An group of Switzerland's data protection watchdogs has issued a stark warning to public sector organizations: steer clear of major cloud platforms like Microsoft 365, Google Cloud, and AWS. The guidance points to critical shortcomings in data encryption and conflicting legal frameworks as the main reasons for concern.

The group, named Privatim, says that the majority of software-as-a-service (SaaS) offerings lack robust end-to-end encryption. According to their findings, this gap could potentially allow providers to access data in a plaintext state, a vulnerability considered far too great for sensitive public records. (Source: theregister.com)

US Law Sparks Sovereignty Concerns

A key reason for this warning is the controversial US CLOUD Act. This American legislation legally requires US-based technology firms to provide user data to American authorities upon request, regardless of where that data is stored globally. This creates a direct clash with Switzerland's rigorous privacy regulations and its principles of national sovereignty.

The problem persists even if the data physically resides on servers within Switzerland. The US claims its jurisdiction extends across borders, casting a shadow of legal ambiguity over confidential government files. Privatim contends that by relying on these platforms, Swiss public agencies are effectively ceding control over citizen data. (Source: techradar.com)

Call for User-Controlled Encryption

In their official resolution, the Swiss data protection commissioners detailed several other fundamental issues with global cloud providers. They cited complex supply chains involving numerous third-party vendors, which can obscure data handling practices, and an inability for customers to independently audit whether security protocols are being followed.

Ultimately, the authorities outlined a single acceptable scenario for using these services: a public agency should proceed only if it implements its own encryption and maintains exclusive control over the cryptographic keys. This would effectively block the cloud provider from ever accessing the sensitive contents.

What's Your Opinion?

Do you think data location or the nationality of the cloud provider is more important for data security? Should governments exclusively use domestically-owned and operated cloud services for official business? Is it realistic for large organizations to manage their own encryption keys effectively?