Microsoft confirms: U.S. authorities can access data even in EU data centers
A recent statement by Microsoft France before the French Senate has brought a controversial issue into sharp focus: U.S. authorities could gain access to European data even if it is stored exclusively in EU data centers. The underlying cause is the U.S. CLOUD Act, a law that requires American tech companies to hand over data even when it is located abroad.
What was uncovered in the Senate?
On June 10, 2025, Anton Carniaux, General Manager of Legal Affairs at Microsoft France, testified under oath that Microsoft could not technically guarantee that European data would not come under the scrutiny of U.S. authorities, even if it were stored within the EU. This raises key questions about Europe’s digital sovereignty.
Why is that a problem?
The discrepancy between U.S. law (the CLOUD Act) and European data protection regulations (the GDPR) is clear: While the GDPR sets forth strict rules for cross-border data transfers, the CLOUD Act allows U.S. authorities to access data held by U.S. companies—regardless of where it is stored.
What is Microsoft doing?
Microsoft is attempting to create technical and contractual barriers, such as through the EU Data Boundary, which ensures that data is stored within the EU and EFTA. However, U.S. law takes precedence. While transparency reports have not yet revealed any known instances of abuse, from a legal standpoint, a backdoor remains open.
Recommendations for Businesses
- Technological measures such as client-side encryption using a proprietary key set
- Conscious selection of infrastructure—giving preference to EU-based providers whenever possible
- Contracts and Compliance: Including EU Data Localization and Sovereignty Clauses in Procurement Contracts
- Regular risk reviews and technical audits to monitor data flows
This is the only way to avoid the “golden trap” of the supposedly independent U.S. cloud.