The likes of AWS, Microsoft and Google continue to lure in enterprises with their expansive cloud and SaaS offerings. But worry over who has access to customer data in Europe has led to the continent uniting behind the ambitious idea of a next-generation, federated European cloud. Will it happen? Digital Bulletin explores.
Data sovereignty is a burning issue in the world today. The matter of who owns and has access to our data is relevant across society: it is a subject we all as individuals should be engaged with, and one that represents a big challenge for businesses.
For many years, our lawmakers have also been grappling with the consequences of the 21st century data explosion. Here in Europe, the introduction of the General Data Protection Regulation (GDPR) in 2018 was seen as a milestone on the journey to people having control over their data.
But just prior to GDPR’s enactment, across the Atlantic another equally high-profile piece of legislation was being pushed through. The CLOUD (Clarifying Lawful Overseas Use of Data) Act was signed into United States law in March that year, establishing the mechanisms by which its government could get access to personal data stored by U.S.-based tech companies overseas.
In effect, if armed with customer consent or a U.S. court warrant, law enforcement could obtain customer data held on European soil by the likes of AWS, Microsoft and Google. This possibility raised alarm bells on the continent, and casted doubt over just how secure the private data of Europeans was in the hands of American cloud providers, even if AWS, for example, stresses that “customers should maintain control of their own data”.
“With that knowledge, the entire tech industry [in Europe] kind of woke up and said ‘this doesn’t sound right’,” says Falk Weinreich, GM for Central Europe at OVHcloud, the French cloud provider that turned over €600 million ($710 million) last year.
Weinreich is catching up with Digital Bulletin because OVHcloud has a role to play in the ongoing fight for European companies to have data sovereignty in the cloud. As he revealed, the controversy surrounding the CLOUD Act was another wake up call for Europe. Since then, political and business leaders have been hard at work figuring out a way for Europe to achieve cloud independence – and get back absolute control of our data.
The result? On October 15th this year, 25 European Union (EU) states signed a joint declaration to develop a “next generation cloud” for Europe. The EU plans to spend $10 billion over the next seven years deploying “resilient and competitive” cloud infrastructure and services across the continent. By the end of 2020, it will have launched the European Alliance on Industrial Data and Cloud, which will oversee the project’s implementation.
Work in industry has already started on the basics of a federated European infrastructure, however, in the form of the GAIA-X initiative – and this is where Weinreich and OVHcloud come in. OVHcloud is one of the 22 founding members of GAIA-X, a cross-industry and cross-country collaboration to create a unified ecosystem of cloud and data services enshrined in EU law.
GAIA-X was first announced in October 2019, and involves some of Europe’s biggest companies: BMW, Bosch, Deutsche Telekom and Siemens to name just a few. In September, its members signed incorporation papers for the GAIA-X Foundation and a management team was put in place, marking major steps forward.
“The starting point of GAIA-X was that Peter Altmaier [the German Federal Minister for Economic Affairs and Energy] and his consultants became convinced that in Europe there is a little bit of an issue. A huge percentage of data goes to American cloud providers,” says Weinreich.
“So they came and said that we need a European answer. It didn’t necessarily mean a European cloud at that point, like a service offering necessarily, but a legislation if you like, a set of rules which is data sovereign, which is secure, which we can all trust and feel good about. And this is kind of how the project started.”
Over the last 12 months, GAIA-X members have been laying the foundations for the initiative, despite the obvious distraction of COVID-19. OVHcloud has been at the centre of these actions; in September an official collaboration was announced with T-Systems, the IT services offshoot of Deutsche Telekom. The pair are to engage in developing a unique OpenStack public cloud platform, initially to address the specific needs of the public sector or companies operating in strategic or sensitive areas of public interest.
Expect to see serious movement on that front early next year. The foundation has also established a number of different work streams designed to call on the specialism of each founding member. Weinreich says there are now clear agendas to move the project forward at pace, and the GAIA-X Summit in the middle of November will kick off its “next phase”.
imon Hansford, CEO of UKCloud, has been a keen observer from the outside. UKCloud is a British cloud provider specialising in delivering multi-cloud services exclusively to the public sector, and it shares many of the principles that GAIA-X is built upon.
“I absolutely support it, and I think it’s absolutely the right thing to do,” Hansford says. “Clearly there still needs to be work to fully understand what it means, what the deliverables are and when they will be realised. However I definitely understand the principles and I completely agree with them. We need to put data at the centre of digital transformation. It’s an essential resource for not only Europe, but for Britain, for our recovery and our long-term competitiveness.”
So how exactly does GAIA-X intend to deliver data sovereignty for Europe? The promise is an open, transparent and interoperable infrastructure, where data will be accessible through federated catalogues. An ecosystem will slowly build as it finds, combines and connects services from participating providers. The foundation has already illustrated dozens of different use cases across industries like finance, healthcare and agriculture, not just in the public sector.
“You have some customers – and I’m talking about the middle-sized businesses – that read about data sovereignty and they buy the story,” says Weinreich. “They don’t want to put their intellectual property into a cloud that somebody else might have access to. With those companies, we have found our story well received. And with the public sector, by definition – would they really want their defence data, or police data, or healthcare data, in a public cloud? Maybe not. So they are an easier catch.
“It needs a bit more time on, let’s say, the Fortune 500, because first of all they are very much engaged in the U.S.. The likes of Microsoft and AWS are doing a great job with their platforms and their SaaS services, they’re easy to consume. But you start to get locked in, and I strongly believe that at a certain point of time, people will wake up and think that it’s getting expensive and there are some downsides. That’s where I think GAIA-X comes in – not just because of data sovereignty, but also because of the transparency and reversibility.”
The idea that Europe can face up to the might of the hyperscalers is nothing if not ambitious; this is, after all, a set of private companies that have enjoyed extraordinary growth in recent years. The coronavirus has accelerated that growth even more as the shift to remote working has brought digital transformation and cloud technologies to the fore. Overall, the public cloud services market is expected to grow by 17% in 2020 to $266.4 billion – and as of July, AWS owned more than 30% of that market, according to Canalys.
Hansford is adamant GAIA-X, and the EU’s wider goal to provide an alternative, isn’t about blocking the hyperscalers from being able to operate in Europe, more about stemming their broad influence.
“I’m not for one moment suggesting the hyperscalers are all bad,” he says. “I can see some clear use cases where they’re very good. However, I feel there’s a real danger that they become too monopolistic. Therefore programmes like GAIA-X, and companies like UKCloud, who provide a sovereign alternative, I think are really, really important.
“We’ve got to hold that data, not only to create new digital industries but to give public confidence that their data is being used ethically, legitimately and encouraging them to be part of the digital transformation we all need to go through.”
The project is clearly being driven by right-minded companies and individuals who have the interests of Europe at heart. But is it viable?
Eyebrows were certainly raised when news of GAIA-X first filtered into the public domain, and many have questioned different aspects. Concerns have been highlighted about the clarity of GAIA-X’s concept and the vagueness around its timelines, along with the commercial viability and whether it could be successfully integrated with the multi and hybrid cloud setups used most commonly by enterprises today.
Weinreich says he understands those who might be sceptical but he ultimately believes that a project of the scale and ambition of GAIA-X is needed to secure the future of digital Europe.
“I think Europe understands that without coming up with something, the whole digital story will just pass it by,” he says. “There are really no European giants in the digital space at all, and the growth rate is driven by the tech giants right now. The foundation made by GAIA-X is the starting point.
“It has reached the highest level of attention in governments – they are waking up and seeing that this whole industry is transforming, and if Europe isn’t finding a common ground, then it has no role to play any more. So I am positive.”
Europe is only at the beginning of this journey. Under its plans announced in October, it vowed that the European Alliance on Industrial Data and Cloud will work quickly to detail its business, investment and implementation plan for deployment. The details of GAIA-X’s involvement remain unclear, but Weinreich says action next year is critical.
“The groups are coming together, there are more and more parties now who are building on the same values and ideas,” he concludes. “I’ve got the feeling that it’s going in the right direction, but the speed is essential. We’ve got to come up with something tangible next year, because if it takes another year, then another year, then there’s a risk that it’s getting too complicated. So we need to watch the time, but I am positive this can be achieved.”
