The European Court of Justice's preliminary opinion released last week has sent shockwaves through the tech industry, raising serious doubts about whether the EU-US Data Privacy Framework provides adequate protection for European citizens' data. In response, businesses across Europe are fast-tracking their plans to migrate from US cloud providers to European alternatives.
What the Court Said
In its preliminary opinion on Case C-446/24, the ECJ's Advocate General stated that US surveillance laws, particularly Section 702 of FISA and Executive Order 12333, continue to allow "bulk collection and access to personal data that goes beyond what is strictly necessary." The opinion suggests that the safeguards introduced by the Data Privacy Framework may not be sufficient to meet EU fundamental rights standards.
"The protections offered to EU citizens under US law remain fundamentally inadequate when compared to the guarantees provided under EU law, particularly regarding judicial remedies and proportionality."
While the final ruling is not expected for several months, the strongly worded opinion has prompted many organizations to reconsider their reliance on US-based cloud services.
Companies Taking Action
Major European corporations have announced plans to migrate critical workloads away from US hyperscalers. Deutsche Telekom confirmed it is expanding its partnership with OVHcloud to reduce dependence on AWS. French insurance group AXA announced a comprehensive review of its cloud strategy, with a focus on European providers.
The shift is particularly pronounced in regulated industries:
- Healthcare: Hospital groups across Germany and France are moving patient data to European clouds
- Financial services: Banks are prioritizing EU-sovereign infrastructure for customer data
- Legal sector: Law firms are migrating to European email and document storage
- Public sector: Government agencies are accelerating "cloud souverain" initiatives
Organizations using US cloud providers for personal data of EU residents should consult their legal teams about the implications of this ruling and consider contingency plans.
European Cloud Providers See Surge in Demand
European cloud providers are reporting unprecedented demand following the ruling. Hetzner reported a 340% increase in enterprise inquiries in the week following the opinion. Scaleway has announced plans to open two new data centers to meet demand. Infomaniak reported its highest-ever sales month.
The European cloud industry body CISPE (Cloud Infrastructure Services Providers in Europe) welcomed the development, stating that European providers are "ready and capable of serving enterprise workloads at scale."
What This Means for Your Business
If your organization processes personal data of EU residents using US cloud services, you should take the following steps:
- Audit your data flows: Identify all personal data stored with or processed by US providers
- Assess risk levels: Prioritize migration of sensitive data categories
- Evaluate alternatives: Research European providers that meet your technical requirements
- Plan for migration: Develop timelines and budgets for transitioning workloads
- Update contracts: Review data processing agreements with US providers
Recommended European Alternatives
For organizations looking to migrate, several European providers offer enterprise-grade services:
- Infrastructure: Hetzner, OVHcloud, Scaleway
- Email & Collaboration: Proton Mail, Nextcloud
- Document Storage: Tresorit, Nextcloud
- Analytics: Plausible, Matomo
Browse our alternatives directory to find European replacements for your current US services, or explore our cloud computing category for infrastructure options.