iQOO Z10x 5G Review: A Budget Powerhouse

New EU Draft Rules Aim to Protect Data Rights and Privacy

Photo by Christian Lue on Unsplash

Highlights

*EU proposes stringent cybersecurity regulations for major tech companies, aiming to protect data rights and privacy, while facing criticism from US tech giants and concerns over market fragmentation.

In a latest draft proposal, the European Union (EU) cybersecurity agency, ENISA, has put forth stringent regulations for major tech companies, including Amazon, Google (owned by Alphabet), and Microsoft. The proposal centers around an EU certification scheme (EUCS) that seeks to vouch for the cybersecurity of cloud services, particularly concerning the handling of sensitive data.

According to a document obtained by Reuters, non-European Union cloud service providers, such as the aforementioned tech giants, will only be able to obtain an EU cybersecurity label by entering into joint ventures with EU-based companies. However, the draft specifies that these non-EU entities can only hold a minority stake in the joint venture. Additionally, employees with access to EU data will need to undergo specific screening processes and be physically located within the 27-country bloc.

The document further emphasizes that certified cloud services must be operated and maintained within the EU, with all customer data stored and processed exclusively within the EU. Furthermore, it states that EU laws take precedence over non-EU laws concerning the cloud service provider.

These proposed rules reflect the EU's concerns about potential interference from non-EU states and aim to protect the bloc's data rights, norms, and values. However, they are likely to face criticism from U.S. tech giants, who may express worries about being excluded from the lucrative European market.

As Big Tech companies seek to tap into the government cloud market and anticipate increased demand for cloud services due to the growing popularity of AI applications, such as OpenAI's ChatGPT, these draft regulations could significantly impact their growth strategies.

The document explicitly states that certified cloud services will be operated solely by EU-based companies, with no outside entity having effective control over the cloud service provider. This measure aims to mitigate the risk of non-EU interfering powers undermining EU regulations and values. It specifically prohibits undertakings whose headquarters or registered head offices are not established in an EU member state from having any positive or negative effective control over the cloud service provider seeking certification.

The proposed rules will be particularly stringent for personal and non-personal data of high sensitivity. Breaches of such data could have a detrimental impact on public order, public safety, human life or health, or the protection of intellectual property.

However, critics argue that the implementation of these rules could lead to fragmentation within the EU single market, as each country will have the discretion to impose requirements as they see fit.

The U.S. Chamber of Commerce has previously expressed concerns that this plan puts American companies at a disadvantage, creating an unequal footing. Conversely, the EU asserts that these measures are necessary to safeguard the bloc's data rights and privacy.

The draft proposal is expected to undergo review by EU countries later this month, after which the European Commission will adopt a final scheme. As the debate surrounding data protection and cybersecurity continues, the outcomes of these discussions will shape the future landscape of cloud services and data handling in the EU.

Go to Link