It’s weird that this was something that Microsoft would have to admit, considering “The CLOUD Act” has made this mandatory for all US based companies anywhere they operate in the world. This has been a law since 2018.
How much you wanna bet they already do and have been doing for years? They already spy on the rest of us, why is this any different?
I mean. They’re a USA company. Of course they would be required to follow the laws of the country in which they HQ. Did anyone think anything different?
This is what data sovereignty is for.
Well pretty sure local laws here say that certain data should stay within the countries borders (like data from accounting firms) so I hope they also encrypted everything to prevent this carrot from accessing it.
And I’m assuming anywhere else that microsoft operates (the entire world) would be the same too, no? I don’t know why this rhetoric would be specific to the EU.
Of course they would. That’s why I quit using their software.
Anyone wonder where your country’s health records about all their citizens are stored? I’m guessing it’s all on either MS, AWS, or Google. That means Trump could get access to your medical history.
This is important because of his attacks on LGBTQ people, vaccines, abortion, autism, and who knows what other nonsense he wants to persecute.
And here in Canada the Liberal government is putting forth bill C-2, which opens up even more access to the US to get even records stored in Canada by Canadian companies.
https://www.eff.org/deeplinks/2025/07/canadas-bill-c-2-opens-floodgates-us-surveillance
Feel safe yet?
In the case of Germany: confidential computing tech ensures all data is encrypted in storage and in memory, shielded even against data center employees / hosting providers. I imagine that’s become the standard for most countries.
Hmm. Policies might say so. Not every business follow policies, whether they are their own or imposed ones, though. Business going all “it’s ok, our provider have the correct certifications for data handling” are definitely a thing.
Most EU countries are single payer healthcare. Businesses develop the software, but it’s vetted by a government entity before acceptance.
Again for Germany, it’s handled by a single provider, and they absolutely do utilize CoCo tech. (Source: I work at one of the involved companies, sorry, not going to be more specific)
Only if they aren’t using customer provided encryption keys (is using blob/bucket storage) or an equivalent approach to encryption at rest, and make sure they’re doing standard TLS for encryption in flight.
It’s absolutely possible, and standard for any decent organization, to build their cloud architectures to fully account for the cloud provider potentially accessing your data without authorization. I’ve personally had such design conversations multiple times.
It is possible to do things correctly. The question is, is it done often, and is it done on hardware you can trust. I’m somewhat confident if I run my services on bare metal, the provider would have a hard time getting my encryption keys, although it’s not impossible even in this situation. How many people do so with VPS and managed instances, where snooping around the runtime and exfiltrating data unbeknownst to the user is trivial?
Also, beyond that, how many fall for the convenience of things like SSE, whether it’s with customer provided keys or not? That should be a red flag, but people find it oh so convenient.
We’re bound to see stuff bubble out where “we did all the right things” boils down to clicking a checkbox in some web UI and be done with it in the future.
I am from the Netherlands and work at a hospital, we exclusively use Microsoft software.
Here in Italy all family doctors use Gmail for safety data regularly
There’s no telling if that hasn’t already happened. Europe needs to drop Microsoft ASAP.
Canada, too. For the last two years, Canada has entrusted sensitive statistical information to Microsoft. We should be treating MS with the same skepticism we currently reserve for Huawei.
Microsoft said this, but this likely applies to AWS and GCP too.
And OCI. Any US based company is subject to the CLOUD act.
Check out Hetzner, a German cloud provider. Established, reliable and way cheaper than AWS.
I know migrating is nigh impossible for most large apps, but creating a new one on AWS/GCP/Azure is so shortsighted.
More people need to know about alternatives.
Hetzner and reliable do not belong in the same sentence.
Cheap yes, reliable no.
I’ve been using them for my company a lot because of how cheap they are, but compared to other European competitors (like OVH) they are complete garbage. Their pricing is the only redeeming factor.
The Schwartz Group (parent company of Lidl) is currently building a German cloud platform, which sounds a lot more promising.
Lidl Web Services
Hetzner is really trashy though. They seem to suspend or permanently ban folks for no good reason.
Damn, they really go the extra mile for a full equivalent to googles offering.
Right?? Like some shit doesn’t have to be part of the competition…
There is also OTC https://www.open-telekom-cloud.com/en
Color me skeptical of anything Deutsche Telekom. I’d rather look at OVH, Hetzner, and Scaleway than at something from Telekom.
EuropeEveryone needs to drop Microsoft ASAPFTFY
Germany and a handful of other countries have been moving to Linux over the past decade. Betting the rate of uptick speeds up now though.
No one is safe anywhere…
I thought gdpr forced companies to store data securely in the eu. Are they saying they’ll transfer that data to the us to give Trump access, cause that’s a gdpr violation and should result in fines and eventual removal from the eu market.
There are provisions. I don’t remember the exact name of it, but basically, the US says “yah, these business are legit ok, you see?” and the EU is like “oh, ok, deal”. This includes the big providers and a handful of others, obviously.
And yes, it is a farce.
The CLOUD act and GDPR do indeed not work together.
The first sentence and the first paragraph of the article:
even if that data is stored overseas
and should result in fines
Hahaha should
So we all agree that “if demanded” ANYONE’S data can be spied on. Doesn’t matter where.
At least it’s finally admitted to out in the open.
Does this also mean Microsoft would allow China to spy on the US if asked?
deleted by creator
My assumption for many years now has been that the answer to any question involving MS giving access to your data is “yes.”
How is that news? The CLOUD Act is law since 2018.
I’m guessing the admits part and of course Trump is the current (quite jutified) bogeyman.
Continuing to do business in the US after the CLOUD act already implied enough.
Didn’t Microsoft say not too long ago not to worry, because they didn’t have to give access to data?
suck my arch btw
well… there is self-hosting too
As an EU citizen, I don’t find the idea of the US government having access to my data nearly as frightening as the idea of my own government getting into my accounts.
What if the US decided to share info about the data on your accounts to your government?
isn’t this part of how the [insert number] eyes works?
Pretty much, basically the country’s involved will share loads of intelligence with each other and data will be a big thing they’ll share.
