organisation
• Governing instrument: Gaia-X Trust Framework defines the minimum baseline to be part of the Gaia-X Ecosystem. This framework “provides a common governance and the basic level of interoperability across individual ecosystems”
• Interest/value: Gaia X aims to achieve digital sovereignty through innovation, and its values are “openness, transparency, data protection, security, and portability” 
• Weakness: Gaia-X was trying to build sovereign infrastructure in the EU market where non-European hyperscalers (Microsoft, Google, Amazon) already dominate (Plixavra Vogiatzoglou and Joris van Hoboken, 'The EU's Digital Sovereignty and Quantum Technologies: To What End?')