A current legal opinion from the University of Cologne provides new clarity on a long-controversial question: data stored by US companies or their European subsidiaries in the European Union are not protected from access by US authorities. Commissioned by the Federal Ministry of the Interior and Community (BMI), the analysis shows once again that location promises alone do not guarantee data sovereignty.

Report confirms known risks

The report entitled “On the US legal situation regarding global data access by US authorities” proves that American laws grant US authorities extensive access rights. These also apply if the affected data is physically located in data centers within the European Union. Group structures and close economic ties are sufficient to justify access claims. This means that many marketing statements from global corporations lose their substance.

Demand for political consequences

The Federal Association of IT SMEs (BITMi) uses the report as an opportunity to clearly criticize the federal government. In the association’s view, a political commitment to digital sovereignty is not enough. It is crucial that resilience, data protection and compliance with European law become binding selection criteria for digital solutions in administration and authorities. At the same time, the domestic digital economy must be specifically strengthened in order to reduce dependencies on non-European providers.

European providers have an advantage

The report acknowledges that European companies with branches in the United States could theoretically also come under pressure to hand over data stored in the EU. However, there is a key difference: US authorities have no direct enforcement powers on European territory. Companies with headquarters, management and ownership structure in Europe are primarily subject to European law. This makes them the legally safest choice for storing and processing sensitive data. A small presence on the US market also increases the economic independence of EU providers.

Digital sovereignty as a security factor

Data sovereignty is no longer an abstract data protection issue, but rather a central factor in digital resilience. Anyone who wants to protect critical infrastructure, administrative data or company secrets must consider the entire legal chain. The report makes it clear that technological measures alone are not sufficient if a provider’s ownership and control structures represent a gateway to foreign legal systems.

Clear mandate for action

For the BITMi, the conclusion is clear: digital sovereignty can only be implemented with European providers that are legally and economically independent. The report now provides a reliable basis for this. The responsibility now lies with politicians, administration and companies to consistently translate these findings into procurement decisions and digital strategies.