Survey of the potential impact of PUA/INL criteria in the EUCS on the Dutch Cloud market
In the spring of 2023 the OTC finished a report requested by the Ministry of Economic Affairs and Climate and Policy. The OTC has kept its’ eye on the developments around the European Cybersecurity Certification Scheme for Cloud Services. Only last month, the OTC published a Briefingpaper regarding the sovereignty criteria. In 2022 the Ministry asked the OTC to start its’ Survey about the potential effects of Annex J in the EUCS. This Survey has now been published.
Annex J
This Annex described the so-called ‘INL-Criteria’ (Immunity for Non-EU Law). Later, these would be renamed to ‘PUA-Criteria’ (Protection of European Data against unlawful access). These Criteria effectively block access to the EU cloud market for assurance level HIGH certified services from non-EU providers who currently are dominant in this segment. Additionally, the impact for EU-providers that use non-EU services as part of their services will be significant.
Non-Paper
In the opinion of the Dutch government the decision to include the PUA/INL-criteria in the final scheme is a political discussion that should include an Economic Impact Assessment. The Netherlands submitted this view in a non-paper to the EU member states. This paper was signed by various member states. So far, The European Commission does not see a need for an Economic Impact Assessment. To validate the importance of an economic impact assessment the Dutch Ministry of Economic Affairs and Climate Policy asked the core team of the Online Trust Coalition to perform a survey under Dutch professional users and providers of cloud services. The objective of this survey is to assess whether a major impact can be expected.
Survey
The survey process started in 2022 with interviews among providers of cloud services and was finalized in 2023 by interviewing cloud users. The “Market study into cloud services” report published in September 2022 by the Dutch Authority for Consumers and Markets (ACM) was also included in this survey.
Read the full “Survey of the potential impact of PUA/INL criteria in the EUCS on the Dutch Cloud market” by following this link.