To ensure your data is actually protected, you have to check the entire chain to see if there is still a US link somewhere. Germany’s Vergabekammer, the official watchdog for public procurement, has canceled cloud bidding because it violates European privacy legislation.
Anyone wishing to bid for a public tender cannot benefit from European affiliates of US cloud services, even if the cloud servers are located in Europe, and even if data protection clauses apply. There is now a Dutch answer to video hosting: Jet-Stream, the inventors of streaming.
In the Netherlands there is an initiative to build a European cloud for video streaming, which now covers 80% of Internet traffic. The European regulator EDPS has already used the Jet-Stream platform after a successful audit.
Tender, tender, tender, soft
The winner of a German tender wanted to use services from a European company affiliated with a well-known American cloud service provider.
This has been successfully challenged by another supplier, which has made data storage investments within the European Union, but without any legal or technical association with US suppliers.
Data sharing risk
According to the Chamber, there is “an inherent risk of unauthorized transfer of personal data.” The reason for this lies in the US Cloud Act, which mandates widespread access to data, and takes precedence over special clauses on data protection between parties. Appeal will follow.
On August 16, 2022, at the request of the Dutch government, the National Center for Cyber Security issued a memorandum on the applications of the Cloud Act on EU entities. EU entities may fall within the scope of cloud law even if they are located outside the United States. In no event should an EU entity have a US parent company as the parent company will be considered to own or control the data of its affiliate.
Serious consequences
The decision could have serious consequences for the current cooperation of European customers of US technology providers and their European Community companies.
Law firm Gruendelpartner, which has studied the ruling, said the fact that a bidder was excluded from a complex bidding process because it used a subsidiary of a US supplier “could have a significant impact on the future design and implementation of bid procedures.”
Data protection is a business interest
“Data protection is in your own interest: for example, you don’t want sensitive business data to end up in the hands of third parties. All this data is in your records and statistics,” says Steve van der Zyl, director of Dutch broadcasting company Jet-Stream.
“The ruling confirms our conviction that you can no longer ignore data protection in purchasing procedures. Data protection is the law, and also in your best interest. Special clauses between parties are not enough. Working with European suppliers is also not enough. You have to check the entire chain to see if There is still an American link somewhere.”
European video cloud
So Jet-Stream is launching its own European streaming cloud, which will allow business customers such as broadcasters, publishers, events and businesses to professionally broadcast live TV and radio, and roll out video services like Netflix, while ensuring that their media and data are protected and available. There is no legal and technical link with US suppliers.
“Hosting, live broadcasting, encoding, statistics and video player; everything is in the secure cloud, in the hands of the Dutch, located in the European region. We protect the public and the commercial interests of our customers with Jet-Stream Cloud,” van der Zyl said.
EDPS audit
EDPS, the European Data Protection Supervisor that ensures European institutions comply with their data protection legislation, recently broadcast its annual privacy conference via Jet-Stream Cloud. To this end, EDPS has successfully conducted an independent data protection audit on the Jet-Stream platform.
Jet-Stream Cloud will be launched on September 9, during the International Broadcasting Conference (IBC), at RAI, Amsterdam.
