Taking into account that data storage and processing are features of numerous services provided by both private and public sectors, the hurdles (extra costs and administrative burden) associated with (proliferating) data localisation restrictions could lead, indirectly, to negative impacts on consumers and citizens as users of those services. For example it could lead to no service being provided where otherwise it could have been provided - such as cross-border digital public services - or less attractive terms and conditions of a service). The evaluation will have to cover these aspects and assess the extent to which the option chosen had an impact on the development of the Digital Single Market. It would need to examine whether it contributed to reducing the number and range of data localisation restrictions and to enhancing legal certainty and transparency of remaining (justified and proportionate) requirements, which is the first specific objective pursued by this initiative. Moreover, repercussions could be on the fourth specific objective concerning trust in / security of (cross-border) data storage and processing, since often localisation is driven by legal uncertainty / lack of trust in the market, as emphasised by the results of the public consultation. The evaluation will also have to assess whether the policy initiative has contributed to improve the trust in free flow of data from the Member States and whether they can reasonably have access to data stored abroad for regulatory control purpose (second specific objective). The evaluation shall be accompanied by an ad-hoc industry survey to assess progress in the area of switching (third specific objective), pricing and take-up of cloud services. A special edition of Eurobarometer may be considered for this purpose.

Since the principle of free flow of data is a pre-condition for the emergence of innovative virtualised and/or distributed data storage and processing technologies, as well as an enabler of data-driven innovation in general, this evaluation will have to assess the impact that the policy initiative suggested in this IA had on the capacity of businesses and the public sector to innovate as a consequence. It may seek synergies with the evaluation of other data policies.

A comprehensive evaluation could take place 5 years after the start of application of the rules. This evaluation will be executed in close cooperation with and relying on the information provided by the single points of contact of the Member States.

Insights on national policies come directly from the in-house expertise and research of country teams and daily policy work on data policy issues and the input from Member States. The information provided will be complemented by information collected through country visits.

The European Digital Progress Report (EDPR) covers 28 Member States and provides comprehensive data and analysis of market, regulatory and consumer developments in the digital economy. It is based inter alia on DESI (Digital Economy and Society Index) combining the quantitative evidence from the DESI with country-specific policy insights. DESI is based on data from Eurostat and various studies and surveys, and is structured in five dimensions: Connectivity, Human Capital, Use of Internet, Integration of Digital Technology and Digital Public Services. DESI already tracks the degree of take-up of cloud services, but more specific indicators may be designed.

Eurostat tracks indicators on enterprises' use of cloud computing services in the EU. Eurostat also conducts a bi-annual survey of the companies operating in the market tracking the factors limiting the enterprises' use of cloud computing-related services. This data can be used to determine a benchmark and to monitor the impact on the business sector of the provisions adopted.

The legislation will require Member States to designate a single high-level contact point to coordinate and facilitate the application of the measure in their respective jurisdictions. These contact points will serve collectively as an expert group that would allow for the exchange of information and for a process of constant monitoring by the Member States and the Commission. Furthermore, the experience of the expert group will serve as a valuable source of information during the ex-post evaluation phase of the legislation, which should take place five years after its application.

Decrease in the % of companies (large or SMEs) worried by the difficulty to unsubscribe or change cloud service provider

This information would be obtained from publicly available sources or directly from Member States or the Single points of contact expert group

To the extent the relevant data is available - the effective use of the information channels

The prevention indicator developed to measure the ability of the procedures provided by Directive 2015/1535 (the Transparency Directive) to prevent barriers to trade

The preferred option selected above will be monitored by the indicators listed in this section. Different indictors and sources of information are listed for the different operational objectives.

The second phase would focus on the mid-to-long-term and would address direct effects of the rules contained in the legislation. The table below presents the operational objectives corresponding to the identified specific policy objectives, the indicators that would be used to monitor progress towards meeting the objectives as well as the possible sources of information. The information-gathering would start immediately after the beginning of application of the legislation and then continue every year (every second year in the case of the number and use of dedicated information channels).

The first phase would concentrate on the short-term and start right after the adoption of the legislative act. During this phase the Commission would engage with Member States (e.g. groups of experts) in order to increase their awareness and understanding of the new rules and stimulate the adoption of pro-active approaches when it comes to notifying data localisation restrictions and ensuring their transparency. The Commission would also engage with the relevant stakeholders in order to increase their awareness and understanding of the new rules.

The Commission will ensure that the action selected in this IA contributes to the achievement of the policy objectives defined in Section 4. The monitoring process could consist of two phases:

As regards switching / data porting, Option 2a would also be coherent with the IPR protection mechanisms of the Database Directive and the Trade Secrets Directive - it would not require any disclosure of IPR-protected information. Secondly it would not preclude foreign operators from accessing the EU market, would not treat foreign providers differently from EU providers or other foreign providers.

The preferred option does not go beyond what is necessary to solve the identified problems and is proportionate to achieve its objectives. Firstly, Option 2a will rely to a high degree on the existing EU instruments and frameworks: the Transparency Directive for notifications of data localisation restrictions and different existing frameworks ensuring data availability for regulatory control by Member States, thereby limiting additional administrative burdens on Member States. Secondly, the approaches to the movement of data across borders and across cloud service providers / in-house IT systems would seek balance between EU regulation and the public policy interests of Member States as well as balance between EU regulation and self-regulation by the market.

(iv) Clarification that existing security requirements remain applicable to data storage and processing in other Member States and under outsourcing agreements would foster trust and facilitate a single market for this type of services and activities.

(iii) Self-regulation and codes of conduct would induce a market-driven progress towards free movement of data across data cloud service providers and/or in-house IT systems in the single market.

(ii) Strengthening the commitment of market players to provide data for regulatory control even if it is stored in another Member State (legal principle) and a complementary administrative cooperation between the Member States where needed, would reinforce the case for the free movement of data in the single market.

(i) The combination of a legal free movement of data principle, notification, and review and transparency requirements would give appropriate incentives to remove and prevent data localisation restrictions across the EU single market.

In particular, Option 2a would result in an effective and coherent framework in all the four intervention areas of this initiative:

The preferred option complies with the principle of subsidiarity, as the EU digital single market in this field cannot be accomplished by Member States acting nationally.

By combining clear legal principles, transparency requirements, clarifying the applicability of current security requirements, cooperation between and with Member States through the establishment of an expert group and self-regulation, the option will enhance legal certainty and raise trust levels, deliver tangible results in the short term (especially compared with the baseline option and option 1), while leaving substantial flexibility for the framework to evolve and adapt. Option 2a also combines measures that are supported by stakeholders as best ways to foster the free movement of data in the EU single market.

Based on the above comparison, it appears that on balance Option 2a is the option that would best achieve the objectives of the initiative, taking into account the criteria of effectiveness, economic impacts and stakeholder support.

For each of the different categories of consideration, the options received scores on a scale from -2 (direct negative impacts) to +2 (direct positive impacts). The calculated total scores are displayed in the last row.

For Option 3, stakeholders' views were of diverging nature across the different intervention areas. As indicated before, most stakeholders see legislative intervention as suitable to introduce a free flow of data principle. However, they have not advocated a detailed legislative initiative. This results in a score of +1 for stakeholder support in this intervention area. Regarding switching for porting data, however, the majority warned the Commission for being too prescriptive in terms of prescribing technological standards, as this could be a barrier for innovation, leading to a -2 on this intervention area. Therefore, the stakeholders support is averaged to -1 (Option 3: -1)

Option 2 combines measures that are supported by stakeholders as best ways to foster the free movement of data in the EU single market (Option 2: +2). Sub-option 2a will also obtain a positive scoring in this category, many stakeholders that were in favour of a legal right for the free flow of data, propagated a soft law approach to porting data and switching providers/IT-systems, as they believed that a portability right could potentially curb innovation in the market (Sub-option 2a: +2).

Stakeholders across the spectrum have strongly advocated legislative action to ensure free flow of data in the EU. Therefore, Option 1 receives a -2 as it relies entirely on soft measures. However, on the intervention area of switching and porting data between cloud service providers, they were less in favour of legislative action. Therefore, in this area it receives a 0. Therefore, the overall score for stakeholder support will be averaged out to -1 (Option 1: -1).

Option 3 will result in direct higher burdens for Member States public authorities, because of the likelihood of many implementing procedures. (Option 3: -2).

Since Option 2 does not envisage prescriptive detailed provisions it will achieve the objectives of the initiative at a limited and reasonable cost to the public authorities and market players. It would however lead to direct costs for the Member States in terms of human resources (Option 2: -2). This would be the same for Sub-option 2a (Sub-option 2a: -2).

Option 1 will lead to a higher administrative burden for both the Member States and the Commission, because of the strengthened enforcement of existing legislation. This, however, will be in placed in the category of indirect costs (Option 1: -1).

As regards coherence, option 3 would risk overlapping with existing mechanisms, for example in the area of data availability for regulatory control, because currently there are already many sectoral cooperation mechanisms in place (Option 3: -2).

Option 2 is nearly consistent with all existing EU legislation, because its principles merely complement the provisions in existing legislation, such as the General Data Protection Regulation. Its scope explicitly does not overlap with this regulation. However, the Option would run the risk of overlapping with other EU instruments on security of data storage by providing for cloud specific certification schemes, notably with the NIS Directive (Option 2: -2). Sub-option 2a ensures full coherence with existing EU legislative instruments, because it is consistent with the GDPR in the same way as Option 2, but leaves any EU policy actions on security to the scope of other/existing EU instruments, such as the NIS Directive (Sub-option 2a: 0).

As Option 1 concerns a soft-law approach, the option will however not lead to problems of coherence with existing EU-legislation (Option 1: 0).

As Option 3 would also decrease the number of data localisation restrictions, there will also be positive environmental and social impacts, As in Option 2 these will be of an indirect nature (Option 3: +1).

Because Option 2 is expected to achieve all four policy objectives efficiently, this will yield positive economic and social impacts, as explained in section 6.4.2. However, as these impacts will be of indirect nature (e.g. through the relocation of data centres), the scoring is kept at +1 (Option 2: +1). This would be the same for Sub-option 2a (Sub-option 2a: +1).

Because Option 1 envisages the use of existing legislation to eliminate unjustified data localisation restrictions at least to a certain degree under this option, it can have indirectly positive effects in terms of environment and employment (Option 1: +1).

Option 3 could also lead immediately to significant burden for businesses, through very detailed technical specifications for switching between providers. Therefore, although it will likely reduce the number of data localisation restrictions to a degree, it will only get an indirectly positive score in terms of economic impacts (Option 3: +1).

By establishing a clear legal principle accompanied by cooperation between and with Member States as well as self/co-regulation, Option 2 will enhance legal certainty in the short term, while staying relevant and effective in the long term. This option would have a much stronger impact in addressing the problems related to legal uncertainty and lack of trust, which is needed for a true change in market dynamics, removing 'self-imposed' localisation. Evidence gathered for this Impact Assessment shows that this would have the most significant economic effects (Option 2: +2). Sub-option 2a may lead to less effective mitigation of market dynamics leading to 'self-imposed localisation'. This is because, it is harder to successfully conduct awareness raising campaigns around self-regulation (e.g. on switching and porting data) than around a new legal right (e.g. the right to switch and port data). On the other hand, as indicated in section 6.4.1.3, the introduction of a portability right could lead to significant compliance costs for cloud service providers. Self-regulation, however, would present the cloud service industry with the opportunity and responsibility to self-regulate while minimising compliance costs. Also in the area of security of data storage and processing, Sub-option 2a yields positive economic effects, as it will enhance legal certainty for businesses, clarifying that any currently applicable security requirements will remain applicable to them regardless of the location of the storage or processing in the EU and also under potential outsourcing of these activities. Therefore, sub-option 2a receives a positive scoring for economic impact as well (Sub-option 2a: +2).

As Option 1 would not change the more fundamental problem of localisation by the market as a result of legal uncertainty and a lack of trust, it is not deemed to generate positive economic effects (Option 1: 0).

Effectiveness-wise, Option 3 would be less likely than Option 2 to realise the policy objectives set out in section 4 of this Impact Assessment. By enshrining detailed provisions in law on what constitutes (un)justified data localisation restrictions, and forbidding the existence of all unjustified data localisation restrictions along these lines, it would significantly lighten up the existing situation. But it would also risk inciting Member States to list entire sectors or types of data as areas of justified restrictions and therefore only moderately reduce the number and range of data localisation restrictions and prevent the emergence of new restrictions. The positive impact in terms of reaching the policy objectives is therefore less predictable (Option 3: +1).

Option 2 would prevent Member States from putting in place unjustified data localisation restrictions, requires the review and evaluation of all existing data localisation restrictions and foresees a notification mechanism in case Member States intend to put in place new (in their view justified) data localisation restrictions. It would also introduce the principle of switching and porting data between cloud service providers and back in-house, but it avoids prescriptive and technical legislation in the first instance. The same method applies to the area of security of data processing and storage. This option would therefore achieve all four policy objectives (Option 2: +2). Sub-option 2a also receives a positive scoring for effectiveness, as the policy objectives of easier switching and porting of data and security of data storage and processing can also be attained by relying on existing instruments and self-regulation. More specifically, the reassurance provided by Sub-option 2a that the legal proposal would avoid any overlap with other EU security instruments, would lead to a higher level of legal certainty (Sub-option 2a: +2).

Option 1 would use non-legislative initiatives and a strengthened enforcement of existing legislation to promote the stated policy objectives. Such an approach could persuade Member States to remove certain existing data localisation restrictions, as was indicated by the structured dialogue with the Member States. Moreover, a strengthened enforcement approach could be an improvement on the baseline scenario. However, there would be no clear legal framework for discussions with Member States and the impact of infringement procedures would be limited and likely to take considerable time to deliver results. This leads to an overall indirect negative scoring for effectiveness (Option 1: -1).

In this comparison exercise, effectiveness is defined as the ability of the options to reach the specific policy objectives of this initiative.

In the descriptions below, an explanation of the scoring will be provided. The calculated total scores per option are displayed in the last row of the table below summarising the findings.

This section presents a comparison of the options in the light of the impacts identified. The options are assessed against the criteria of efficiency of reaching the policy objectives, potential impacts in terms of economy, environment, society and financial burden, as well as taking into account the support expressed by the different stakeholders. For each of the different categories, the options receive scores on a scale from -2 to +2, taking into account the following rules:

As Option 2 and 3 contain the same policy approach to this area, stakeholder views for security of data processing would here be the same as for Option 2. Therefore, the reader is referred to section 6.4.4.4.

Also in the cloud switching workshop many participants were positive towards the establishment of a legal principle of data portability to facilitate switching, however many explicitly noted that any such right should not be too detailed, as too many prescriptive solutions in law might prevent the industry from coming up with good solutions.

Stakeholders emphasize that being over-prescriptive is a risk regarding multiple elements of a switching right, but technical standards were mentioned most in this context. As one respondent put it: "Rebuilding IT solutions entails high costs. Imposing similar demands on machine-generated data would mean enforcing technical solutions, which would hardly benefit innovation and competitiveness in Europe."

Although around 60.6% of stakeholders participating in the public consultation support the introduction of a specific right to ensure the possibility of switching between providers and IT systems, almost all stakeholders have pointed to the risk of being too specific in proposed legislation.

Option 3 would meet stakeholders' views in this respect, as it would develop a detailed cooperation mechanism to enforce the possibility for public authorities to effectively obtain data in a timely manner, when it is processed in another Member State.

As indicated above, stakeholders identified data availability for regulatory control as an important issue in their responses to the public online consultation.

In position papers submitted to the Commission in the framework of the public online consultation, several stakeholders have emphasized the importance of awareness raising around the principle of the free flow of data. In their opinions, Option 3 would be probably less convincing than Option 2 because Option 3 is a purely legislative option and makes no reference to awareness raising activities. The reason is that Option 3 foresees comitology as execution mechanism, instead of a cooperation group made up of representatives of Member States' civil services. Without awareness raising, these stakeholders could argue, it is not efficient to adopt legal principles on the free flow of data as this would insufficiently address the legal uncertainty and lack of trust problems that were identified by nearly all stakeholders.

The expected impacts of Option 3 on Member States' public authorities are the same as those of Option 2 for the intervention area of security of data processing, as both options contain the same policy approach to this area.

The expected impacts of Option 3 on Member States' public authorities are the same as those of Option 2 for the intervention area of switching and porting data between providers and IT systems, because this option leaves the responsibility with the private sector.

As Option 3 would place any actions on this intervention area under the comitology mechanism mentioned in section 6.5.3.1, the administrative burden for this intervention area will be shared with the free flow of data area and will not generate extra burden in excess to this.

The administrative burden on Member States' public authorities posed by Option 3 would be significantly higher than for the other options. The reason is the proposed set-up of a new Committee under EU law. Member States' civil servants would have to travel to Brussels more frequently than in Option 2. This would result in human resources costs of 0.75 FTE, i.e. 0.25 FTE more than in Option 2 as a result of more frequent meetings and travelling by Member States' civil servants. On top of this 0.75 FTE, there would be an additional 0.5 FTE needed because of the high number of implementing acts (and the resulting comitology work) that is envisaged under this policy option. It would therefore mean a total of 1.25 FTE per Member State. Using the institutional cost estimation tool, this would mean an average annual cost of EUR 83.460 per Member State.

As Option 3 contains the same provisions on security as Option 2, the impact on environmental and social issues can be considered the same.

The assessment of environmental and social impacts for this option is the same as for Option 2.

Policy action on improving data availability to Member State authorities for regulatory control purposes would increase cross-border data mobility because of raised levels of trust both with market participants and with Member States authorities. Therefore, there would be positive environmental impacts flowing from this intervention area under Option 3, in line with the previous section.

The social/employment impacts foreseen by Option 3 are similar to those in Option 2, so the reader is referred to section 6.4.2.

Option 3 would have a positive impact on the environment, since cloud service providers and organisations using in-house data storage or processing IT systems would have more opportunities to deploy data storage or processing infrastructures in those locations which are optimal from the environmental point of view and to adopt innovative approaches to the use of energy in data centres.

This option entails developing common standards, a European certification scheme for the security of storage and processing of data. Their use would be mandated. The economic impacts are qualitatively very similar to those of Option 2, but the magnitude of their economic impact on business is likely to be wider as it would become an obligation for all companies, who would have to adopt the standards irrespective of their size and cross-border activity.

This is in line with stakeholders' concerns emerging from the public consultation about overly prescriptive regulation. They suggest that business models and types of non-personal data are too different to allow for full regulatory intervention. Rather, a principle-based approach is advocated.

The scant quantitative evidence currently available and the results of the support study and the public consultation do not seem sufficient to argue the case for the type of strong regulatory intervention under Option 3.

As outlined in section 5, this option would establish both the principle of switching / porting facilitation and harmonise the key technical and legal conditions (e.g. concerning types of data, usable formats / structures, timeliness). In section 2.3 the trade-off between the regulatory burden on providers and the higher operational efficiency of the business end-users was described. This trade-off would be even more radical under Option 3, which would be more prescriptive in nature. Too invasive a regulatory intervention may also stifle innovation and undermine growth of the cloud data services sector in Europe.

The impacts on the business sector under this option are going to be equally sizeable as under Option 2 and of the same indirect nature.

This option would probably incur a higher increase in coordination costs for the Member States' administrations as compared to Option 2 due to the number of elements in the process that will have to be harmonised (including templates and dispute resolutions mechanisms). The evidence from the structured dialogue with the member states is not clear on whether the benefits (similar to the ones from Option 2) would overcome the costs (higher than Option 2).

Option 3 foresees to establish a detailed cooperation mechanism to enforce the possibility for public authorities to effectively obtain data subject to detailed procedures, when it is stored or processed in another Member State. This type of intervention will require competent authorities to meet deadlines for answering the enquiries by other Member States, and common request and response templates would be specified for the implementation of the policy initiative. As for the previous two options discussed, the impacts on the business sector from provision easing data availability for regulatory control by Member States authorities are likely to be indirect.

In terms of impacts on the cost and choice for users, Option 3 would relieve organisations using external data services from negative indirect effects. To recall, it is reasonable to assume that under the baseline scenario and in the absence of intervention the additional costs borne by the cloud service providers due to data localisation restrictions would be passed on to users (e.g. cloud providers might charge a premium for the use of cloud data centres in particular locations). In fact, prices for the same quality of services can differ up to 50% between different Member States.

As this option would establish pre-defined, harmonised white or black list of localisation restrictions, as well as a dedicated platform to ensure transparency around them, it would have a large impact on data localisation restrictions and would provide legal certainty. At the same time, it can be expected that the option would only moderately reduce the number and range of data localisation restrictions and prevent the emergence of new restrictions, since the pre-defined assessments approach would incite Member States to seek listing entire sectors or types of data as areas of justified restrictions. Also, this option and the measures included therein would entail a higher regulatory burden for the Member States’ public administrations. As the benefits of these more stringent measures could not be justified, the precautionary and better regulation principles would not be well served by this intrusive option.

6.5Option 3: Detailed legislative initiative to ensure trustworthy free flow of data across borders and facilitate switching and porting data between providers and IT systems

No significant stakeholders' views were received regarding this Sub-option, as it was not tested in the public online consultation. This is because Sub-option 2a relies completely on existing security requirements. Assuming that these requirements achieve the policy objectives in an efficient manner, stakeholders' judgment would be that the sub-option is equally positive as Option 2.

Nearly all stakeholders with an IT background state that security of data processing would benefit from increased data mobility. Other stakeholders concur with this, or remain silent on the topic. Keeping this in mind, it could be inferred that their opinion would be that Option 2 is preferred, as it proposes to introduce a principle of free flow of data within the EU and the review of existing measures. This would enhance legal certainty to cyber security providers, meaning that they would be able to deliver better cyber security services to their customers, for instance by doing cyber security updates at once for all customers, regardless of their location in the EU.

As indicated above, many stakeholders that participated in the public consultation and the dedicated workshop on switching cloud providers, propagated a soft law, market driven approach to porting data and switching providers/IT-systems, as they believed that a portability right could potentially curb innovation in the market. This sub-option, relying on self-regulatory codes of conduct, would therefore better respond to the vision of the majority of stakeholders.

Certain Member States have also shown interest in a legal right to data portability. The French Digital Council has announced its support of an EC initiative to introduce legal rights to portability of non-personal data, as discussed in the EC Communication on Building a European Data Economy. The Estonian government has also recently published a vision paper on the free movement of data in which they elaborate on the possible future framework for data access and portability. Although no direct call is made for the development of new data portability rights, the Estonian government clearly sees the need to address the issue, claiming that "there are at present no obligations to guarantee even a minimum level of data portability, even for widely used online services such as cloud hosting providers", and that " The right to data portability is relevant both in the B2C and B2B contexts".

Among the participants in the workshop on cloud switching (who were all either cloud service providers or business customers of such services), about half considered there is need for a European regulation to ensure a right to port data in view of switching cloud service providers. There was a preference among the participants for principles-based legislative initiative rather than more detailed legislation, as too much detail in the provision might hamper the development of flexible and innovative solutions.

One responding organisation to this open question explained its position by drawing a comparison between portability rights for individuals regarding their personal data and the data flows that businesses deal with: "Organisations using cloud services are no different to consumers in terms of their need for the portability of the data they collect with these systems and services, it is the history of their organisations business transactions and the portability of such data is an essential element of protecting any organisations assets and capability."

In written contributions to the public consultation, a small majority reacted positively when asked about their attitudes towards a more general portability right for non-personal data. Although they were not specifically consulted about the introduction of data portability rights for cloud switching, many of the respondents to the public consultation were also cautiously positive towards the possible EC introduction of such rights. When it comes to cloud-specific portability rights, several positive effects were cited by the respondents, such as reduced vendor lock-in, increased competition, new business opportunities, more data-driven innovation and research and better convenience for the customers. Among the negative effects cited by the respondents were increased financial and technical burdens on providers and the possible disclosure of IPR and trade secrets.

Of the stakeholders that participated in the public consultation, most argued for non-legislative forms of EU intervention, such as setting standards or addressing the issue through developing model-contracts for cloud service providers.

Option 2 will address these legitimate concerns by providing certainty on private undertakings' responsibility to provide data and strengthening Member State cooperation. Appointing single points of contact in the Member States and putting in place a cooperation framework on data issues should further promote the effectiveness of the principle of data availability for regulatory control and its development via model clauses and practices. Therefore, Option 2 would correspond to the views of the majority of stakeholders.

22.3% of stakeholders responding to the public online consultation identified the immediate availability of data for supervisory authorities as an important enough issue to keep (some form of) data localisation restrictions to safeguard it, while at the same time a majority of respondents voted for taking away data localisation restrictions in general. This clearly shows that stakeholders feel that data availability for regulatory control is an important issue that needs to be tackled.

During the structured dialogues with the Member States the availability of data for regulatory control emerged as a key concern. During the first dialogue the fact that cross-border storage could in some cases mean that data would be unavailable for inspection, was flagged by Member States as a 'key challenge or threat' of a future free flow of data right. In the second dialogue this was reversed to a positive 'functional requirement' to flank a potential free flow of data right: Member States indicated to be willing to remove certain data localisation restrictions if availability of certain data would be guaranteed by another provision of the legal act. At the end of the dialogue process, during the third meeting, the majority of Member States agreed that data availability should be a building block of a forthcoming free flow of data proposal.

According to certain stakeholders, awareness-raising around a legal principle on the free flow of data is important. The government of the United Kingdom phrased it accordingly while discussing its favoured policy option in a position paper submitted as answer to the public online consultation: "The European Commission proposes a new consolidating regulation which provides clarity and legal certainty […]. To be effective, this should be accompanied by awareness raising in Member States […]" Option 2 foresees in such awareness raising around the Free Flow of Data principle (awarding this task to the single points of contact group). Therefore, Option 2 would be in line with these stakeholders' views.

Therefore, only a legislative instrument would be appropriate to solve the problems, as non-legislative initiatives would not replace the current patchwork of applicable legislation and therefore retain legal uncertainty. As was demonstrated in the previous sections, perceived localisation by the market is an important obstacle to data mobility. As the policy objective is to take these obstacles away, Options 1 and 2 would be disqualified.

Exemplifying this argument, in one of its responses to the public online consultation, a cloud service provider stated: "In the cloud computing business, the most common data localisation restrictions we see target financial, health, telecom and public sector data. However, these measures are less often found in black and white legislation, but rather in sectorial guidelines by national regulators or government agencies". As the respondent also stated, it is increasingly difficult for data storage and processing (cloud) service providers to be aware of all data localisation restrictions that are in place at a given time, because of the multitude of regulators and agencies and of their varying approaches to technology and data transfers.

The public consultation consulted stakeholders on the type of EU-level action they consider appropriate to address data localisation restrictions. 55.3% of respondents advocate legislative action . Cross-checking the multiple-choice answers to this question with the written contributions to the same question leads to the conclusion that most respondents see a combination of a legislative instrument and increasing the transparency of justified restrictions as the most appropriate option. As Option 2 foresees precisely this, it may be inferred that the majority of public consultation respondents would have chosen Option 2.The respondents' argument behind the call for a legislative instrument is that this provides clarity and legal certainty by establishing a general principle of the free movement of data.

The majority of stakeholders who responded favour Option 2 for this intervention area, because it concerns a legislative approach, combined with certain non-legislative elements such as cooperation and awareness raising.

This option would rely completely on existing legislative instruments for security. Therefore, there would be no conceivable additional impact on Member States.

Members of the cooperation group of single points of contacts would be expected to have regular but non-frequent meetings with the data protection authorities and cyber security authorities of Member States, but because this will constitute a maximum number of two meetings annually, no extra burden in terms of HR or finance is to be expected.

There would be no administrative burden for Member States in the intervention area of security under this option. It envisages the development of common standards, but this could also be done by industry.

This option would rely on self-regulation, to be monitored by the European Commission. Therefore, there would be no conceivable additional impact on Member States.

Under Option 2, market participants would be required to give insights in the processes, technical requirements, timeframes and charges that apply in the situation of switching providers. So, although Option 2 would institute a legal principle on porting for switching provider, any burdens would be placed on the private sector, not the public authorities of Member States.

As Option 2 would place any actions on this intervention area under the cooperation framework of single points of contact mentioned in section 6.4.2.1, the financial burden for this intervention area will be shared with the free flow of data area and will not generate extra costs.

Although this option would slightly increase the coordination costs for the Member States' administrations as compared to the previous two options, this cost would be fixed and the effort to establish the system would be a one-off. On the other hand, the benefits of common approaches and guidelines, as well as increased cooperation on data availability in electronic format are going to be increasingly large as the volume of cross-border data availability requests increases.

Option 2 would also put in place the notification/review procedures to verify the compatibility with the EU law of Member States' planned and existing derogatory measures as well as the transparency mechanism and could, therefore, result in administrative burden on Member States' public authorities. However, all options would include notification and review process, including the baseline option. Therefore, there are no further added costs in this respect in the higher intervention range options. As demonstrated in the section describing drivers of the problem above, the number of measures to be notified and reviewed is not expected to be very high. Assuming that a Member State would have to provide between 1 and 5 notifications per year and that an average administrative cost is around €385 per notification, the annual administrative burden per Member State would range between approximately €385 and €1925.

The expert group would meet regularly. Accumulating the tasks mentioned above, it can be estimated that 0.5 FTE would be sufficient to fulfil these duties, because the expert group would not meet frequently. Moreover, any implementing acts could be taken by making use of the comitology procedure of an existing Committee. According to the 'institutional cost estimation' tool used for the European Electronic Communications Code, this would result in an annual cost of EUR 33.384 for Member States.

As indicated in the description of Option 2 in section 5.4, these single points of contact would be tasked with cooperation regarding free flow of data categories (in particular in the context of the expert group) and organising awareness raising campaigns around the free flow of data principle.

Option 2 would lead to moderate administrative burden for Member States' public authorities, caused by the allocation of Member States' human resources necessary for structured cooperation between Member States and the Commission by means of a 'single points of contact' expert group in the Member States. The single points of contact would be represented by civil servants who are already employed by Member States' public services, but whose responsibilities would be expanded or further coordinated.

Sub-option 2a would not provide for any additional actions on cyber security. However, the issue will be addressed by of other/existing EU instruments, such as the NIS Directive. As for potential environmental/social impacts of cyber security it is not important at all which instrument is used, Sub-option 2a would not lead to impacts different from Option 2.

Option 2 foresees in the development of a specific cloud service providers' certification scheme. This would mean a considerable improvement in terms of cyber security, compared with Option 1. Therefore, potentially negative environmental and social impacts of cyber-attacks, as described in 6.2.2.4 would diminish under Option 2.

Sub-option 2a does not include a legal principle of data portability. For that reason, it might lead to less directly positive environmental and social effects in terms of the decrease of processing power used for migrating data from one server (of a service provider) to another server. However, this difference in impact would be negligible as Sub-option 2a would provide for self-regulation through the development of codes of conduct, which will also lead to improved interoperability of systems.

As for the social impacts of this option, the assessment is the same as for the preceding options.

The introduction of a legal principle of data portability to facilitate cloud switching, especially when accompanied by guidance and recommendations on the levels of interoperability needed, would force companies to improve the interoperability of their systems. With a minimum level of interoperability ensured, migration processes would need less processing power and thus have less of an environmental imprint.

Policy action on improving data availability to Member State authorities for regulatory control purposes would increase cross-border data mobility because of raised levels of trust both with market participants and with Member States authorities. Therefore, there would be significant positive environmental impacts flowing from this intervention area under Option 2.

In social terms, Option 2 would reduce the number and range of limitations constraining (i) business choices regarding the location of data storage or processing infrastructures and (ii) the opportunities for data service providers to serve customers in other Member States. It would, therefore, have a positive impact on the freedom to conduct a business provided for by Article 16 of the European Charter of Fundamental Rights.

In indirect terms, however, Option 2 would have a positive impact on employment because of the added growth and innovation potential, caused by the lower costs for (i) setting up a business in the EU, (ii) entering a new market, (iii) launching a new product or service to the market and (iv) the ability to serve public and private customers, as indicated in section 6.4.1.

More generally, as illustrated in the high growth scenario by the European Data Market Study, by 2020 the overall number of data jobs is estimated to amount to 10.4 million, subject to a set of very favourable framework conditions triggering a faster take-up of data services and technologies. Apart from other factors such as the adoption and diffusion of all digital technologies, as well as the awareness and willingness to deploy them, the removal of regulatory barriers such as restrictions to the free flow of data, is critical to a favourable framework. Therefore, Option 2 would have a positive impact on the overall creation of data jobs by 2020.

In direct terms, Option 2 would have a positive impact on social issues in terms of employment. An interview with a large European cloud service provider on the specific conditions for investment in data centre locations led to the conclusion that a moderate number of new jobs might well be created thanks to relocation of data centres to Member States with better conditions in terms of climate, energy prices or land prices. In line with EU-regional policy objectives to diversify economic activities in rural areas, this is likely to more evenly spread data centre jobs over geographical locations in the European Union. At the same time, this would not lead to loss of jobs in the locations were data centres are located before relocation, because they can be operated remotely, so current personnel would not have to be necessarily relocated. Data centres can easily service clients over larger distances, for instance 2000 kilometres between a data centre and its clients is feasible. This allows for an optimal distribution of resources of cloud service providers over the EU because of the more transparent, predictable and open regulatory environment for data storage and processing activities.

Option 2 would have a positive impact on the environment, since data service providers and organisations using in-house data storage or processing IT systems would receive concrete benefits. Firstly, they would be free to deploy data storage or processing infrastructures in those locations which are characterised by low average temperatures and/or abundance of renewable sources of energy, thereby achieving small environmental footprints of their activities. Secondly they would be able to adopt innovative approaches to the use of energy in data centres, e.g. maximising the use of renewables by shifting the data processing load to a data centre where renewable energy is available at a particular moment.

The actual security levels of data storage and processing in the EU would be maintained or even improved compared to Option 2, because the same EU actions on security of data storage and processing would still be provided for under Sub-option 2a, only on a different legal basis, making use of other cyber security initiatives and the NIS Directive.

The economic impact of security elements of the sub-option would be more positive than under Option 2, as it would lead to a higher degree of legal certainty in the market. This positive effect is attained by explicitly avoiding any overlap with existing requirements, while at the same time providing reassurance to businesses about the continued applicability, also across borders in the EU and under outsourcing arrangements, of the security provisions under which they already operate.

Instead of catering the possibility for a new cooperation mechanism on security standards or certification schemes, Sub-option 2a would enhance legal certainty on the already applicable security requirements. It would recall that any existing security requirements for companies will continue to apply to them, regardless the location in the EU where their data is stored or processed and also when this is subject to outsourcing to a cloud service provider.

The importance of certification and standards has been quantified by Deloitte calculating that cloud users are expected to experience an additional NPV creation of 0.64% (which corresponds to around EUR 3.5 billion) from the additional user uptake generated by these certifications and standards and the reassurance they provide that these cloud services can be considered safe and reliable.

At the same time a minimal level of common requirements would reduce uncertainty and lack of trust stemming from different levels of data security among the Member States which is currently contributing to alter the market structure and the client choice, as has been proven by stakeholders consulted and by the support studies.

The benefits from standards would be expected to outweigh the costs if an EU-wide certification and labelling scheme for the Cloud sector is established. This would enhance the efficiency of companies operating cross-border as industry could certify their products and services only once and against a scheme that is recognised in the whole of the EU. The existence of standards in areas such as security is likely to increase trust and hence attract more business end users of cloud services, thus fostering growth and competitiveness across the borders

There will be an impact on the providers of cloud services which will be involved in the making of the codes of conduct and standard-setting. This is likely to entail only moderate costs, as participation would be voluntary and possibly devoted to trade associations and bodies. The cloud services providers may be more extensively affected by the specification of EU standards, to the extent that they would implement new standards (one-off cost and lower running cost ensuring updates).

This option would facilitate the identification and development of reliable common standards and/or certification schemes for the security of storage and/or processing of data. Concretely, a specific cloud service providers' certification scheme could be developed through cooperation on standards by the Member States.

What is more, the sub-option would probably result in lower compliance costs for cloud service providers than under Option 2, because self-regulation would present the cloud service industry with the opportunity and responsibility to self-regulate while minimising compliance costs.

Option 2a would however still induce the largest amount of the positive economic effects assessed for Option 2 above, because it would provide for action by the industry to develop codes of conduct on switching and standards of information provision to users regarding the conditions under which data can be ported out of their IT environments. This would provide for better functioning of market forces to yield easier switching and porting data for customers.

Sub-option 2a would rely on self-regulation by industry through the development of codes of conduct for facilitating switching between providers. Accordingly, Sub-option 2a may lead to less directly positive economic result than Option 2, because of a more modest approach to mitigating market dynamics leading to 'self-imposed localisation'. This is because it is much more effective to raise awareness around a clear legal principle than around a decentralised effort of industry to develop codes of conduct that is foreseen under Option 2a.

At the same time, the level of information supplied by the evidence-gathering process (e.g. the dedicated support study 'Switching Cloud Providers') is of such a modest volume, that instituting a legal right to portability and an obligation to CSPs could yield negative externalities that are not yet assessed. In this respect, the Commission should be cautious about instituting such a right.

The increase of switching requirements is likely to lead to a regulatory burden and compliance costs on the service provider. Here it could be argued that since service providers will anyway have to give effect to the portability right under the GDPR, these negative effects will be limited. Since many of the cost factors are present but quantitatively unknown, this option aims to strike the balance in regulatory intervention.

At the same time, however, evidence suggests that legislative action in this intervention area should not be too detailed, as this could have counterproductive effects. Analysis of the written inputs to the public consultation indicates that some stakeholders are concerned about the introduction of a right to data portability for any kind of data held by a company. Likewise, they flag the risk of negative impacts on innovation.

Although it is currently impossible to obtain a macro-economic estimate of what this option would entail at European level in terms of costs' savings, it is possible to get some insights at the micro-level thanks to a study by Kolb, Lenhard and Wirtz who carried out and evaluated the migration process for a real-world application among seven cloud platforms. Their study shows that there are many costly and time-consuming issues to grapple with for cloud service providers when customers migrate from platform to platform. The effort put into this by cloud service providers differs considerably from vendor to vendor. Introducing a principle of data portability to enable switching would steer the efforts made by market players in the same direction, and force more cooperation and a more streamlined approach to portability solutions (both on a technical and contractual level).

Furthermore, as reported in one of the workshops with business stakeholders organised by the support study team, "Standards are used in the market in an ineffective and inconsistent manner, thus, hampering the export of data from one cloud service provider and their import to another cloud service provider". High level EU principles could encourage industry-wide initiatives.

Option 2 could indirectly foster, through making switching easier, the growth and the take-up rate of cloud services in Europe. A forecast of the growth in the uptake of public cloud has been made in the study on Switching Cloud Providers, using a Mandatory Regulation Scenario. A mandatory regulation will lead to a faster take-up of public cloud services. SMEs and start-ups are expected to be most positively impacted in this scenario. The demand for public cloud is forecast to grow by 20.5 % Compound Annual Growth Rate between 2018 and 2025, reaching €71.9 billion in 2025.

More transparency will remove legal uncertainty, especially regarding hidden costs which are not mentioned in the contract. However, transparency and voluntary agreements on some contractual arrangements fall short of addressing the cost problem. This has to do with the magnitude of the costs and its apportioning between the "sending" and "receiving" side. The more granular the analysis of the cost apportioning gets, the more difficult (and costly) it is to extricate the cost components, especially for data which are complex in format and not raw.

The economic impacts of this option stem from establishing the principle that cloud service providers should offer data portability to facilitate the switching of providers or porting of data back to users' own IT systems. Under this option, the role of industry will be flanked by enforceable legal principles. A possible result could be more direct compliance costs, however at the same time the option would tackle vendor lock-in issues more convincingly. As these have higher and more serious impacts on stakeholders and the economy in general, they will therefore offset any increased compliance costs through the creation of a more open and competitive market.

The only limited negative impact on the upstream sector from Option 2 would be linked to the costs associated with the set up and enforcement of the standard contractual clauses.

The impacts on the cloud service providers are likely to be more significant in the medium term. Under a provision and a cooperation mechanism on data availability foreseen by this option, they could compete widely across borders, which would improve the efficiency of the data service providers' sector and contribute to bring down the costs for its clients.

However, the fact that the obligations on private parties are clearly established and reinforced and a cooperation framework is established to promote the effective application of the principle of availability in cross-border data storage will reduce the level of uncertainty for those business users who would like to move to cheaper providers in another Member State. This has a short-term positive impact on the operational efficiency of the downstream sector (business end-users).

Option 2 foresees the establishment of the principle that the holder of data shall not deny access to data to a public authority for its regulatory control purposes. As for the previous two options discussed, the impacts on the business sector are likely to be indirect.

In 2015 there were around 23 million SMEs in the EU. The following example assumes that only 8% of them use private cloud computing services. Assuming theoretically that 50% of the SMEs can use a 'cheap' provider and the other 50% an 'expensive' one, then the potential savings from migration of half of them from the cheap to the extensive provider would be in the area of 23.9 million euro per month. That would amount to around 276 million euro per year. This is an estimation which has little scientific value, but can give an idea of the magnitude of lifting data restrictions that may hinder this migration in fact or in perception.

This can have an impact on the competitiveness of European SMEs. If we extend as an example, the price differential of 51.69 Euro cents and we assume that SMEs store 50 TB on average using private cloud services, this would entail a saving or around EUR 26,000 per SME.

The very nature of data localisation restrictions implies that the offer of data services is reduced, at least in the short term, leading, potentially, to higher prices of such services in the markets concerned. This has an impact of market structure as pent-up demand in "expensive" Member States is not met and providers in "cheaper" Member States do not manage to attract all the potential clients. Also, the choice will be more limited in smaller Member States. In several countries, only data centre services that offer the lowest added value are available (e.g., Infrastructure-as-a-Service (IaaS)), while more value-adding services like Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS) are not available there. This limits the options of some companies to less efficient data centre solutions. For example, the price of storage per gigabyte in case of a Hungarian cloud service provider is more than 25 times higher than the price per gigabyte per month in a larger PaaS service.

It is possible to extrapolate some of the economic impacts in more quantitative terms to give an idea of the potential benefits from the free flow of data principle.

Taking away data localisation restrictions and enshrining a legal principle on the free flow of data in European law would reduce the cost of setting up a business in the EU through the provision of cheaper and more competitive cloud services at a one-time cost for applicability in the whole EU. The cost of setting up a business in the EU is currently at EUR 300 and 3 days per Member State. In line with the Commission's Start-up and Scale-up initiative's findings, bringing this cost down would increase EU innovation and competitiveness, strengthening the economy.

Also, the consultation showed the high impact (more than 70% of respondents) for the effects of data localisation restrictions on launching a new product or service or entering a new market.

These results are corroborated by the results of the public consultation, which show how stakeholders are aware of these potential savings that could accrue in case of clear limits to data restrictions.

The same report acknowledges that the impact of these price adjustments would not lead to a large-scale outsourcing of data hosting and processing services to other EU Member States. Imports of communication services by German customers from other EU Member States would increase within a range of 2-8% above the current levels. The ranges are similar or slightly higher for France. In all other cases, the import increase on communication services are limited to between zero and 3% according to ECIPE.

ECIPE estimated an overall EU-wide weighted impact on GDP is up to EUR 8 billion yearly, representing 0.06% of the current EU GDP. The true cost of today's restrictions is however likely to be underestimated given that this scenario does not take into account the regulations that are implicitly or indirectly localising.

In terms of different sectors of activity, the same study calculated that the largest benefits in relative terms would accrue to the manufacturing sector (+2.23%), followed by distribution retail and hotels (+2.12%).

The study conducted by Deloitte for the European Commission shows how important the removal of data localisation restrictions is for downstream business users. Although there is an overall net benefit, the removal could be detrimental to providers using data location as a specific competitive advantage. Deloitte compares a baseline scenario of no intervention with one where data localisation restrictions are removed. The results are illustrated by below, showing that EUR 11.6 billion can be leveraged in terms of net present value (NPV) of revenues for cloud users, providers and society as whole by the removal of data localisation restrictions. Being based on cloud services only, this is just a conservative proxy of what could happen in the entire data universe.

The study asserts that data localisation restrictions could lead to the provision of more cloud data centres than cloud service providers would ideally like to deploy if they wish to provide services in Member States with more onerous cross-border data transfer compliance obligations. With each cloud data centre costing €276.9 million on average in EU Member States, overprovision of centres is costly.

The support study by Spark, Time.Lex and Tech4i2 has provided some evidence on stark difference across costs in setting up and operating data centres in Europe, but relativizes the link between these costs and the existence of restrictions. The study finds that data localisation has an impact predominantly on the data centres that cloud providers build in addition to their first facilities: "It is possible to assert that having built a first round of data centres primarily in locations to meet user needs, later choices for additional data centres (being built now or in the future) might be driven more by concerns of cloud service providers about cross-border data regulations - thus they might be located in sub-optimal locations".

The most notable economic effects of this Option will be achieved through creating legal certainty and raising trust levels regarding data storage and processing. This should create an optimal investment climate, directed at the EU's future. The data economy is developing rapidly at the moment. Therefore, the proposal underlying this IA deviates from the classical situation in the sense that it is not only directed at present problems but also at preventing future ones and creating the right environment for the EU to fully grasp the benefits of the data economy.

However, there are also challenges in calculating the exact macroeconomic impact generated from removing data localisation restrictions in quantitative terms. The link between the different levels of regulation proposed to address the problems identified in section 2 and aggregate economic elements such as GDP, employment level or competitiveness of the sector does not allow quantifying in a high level of granularity.

It is, to a certain degree, possible to estimate the macro-economic impacts following the general adoption of data-driven innovation and data technologies in the EU, as in the analysis carried out by the support study for this Impact Assessment. This study concludes that a free flow of data legislative proposal taking away data localisation would be the most important factor in driving the European data economy towards the high growth scenario of 4% GDP by 2020.

Hence, this option would ensure the effective removal of existing unjustified localisation restrictions, and the avoidance of future ones. As more than two-thirds of the sample of 45 analysed data localisation restrictions is unjustified, this would mean the removal of most existing data localisation restrictions. The remaining restrictions are not likely to affect businesses, e.g. in the form of restrictions on accounting data, because such restrictions would not likely be justified on grounds of public security. Additionally, the at least equally important problem of market dynamics originating from a lack of knowledge by operators of the correct legal situation concerning data localisation restrictions or on implicit localisation restrictions would be addressed by the awareness raising action foreseen, effectively mitigating legal uncertainty and lack of trust. The remainder of this section will assess the economic impacts of the removal of data localisation restrictions.

Option 2 includes the establishment of a legal principle of free flow of data within the EU (as described in section 5 and in the context described in section 2). It requires Member States to notify any new data localisation restrictions they deem justified and intend to put in place by means of notification schemes of existing EU legal instruments. During a transitional period, Member States would be obliged to carry out a review of existing data localisation restrictions. Additionally, the policy option proposes awareness raising campaigns around the free flow of data principle.

6.4Option 2: Principles-based legislative initiative and cooperation framework to ensure trustworthy free flow of data across borders and facilitate switching and porting data between providers and IT systems

However, as a free flow of data principle would be still absent, cyber security service providers would still have to be engaged in costly processes of compliance research. This would still result in a lack of legal certainty.

With reference to section 6.2.4.4., we may conclude that specialised stakeholders argued that security of data processing would benefit from increased data mobility. During the evidence gathering process, this insight was frequently confirmed by other stakeholders, with no opposite views voiced. Therefore, stakeholders' judgment would be that Option 1 is suboptimal but slightly better, as it would imply a strengthened enforcement of existing legal instruments to counter unjustified data localisation restrictions.

Among the Member States who contributed position papers to the public consultation, the UK held that the EC should be careful not to promote portability through over-prescriptive common standards, or to create unnecessary cost/burden on businesses. The Danish government supports the development of standards which aims to promote interoperability and portability. They also view interoperability as an essential prerequisite for a competitive well-functioning digital economy.

There is broad agreement among stakeholders that the identified issues with data portability and switching need to be addressed. Stakeholders have generally been positive towards the different soft law measures suggested, both in the public consultation and in workshops. Especially popular measures are standards development and guidelines. However, many stakeholders have underlined the need to avoid interfering too much with contractual freedom.

Compared with Option 0, Option 1 does not comprise any significant change in the approach on the intervention area of data availability. It is unlikely that Member State discussions / exchanges of best practices would lead to tangible results in terms of trust either on the part of public authorities or the part of market players. Therefore, Option 1 would not enhance the data availability concerns that were frequently mentioned by stakeholders in their responses to the public online consultation.

Finally, as evidenced by multiple press reactions to the Digital Single Market Mid-Term Reviewan initiative under Option 1 could be seen as a negative appreciation of the Commission's promised actions under the Digital Single Market strategy. This is contention is reinforced by the letter of 16 heads of governments of EU Member States to President Tusk on 13 December 2016: "we note with concern the risk of serious delay with the presentation of a legislative proposal in relation to data localisation under the European 'free flow of data' initiative. The DSM strategy set very clear expectations for presentation in 2016 on an initiative…"

Option 1 would not take away this legal uncertainty, as it proposes to retain the current patchwork of EU-law applicable to data localisation. As no awareness raising campaign would be undertaken under this option, the uninformed market dynamics leading to data localisation and the 'perceived restrictions' mentioned above would retain intact. Accordingly, this approach does not tackle the sectorial administrative requirements that are still in place.

The majority of stakeholders, therefore, would be disappointed with an approach as under Option 1. The different group of stakeholders also provide more in-depth views on why they would prefer a legislative approach. Participants of the structured dialogues with the Member States, for instance, convincingly identified the issues of 'legal uncertainty' and 'lack of trust' as drivers of the problem of obstacles to data mobility. This view was confirmed by respondents to the public consultation, who identified the influence of market dynamics on data localisation, even without the presence of data localisation restrictions from the part of public authorities. One respondent to the public consultation referred to such 'perceived restrictions' in a written answer to an open question: "More concerning than formal obligations are informal/perceived ones. For example, our experience is that many entities in regulated industries want data to be stored in one country. Even without a formal requirement, it is clear from these conversations that entities believe that regulators strongly disfavour or in practice prohibit storing data outside of their home country. More generally even with formal requirements, there is uncertainty as to their application and coverage which complicates market assessment".

The same message appears from the public online consultation, in which 55.3% of respondents argue for a legislative approach.

However, as introduced above, stakeholders from both the public and private sectors have called for a new legislative instrument. On 13 December 2016, 16 heads of governments of EU Member States sent a letter to President Tusk to call for such a legislative approach. They state "In our view an early legislative proposal providing for the free flow of data is crucial to avoid market fragmentation and further obstacles to the development of the data economy in the EU".

In first instance, the strengthened enforcement of existing EU legislation vis-à-vis different categories of unjustified localisation restrictions, as foreseen under Option 1, would be welcomed if compared to the baseline option. For, a clear majority of stakeholders (61.9% of respondents to the public consultation) believes that data localisation restrictions should be removed. In this regard, strengthened enforcement is expected to have a moderate positive effect as compared to no EU policy change.

In general, stakeholders have indicated not to support Option 1. Instead, as argued further below in this section, a majority of different categories of stakeholders has called for a legislative approach to confront the problem.

The expected impacts of Option 1 on Member States' public authorities are the same as those of Option 0 for the intervention area security of data processing.

As Option 1 encourages self/co-regulation by the market to establish common conditions for switching cloud service providers, it would pose no direct administrative burden to Member States.

Option 1 would have similar implications for burdens on public authorities to those described in 6.3.3.1.

Moreover, this option does not provide an avenue for problem resolution regarding data localisation not covered by the existing mechanisms. As such, it is not future-proof and it does not allow for tailoring/further deliberations or implementing rules on issues relating to the free flow of data.

A strengthened enforcement of existing EU legislation, combined with enhanced transparency on existing data localisation provisions, could lead to administrative burden for Member States, particularly in terms of human resources. As Option 1 is not legislative, the impact would depend greatly on the modalities of its implementation in particular Member States (from low-scale implementation to full-scale implementation) and the degree to which existing mechanisms set up under the acquis would be relied on. Any quantitative estimation would also depend on the number of existing data localisation restrictions in a particular Member State. Under this option, therefore, administrative burden is expected to vary greatly by Member State.

Guidelines on security of data processing and storage would mean an improvement in terms of cyber security compared with the baseline option. Therefore, potentially negative environmental and social impacts of cyber-attacks, as described in 6.2.2.4 would diminish under Option 1.

The impacts would be similar to those under the baseline option. However, with a stronger push from the Commission for market players to cooperate on interoperability, and especially open APIs, a further increase in the efficiency of data migration may be seen.

As the option would mostly include discussions / exchange of practices under a non-legislative approach to improve data availability for regulatory control by Member State authorities envisaged by this option, there would be only limited positive environmental impacts in this intervention area.

Its social impact is likely to be negligible due to (i) the option's non-binding nature and (ii) the absence of a strong link between setting up data storage and processing infrastructures and employment in general.

As explained in section 6.2.2.1, a free flow of data is beneficial for the environment through increased liberty for cloud service providers to locate their data centres in more environmentally optimal locations. Option 1 would slightly reduce the need to deploy infrastructure in environmentally sub-optimal locations and could have a (limited) positive impact on the environment.

Because of enhanced levels of trust, this option would have a positive indirect impact on the business sector, including both upstream (cloud service providers) and downstream markets (business end-users of cloud services). The magnitude of the impact will depend on the uptake and effective implementation of guidelines by Member States. However, it is likely that this impact will be modest because of the voluntary nature of the guidelines, which will configure against a background of a myriad of different voluntary certification schemes. Therefore, Option 1 will not lead to a high degree of clarity.

This option would result in guidelines concerning security of data storage and processing, but would not be binding for the Member States. Nevertheless, clarity would be shed on the security provisions on data storage, and contribute to alleviate the lack of trust and the uncertainty.

Costs in data transmission are already high and sometimes prohibitive. Transparency on this type of cost could be helped under this option, e.g. by explicitly stating the cost of bandwidth for data outbound and data inbound in contractual agreements in guidelines or self/co-regulation. This can help cloud customers plan their costs related to migration. This could be beneficial for SMEs that have lower bargaining power against cloud service providers, and it could incentivise switching by removing uncertainty.

This option would require service providers to explain in a sufficiently detailed and accessible manner the processes, timeframes and charges that apply to switching. The economic impacts of this option therefore include an increase in variable costs for the service providers.

The development of the EU cloud market is forecast to be somewhat stronger under the Option 1 than under the baseline option, putting the growth in demand for public cloud at 19.7 % Compound Annual Growth Rate between 2018-2025 (6 percentage points higher than in the baseline scenario), amounting to a €68.8 billion market by 2025. This is due e.g. to growing awareness and involvement from industry and increased momentum to build trust and confidence in cloud and reduce the fear of vendor lock-in. Exit strategies by design might be implemented by cloud service providers.

The impacts on the upstream market structure (cloud service providers) would be similar to those envisaged in the baseline scenario.

In addition, option 1 is likely to have only limited impacts on the downstream sector. Many negative impacts identified for the baseline scenario are likely to persist. A persisting lack of trust could alter costs and choice of market operators and have an indirect effect on their operational efficiency. Market fragmentation would also persist, hampering innovation and competitiveness of the companies in the market as business end-users of data services would in some case be obliged to stay in less competitive markets with higher prices.

The introduction of guidelines on data availability for regulatory control by Member State authorities would reduce the negative economic impacts and costs deriving from the administrative burdens present in the baseline scenario. Member States will find it useful to have a framework for discussion and a forum where best practices can be discussed and eventually adopted. This could result in a degree of procedural convergence and reduce the human resources cost, thereby increasing cost efficiency for public administrations. This remains, however, a simple discussion forum which is not likely to lead to specific improvements or results.

Putting in place guidelines and transparency measures is not expected to affect the competitiveness of cloud service providers or organisations using in-house data storage or processing IT systems.

This option could have a marginally positive impact on costs associated with the analysis of the regulatory environment, at least for SMEs and could also have a marginally positive impact on the choice and cost of data services for the organisations using them. This would for instance be the case if an organisation that had erroneously assumed it has to store and/or process data in a particular Member State (i) found out, thanks to transparency measures, that there was no such localisation restriction and (ii) contracted a cheaper (foreign) data service.

Finally, even if proceedings were to be launched, the fact that many data localisation restrictions are context-specific means that several court judgements would be required in order to cover all aspects of such restrictions and establish a cross-cutting set of principles. Since, as explained in section 6.2.1.1 above, infringement proceedings take on average 4-5 years until they result in a court ruling, this would indeed lead to a long period of legal uncertainty. As a result, users would continue to demand local data storage and/or processing from the service providers, and the prospects of the fast-developing data economy would continue to be harmed.

In view of these difficulties, it is not surprising that no infringement proceedings against data localisation restrictions imposed by Member States have been launched yet.

Considering the potential cases targeting different categories of data localisation restrictions against the criteria mentioned above, very few cases would satisfy the threshold of addressing "the most important breaches of EU law" while being, at the same time, easy to pursue. For instance, cases targeting restrictions in the financial sector could be said to have sufficient economic significance, however the sector is excluded from the scope of the E-Commerce Directive and the Services Directive. Moreover, the restrictions typically stem from administrative requirements and practices rather than easily identifiable Member States' laws. Cases targeting restrictions in the health sector or those concerning public data could also be regarded as economically important, but the type of data at hand would make such cases difficult to pursue.

Also it appears from the structured dialogues with Member States and the Commission's own assessment that it would be more difficult to pursue infringement proceedings against localisation restrictions concerning public data or sensitive private data, such as health data.

In this regard the structured dialogues with Member States point to significant confusion as to how (if at all) the data localisation restrictions identified fall within the scope / could be addressed under the provisions of different existing EU legal instruments (Annex 5 presents a detailed overview). Moreover, many restrictions are hidden in outsourcing guidelines, circulars and similar administrative documents.

(ii) the infringing provisions of laws or practices of Member States are easy to identify (e.g. infringing laws are generally easy to identify).

(i) where a case is underpinned by provisions of EU law clearly targeting the infringement at hand (e.g. the Services Directive clearly precludes Member States from imposing an obligation on the provider to obtain an entry in a register or registration with a professional body or association in their territory); and

In this vein, the following categories of cases would be easier to pursue:

The Commission has recently announced that it would pursue infringements "in a strategic way to focus and prioritise its enforcement efforts on the most important breaches of EU law affecting the interests of its citizens and business." In particular, economic and systemic (cross-EU) significance of a particular case are among the factors to be taken into account.

In particular, as explained below, it would still be difficult to pursue infringement proceedings targeting data localisation restrictions.

Soft approaches could persuade some Member States to lift some data localisation restrictions. For instance, France revised Act number 2002-303 and the French Public Health Code which oblige hosting service providers to be approved by the Shared Healthcare Information Systems Agency within the Ministry of Health in order to be allowed to undertake hosting activity for patient data. From 2019 the strict prior authorisation requirement will be replaced by a certification requirement. In Germany, the initial draft "social network" law contained data localisation restrictions, but those were taken out as deliberations on the draft law progressed.

Also, it would largely preserve Member States' discretion to put in place new data localisation restrictions and maintain the existing ones.

Option 1 would foresee strengthened enforcement of existing legal instruments to minimise negative effects of data localisation. However, this would not solve the problem of legal uncertainty and still leave gaps for new localisation restrictions. One IT service provider specifically mentioned this in a written answer to the public consultation: "Only a legislative instrument can remove these barriers; ensure they are not re-instated and that new ones are not introduced; and provide sufficient certainty to providers and users in the longer term. While there are already some relevant legislative instruments in place (e.g., the Services Directive and the E-Commerce Directive), none of these set forth a comprehensive prohibition on the maintenance of unjustified obstacles to the free flow of data. Guidance, or mere identification of the data localisation measures, while helpful, will not be as effective."

The economic impacts of this option would not vary much compared to the baseline scenario, as the intervention in this case would be based on a non-legislative and little binding policy action. It does not guarantee any change in data localisation by business actors driven by market dynamics through legal uncertainty and does not promote consistency of treatment across the single market.

Considering that stakeholders' views were not conflicting on this issue, their judgment suggests that Option 0 is suboptimal, as it would not include any policy action to ensure enhanced data mobility in Europe.

Stakeholders have expressed considerable concerns about the security of data processing. The main argument made by stakeholders is that security of data processing would benefit from a free flow of data legal principle. There were zero stakeholders arguing the opposite. The reason behind this is that hosted cyber security services are typically provided remotely, from operation centres located in strategic places around the globe to be able to benefit from 24/7 security incidents reporting. In the case incidents are detected, these services will typically upload security updates at once on IT-systems of many users worldwide.

56.8% of SME respondents who intended to switch providers indicated in the public consultation that there are important barriers to data portability. This is echoed also by participants from the 18 May 2017 workshop on cloud switching, which included representatives of the cloud industry and their business customers. It is evident from the stakeholder engagement that there is an expectation for the EU to act to improve data portability in order to facilitate switching of cloud services providers. Option 0 would not meet this expectation.

As Option 0 neither includes clear EU-level guidance on the abatement of data localisation restrictions, nor provides guidelines or tools for Member States authorities to ensure availability of data processed in another Member State, there is no reason to conclude that these (frequently defined by sector) localisation restrictions would be mitigated by Option 0.

Concerning the intervention area of data availability, stakeholders hold that national competent authorities uphold data localisation restrictions for the objective (in itself legitimate) of keeping data available for supervision or control purposes. In the public consultation, 77.4% of respondents indicated that localisation demands were rooted in compliance concerns vis-à-vis local legal or administrative requirements.

As Option 0 would rely on Member States to progressively replace data localisation restrictions with less intrusive measures, this option would not address either of these two concerns raised by stakeholders. It does not propose actions to remove existing and perceived data localisation restrictions, and it would also be unable to avoid the emergence of new data localisation restrictions, following the trend witnessed in the European Data Economy communication of the European Commission.

The majority of stakeholders voiced its support for a legislative principle on the free flow of data. They did so by means of the online public consultation, during the structured dialogues organised by the Commission or by submitting position papers for scrutiny. 61.9% of respondents to the public consultation indicated that data localisation restrictions should be removed and, as mentioned in section 5.6, 55.3% argued for a legislative approach in doing so. Moreover, stakeholders have indicated their concern about data localisation restrictions that are currently in place or that are perceived by the market.

The baseline scenario does not lead to direct burdens for Member States' public authorities, as it relies on existing instruments like the NIS Directive. It is likely that such existing instruments will not establish specific security benchmarks for cloud services, as their necessary purpose is to create a generic framework. However, if such common security criteria would not be instituted this could in the future lead to burden for Member States authorities as a result of the collective risk this poses to their societies.

However, relying completely on market participant to introduce such conditions could constitute a lack of guidance and therefore cause disproportionately dominant market positions for large tech companies. This could lead to indirect administrative burdens in the form of an increased number of cases referred to Member States' competition authorities.

As the baseline option relies on market players to progressively introduce technical and contractual conditions facilitating switching data of cloud service providers, it is not expected to incur direct administrative burden on national public authorities under the baseline option.

There are several inter-state cooperation mechanisms in existence, allowing Member States to exchange information in relation to specific administrative/judicial procedures, and specific data types, subject to various conditions. For scenarios not covered by these instruments, Member States can engage in bilateral or multilateral interaction, with potentially diverging procedures to follow in different exchanges, and multiplied administrative efforts. As outlined above with regard to the economic impacts, without establishing and strengthening obligations on private actors to make the data available and promoting Member States' cooperation, a projected rise in cross-border data services and requests for access to data would exacerbate such administrative burden.

The baseline option would not produce specific impacts on Member States' public authorities in the intervention area of free flow of data across borders (in particular, potential infringement proceedings relating to data localisation restrictions could be dealt with in the context of existing administrative arrangements).

As the baseline option does not foresee the development of cloud-specific security guidelines, it may be argued that of all policy options, this option constitutes the highest environmental and social risks.

Cyber threats pose significant environmental and social risks. As more and more data of critical infrastructure or industry working with dangerous substances are moved to the cloud, state-of-the-art security of data processing and storage facilities is of utmost importance to keep environmental and social dangers to a minimum. In this respect, security breaches could lead to accidents in manufacturing processes and/or the release of dangerous or polluting substances. The policy options presented in this area do not cause direct environmental or social impacts. Nevertheless, it can be argued that because it is most likely that this option will not lead to a higher level of security (through better coordination between Member States' authorities and the establishment of common standards), it will not have the potential positive social and environmental impacts that the other policy options constitute..

Apart from the issues of continued market distortion, and leaving SMEs and start-ups in a weaker position, there are no social impacts of this option, although certain negative regional policy effects of localisation can be quite important on a local level, such as the lack of scaled investments because of fragmented service provision.

The baseline option would leave it to the market to implement energy efficient solutions. If the lack of interoperability between cloud services is allowed to persist, this would make it necessary for companies wanting to switch providers to spend more resources and processing power to migrate their data, which could have a negative environmental impact.

Therefore, the reader is referred to section 6.2.2.1 as it applies similarly for the intervention area of availability.

As explained in section 6.2.2.1 above, a free flow of data is beneficial for the environment through increased liberty for service providers to locate their data centres in more environmentally optimal locations. Policy action on improving data availability to Member State authorities for regulatory control purposes would increase cross-border data mobility because of raised levels of trust, both by market participants and by Member States authorities.

As there would be no significant action to improve data availability for regulatory control by Member State authorities envisaged by this option, no change in cross-border data mobility can be expected and consequently, no positive environmental impacts. Through inaction, it would mean a missed chance in terms of improving the environmental footprint of data centres.

Another possible negative social impact could incur on the freedom to conduct a business provided for by Article 16 of the European Charter of Fundamental Rights, since it would result in (a growing number of) limitations constraining (i) business choices regarding the location of data storage or processing infrastructures and (ii) the opportunities for cloud service providers to serve customers in other Member States.

In addition it must be noted that the data skills gap is expected to increase to more than 16% over the next four years totalling a number of unfilled positions of almost 770,000. In particular some of the largest and most advanced EU economies will face a considerable skills gap whereas smaller and less developed economies will witness an oversupply of data workers. Therefore, it can be presumed that non-effective policy measures not sufficiently addressing either, existing or potentially emerging limitations to the free flow of data would promote directly or indirectly a concentration of data skills demand. This will consequentially also affect negatively the data skills gap.

In terms of social impacts, the baseline option would lead to an increase in employment in Member States that have introduced or will introduce data localisation restrictions, because of supervision or operating needs of new infrastructure. The positive impact of such jobs is likely to be limited, since cloud service providers deploy only the limited capabilities needed to serve customers in those Member States.

Proliferation of data localisation restrictions could also hamper the development of innovative approaches energy optimisation or efficiency in data centres, e.g. maximising the use of renewable energy by shifting the loads of data processing to a data centre where renewable energy is available at a particular moment.

Because the baseline option would allow for the persistence of data localisation restrictions by Member States and through market dynamics, it would therefore have a negative impact on the environment.

It is true that many factors play a role in the decision on where to situate a data centre (such as proximity to clients and access to a pool of human resources who have the skills to operate the data centre). Still, it is important to highlight that data localisation restrictions may have an impact on the location choice, skewing it towards less environmentally optimal locations.

In general, a free flow of data has positive environmental impacts, because it will allow cloud service providers to locate their data centres in locations where there are substantive energy efficiency gains to operate such infrastructures. These locations are typically locations in lower temperature zones, as they allow energy savings on cooling servers. Cooling may account for up to half of a data centre's power expenditures, so this issue of large importance for the sector and may therefore have sizable impacts in terms of environmental footprint.

The respondents to the public consultation have highlighted the importance of allowing free flow of data without restrictions for keeping data storage and processing secure. As one respondent noted: "We deliver two major updates a year and smaller updates on a weekly basis, with all of our customers always on the same version. Enabling cross-border data flows enables greater adoption of cloud computing, with these benefits that are lost with multiple instances or hybrid solutions. Having a single privacy and security model and having everyone on the same version makes it easier to protect data, add new functionality, and reduces complexity enhancing ease of use for customers". It seems unlikely that a no-action scenario will help to improve the security of the data processing.

Therefore, the presence of data localisation restrictions and the limited degree of collaboration in security matters in the baseline scenario looks unlikely to solve the problems discussed in the problem definition section.

Moreover, existing legislation and policy does not address security concerns of data storage/processing specifically, for instance by in