Dutch reliance on US cloud providers stokes data privacy concerns

Posted by author February 27, 2025 Tech

Experts say there are concerns that US President Donald Trump could get access to European data with many Dutch ministries, for instance, operating on the public cloud.

The Dutch government is increasingly using cloud services, but very few ministries are aware of the potential risks of doing so.

That’s according to a recent audit from the Netherlands Court of Audit which also found that the government’s services and operations are “exposed to too much risk”.

“The potential harm caused by an interruption of public services could disrupt the country and society,” the government auditing agency said.

The Dutch audit said that Google, Microsoft, and Amazon Web Services are the foreign cloud services that the government uses the most.

Microsoft defines cloudcomputing as having access to servers, data storage, and intelligence over the Internet.

There are concerns that the new Trump administration could either compel tech companies to provide the US with Dutch data or force them to no longer provide cloud services to Europe, causing massive disruptions to public services, experts told Euronews Next.

It’s not the first time the issue has been raised, with the French data regulator reiterating last year its stance that sensitive databases “should be protected against possible disclosure to public authorities in third countries”.

What are the current risks with the US?

Maaike Okano-Heijmans, a senior research fellow at the Clingendael Institute, said the first risk to the Dutch government from using public clouds is that data could be transferred to the Trump administration if requested.

Trump signed the Clarifying Lawful Overseas Use of Data Act (CLOUD) into law during his firstmandate. It allows law enforcement to subpoena US-based technology companies for data stored on any server in the world to help them investigate serious crimes.

Evert-Jan Mulder, founder of the digital transformation consultancy firm Red Plume, said various protections in other US laws also allow these types of transfers.

“These acts have a very wide scope of the data covered, it’s not only US citizens. It’s every citizen,” Mulder said. “If you’re a European, American, or Chinese, it doesn’t matter,” he added.

Okano-Heijmans said the problem isn’t with these US-based Big Tech companies as such, because they comply with existing legislation so they can continue operating in Europe.

“They see big value in maintaining that trusted relationship, but if you have a leadership in the United States who’s sort of overruling that, then we have a problem,” she said.

While Trump has not specified whether he would use or expand the CLOUD Act to get access to foreign data, one of his first executive orders struck down all Joe Biden-era securitydecisions within 45 days.

Americanmedia also reported that Democrats were forced off the Biden-era Privacy and Civil Liberties Oversight Board, an organisation that made sure that EU-US data transfers were meeting privacy standards.

Without the framework, Euronews previouslyreported that “thousands” of EU businesses and public agencies might need to stop using Google, Microsoft, or Amazon for their cloud services.

So far, both Okano-Heijmans and Mulder agree that it’s more of a “risk on paper,” but that it should be taken seriously.

“If the Dutch government or European governments were to work in the cloud, and it’s cut off, then we cannot do our work any longer,” Okano-Heijmans said.

How is the Dutch government responding?

Mulder said security questions go back to 2016 when ministries started adopting public clouds from foreign companies with their internal guidelines.

That changed in 2022 when the government told ministries they could only use public cloud if they had appropriate data privacy protocols in place, he continued.

According to Dutch newspaperde Volkskrant, the Dutch government temporarily halted a planned cloud migration in December because of concerns regarding the reliance on American companies.

The Dutch government acknowledged inresponse to questions from parliament about the use of Google Analytics that the US CLOUD Act does let the American government request data from US-based companies.

It said, however, that data from the government employment site was anonymised and fell outside the scope of the US law.

The response notes that the government is developing “statistics facilities” to reduce dependence on external providers for data hosting, but they say that doing so requires “significant investments in time, money and expertise”.

Mulder said the government is also developing a new national digital strategy that could address some of the security issues with foreign-based public cloud services.

The recent Dutch audit said that while a foreign security service requesting data was “one of the main risks to digital sovereignty,” an analysis of the US CLOUD act found that such information was “rarely requested”.

Euronews Next contacted the Dutch government for an update on these actions but did not receive an immediate response.

‘There’s no other option than Microsoft’

Okano-Heijmans said that while there are Dutch or European cloud services that could work as alternatives, none of them offer an “all-in-one package” like the American companies.

Consultancy firm KPMGfound in a study for the Dutch government that the eight European cloud providers they examined offer “a limited range of services,” compared to US cloud service providers.

The report recommends that a combination of multiple European and Dutch providers be chosen for cloud services.

“We have basically government procurement that oftentimes… is basically saying there’s no other option than Microsoft,” Okano-Heijmans said.

Okano-Heijmans agreed that the government needs to change procurement rules so “we don’t put everything in one basket” and services are “diversified” instead.