Who has access to your cloud data?

In addition to the individuals who have been carefully selected and in compliance with Dutch and EU laws and regulations, the US government may also be involved.

A quick disclaimer: data stored in the cloud of a US cloud provider.

US laws require US-based cloud service providers to make customer data available to the US government upon request. Note that this is true regardless of where the data is stored and whether it belongs to allies.

For this, see the CLOUD Act (law enforcement) and FISA section 702 (intelligence agencies).

Paragraph 2713, chapter 121, Title 18, United States Code:

“A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States”

FISA Section 702 states essentially the same, but in more detail. If requested by the U.S. government, data must be provided.

Machiel van der Wal, University of Amsterdam, has conducted extensive research into this and included the findings in his thesis: “On the Sovereignty of Dutch Government Data”.

Here, with permission from the author, is the link to the thesis: https://scripties.uba.uva.nl/search?id=c11345955

In a NOS article dated January 15, 2025 the Court of Audit, an important government auditor, points out that cloud services could collapse, but also the risk that other powers could access the data.

“There’s a risk that foreign governments, particularly the US, could access and perhaps even modify information from the Dutch central government or its citizens,” says Ewout Irrgang of the Netherlands Court of Audit. “Whether they’ll do so is another matter, but if they want to, they can.”