Here’s a summary and analysis of the article from The Register on Microsoft's admission regarding data sovereignty:
Source: The Register, 25 July 2025
Source: theregister.com Microsoft exec admits it 'cannot guarantee' data sovereignty
Key Points
What did Microsoft admit?
- Microsoft says it "cannot guarantee" data sovereignty to customers in France (and by implication, the wider EU) if the US government demands data from its servers under the US CLOUD Act.
- Under the CLOUD Act, US authorities can require US-based tech companies to provide digital data, no matter where it is physically stored.
What did Microsoft tell the French Senate?
- Anton Carniaux, director of public and legal affairs for Microsoft France, testified on June 18 in the French Senate.
- He explained Microsoft’s policy: resist unfounded US government requests and only comply if legally required.
- Microsoft asks the US government to redirect data requests to the customer when possible, and requests to inform affected clients if data must be handed over.
- However, when directly asked if Microsoft could guarantee under oath that no data on French citizens would ever be handed over to the US government without the French government's consent, Carniaux replied: “No… I cannot guarantee that, but, again, it has never happened before.”
What does this mean in practice?
- If a US legal request is valid and properly framed, Microsoft is obliged to comply, regardless of where the data is stored.
- Microsoft, AWS, and Google have all supported the CLOUD Act, and European providers with US operations could be subject to similar requests.
Industry and Political Reactions
- Mark Boost (Civo CEO): “US hyperscaler providers cannot guarantee data sovereignty in Europe… This is more than a technicality. It is a real-world issue that can impact national security, personal privacy and business competitiveness.”
- AWS responded by emphasizing that the CLOUD Act does not give the US government “unfettered or automatic access” and such requests require judicial oversight.
- The law also applies to foreign-based companies operating in the US.
Broader Context
- European politicians and technical advisors are pushing for stronger, homegrown solutions for data sovereignty to reduce dependency on US tech giants.
- US cloud services assert technical and contractual controls but admit these cannot override US law if compelled.
Bottom Line
Microsoft has openly admitted, on the record, that owing to US law (CLOUD Act), it cannot absolutely guarantee data sovereignty for European cloud customers if the US government pursues a legitimate legal request. Both local subsidiaries and data kept in the EU are affected by this—only building local/EU cloud alternatives offers “true” data sovereignty.Source: The Register, 25 July 2025
Source: theregister.com Microsoft exec admits it 'cannot guarantee' data sovereignty
