https://www.heise.de/en/news/Opinion-US-Authorities-Have-Far-Reaching-Access-to-European-Cloud-Data-11111060.html heise+ entdecken Suchen[ ] heise Plusheise PlusAbo Suchen[ ] * * * * * * Alle Magazine im Browser lesen IT News * Newsticker * Hintergrunde * Ratgeber * Testberichte * Meinungen Online-Magazine * heise+ * Telepolis * heise autos * bestenlisten * tipps+tricks Services * heise shop * heise jobs * heise academy * heise download * heise preisvergleich * Tarifrechner * heise compaliate * Abo bestellen * Mein Abo * Netzwerktools * iMonitor * Loseblattwerke * Spiele Uber uns * heise medien * heise regioconcept * heise business services * SponsoringLogo Hannover 96 * Mediadaten * Karriere * Presse Anzeige * Themenspecial ChromeOS * Newsletter * heise-Bot * Push-Nachrichten ${title} ${title} ${intro} ${title} ${lead} ${title} ${title} ${intro} ${title} ${lead} ${content} heise+ Das Beste aus heise+ Zur heise+ Startseite ${content} heise online Top-Beitrage von heise online Zur heise online Startseite ${content} heise online Most popular articles by heise online ${content} * Newsticker * Security * IT & Tech * Developer * KI * Entertainment * Wissenschaft * Bestenlisten * Adventskalender * Digital Health * Foren * Alle Themen[arrow-righ][arrow-righ] Anzeige Themenspecial ChromeOS Advertisement Opinion: US Authorities Have Far-Reaching Access to European Cloud Data An analysis for the Ministry of the Interior highlights the reach of US laws. According to it, data stored in the EU is also not secure. listen Print view Servers with an overlaid US flag, with the EU flag blurred in the background (Image: Sehenswerk/Shutterstock.com) Dec 10, 2025 at 10:09 pm CET 4 min. read By * Stefan Krempl Advertisement Contents 1. Opinion: US Authorities Have Far-Reaching Access to European Cloud Data + Access by Intelligence Agencies + Reach of US Jurisdiction + What does this mean for MS 365 & Co.? The debate about Europe's digital sovereignty and the strategic use of US cloud infrastructures in sensitive areas is gaining new momentum. A previously unpublished expert opinion, prepared by legal scholars at the University of Cologne on behalf of the Federal Ministry of the Interior, has now become publicly accessible as part of a Freedom of Information Act (IFG) request. It concludes that US authorities have far-reaching access to data even when it is stored in European data centers. Continue after ad Access by Intelligence Agencies The experts were tasked with clarifying whether and to what extent US intelligence agencies and other state bodies have a legal right of access to data in the cloud, even if the infrastructures are operated outside the United States. According to the opinion, the Stored Communications Act (SCA), extended by the Cloud Act, and Section 702 of the Foreign Intelligence Surveillance Act (FISA), in particular, allow US authorities to compel cloud providers to hand over data. A sensitive point is the finding regarding the scope of US jurisdiction. Companies are therefore required to hand over data even if it is stored outside the USA. The decisive factor is therefore not the physical storage location of the information, but the control over it by the affected company. This implies that even data stored in data centers on European soil and managed through German subsidiaries are subject to access. The prerequisite is that the US parent company exercises ultimate control. Reach of US Jurisdiction However, the reach of US laws does not end here. According to the opinion, the jurisdiction of the United States can impact not only European subsidiaries of US companies. It also has the potential to affect purely European companies, provided they maintain relevant business connections in the USA. This extends the risk of indirect or direct data access to a wide range of companies operating in the European internal market. Although a cloud provider could technically prevent itself from accessing the data, for example, through encryption, this does not necessarily avoid the disclosure obligation. US procedural law requires parties to store procedurally relevant information even before the start of legal proceedings. A cloud service provider that is regularly confronted with disclosure requests could therefore be obliged to retain data. If it excludes itself from access through technical measures, it risks significant fines or criminal consequences. In Europe, supervisory authorities may prohibit the disclosure of information to authorities in third countries based on the General Data Protection Regulation (GDPR). Data transfers to the USA can currently be based on the shaky adequacy decision of the EU Commission - the EU-US Data Privacy Framework. However, the opinion highlights the legal tensions arising from the global reach of US laws. It points to the need to develop European alternatives to strengthen digital sovereignty. Continue after ad Videos by heise mehr Videos * c't 3003 * heise & ct * Peertube What does this mean for MS 365 & Co.? Lawyers Stefan Hessel, Christina Ziegler-Kiefer, and Moritz Schneider conclude in a current analysis that the use of the cloud-based solution Microsoft 365 in compliance with data protection regulations is still fundamentally possible. The abstract risk, stemming from extraterritorial US powers, does not in itself constitute automatic unreliability of the processor, as long as no systematic violations of European law are proven. Those responsible must concentrate on their compliance obligations and conduct a data protection impact assessment if the risk is high. Other experts do not see it that way. Melden Sie sich zum KI-Update an Melden Sie sich zum KI-Update an Melden Sie sich zum KI-Update an Melden Sie sich zum KI-Update an (wpl) Don't miss any news - follow us on Facebook, LinkedIn or Mastodon. This article was originally published in German. It was translated with technical assistance and editorially reviewed before publication. Dieser Link ist leider nicht mehr gultig. Links zu verschenkten Artikeln werden ungultig, wenn diese alter als 7 Tage sind oder zu oft aufgerufen wurden. --------------------------------------------------------------------- Sie benotigen ein heise+ Paket, um diesen Artikel zu lesen. Jetzt eine Woche unverbindlich testen - ohne Verpflichtung! Wochenpass bestellen Sie haben heise+ bereits abonniert? Hier anmelden. Oder benotigen Sie mehr Informationen zum heise+ Abo Home Anzeige [svg] [spon_article_Synology_mpu-12ac8fc7aa6a1c2] Advertisement * Special: Zusammen das Datacenter weiterentwickeln * Themenspecial: Secure IT fur Unternehmen * Mehr Kunden fur Ihren Online-Shop gewinnen * Warum ist ChromeOS so sicher? Hier informieren! * Wenn die menschliche Firewall fallt * Wie Firmen die ,,Legacy-Falle" umgehen konnen * So revolutioniert KI die Produktivitat * Wie KI das End-to-End-Testing verandert * Wenn das Backup unter Beschuss gerat * KI als Motor von Innovation, Sicherheit und Fortschritt Share this article Shortlink: https://heise.de/-11111060 Beliebte Bestenlisten Alle bestenlisten[arrow-righ][arrow-righ] [svg] Top 10: Das beste Smartphone bis 400 Euro im Test bestenlisten --------------------------------------------------------------------- [svg] Top 10: Das beste Heizkorperthermostat im Test bestenlisten --------------------------------------------------------------------- [svg] Top 10: Die beste Smartwatch mit EKG-Funktion im Test bestenlisten Alle bestenlisten[arrow-righ][arrow-righ] Advertisement Advertisement Alle Angebote IT News * Newsticker * Hintergrunde * Ratgeber * Tests * Meinungen Online-Magazine * heise+ * Telepolis * heise autos * bestenlisten * tipps+tricks Services * heise shop * heise jobs * heise academy * heise download * heise preisvergleich * Tarifrechner * heise compaliate * Abo bestellen * Mein Abo * Netzwerktools * iMonitor * Loseblattwerke * Spiele Uber Uns * heise medien * heise regioconcept * heise business services * SponsoringLogo Hannover 96 * Mediadaten * Karriere * Presse Newsletter heise-Bot Push Push-Nachrichten Back to top * Kontakt * Impressum * Barriere melden * Vertrage kundigen * Cookies & Tracking * Datenschutz * Mediadaten * 4994339 * Content Management by InterRed * Hosted by Plus.line * Copyright (c) 2025 heise medien Unser Hauptpartner Hannover 96 kopieren *