EU Security Label Plan Is Criticized By Technology Lobbying Groups

ECIPE Director Matthias Bauer, European Union technology policy criticism. (photo: Twitter @MatBauerEcon)

JAKARTA - A report commissioned by the technology advocacy group, the Computer and Communications Industry Association (CCIA), says that the proposed EU cloud security label plan could limit access to cloud services of Amazon, Google, Microsoft, and other non-EU cloud service providers.

The report published by the European Center for International Political Economy (ECIPE) underscores concerns over plans for an EU label among US tech giants who have yet to make a public comment.

The problem that arises is that the EUCS (EU cybersecurity agency ENISA's certification scheme) certification scheme set by the European Union cybersecurity agency (ENISA) requires that cloud service providers must have a registered head office and global headquarters in the European Union and operate cloud services and store and process customer data in the European Union region.

"In my view, the political intent is to curb foreign suppliers but of course, that will have an impact also on EU businesses that are more or less reliant on cloud computing services," ECIPE Director Matthias Bauer told Reuters.

"Member states should now ask cybersecurity agencies as well as the European Commission to waive politically driven EUCS immunity requirements," he added.

"ENISA is waiting for the opinions of the European Union countries and will finalize the scheme taking into account these opinions and submitting the final nominee scheme to the European Commission," said an ENISA spokesperson.

The European Union Commission declined to comment on the ECIPE report.

"Such schemes must comply fully with EU law, as well as with the EU's international commitments, including trade," said a spokesperson for the European Commission.

ECIPE said the proposal could set a dangerous precedent for any data-intensive sector, so cybersecurity labels could become mandatory for new technologies such as internet-connected devices in the energy, healthcare and autonomous vehicles sectors.

The ban could also trigger acts of retaliation by EU trading partners, the think tank said.