COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE AND THE COMMITTEE OF THE REGIONS Unleashing the Potential of Cloud Computing in Europe
Date: 2012-09-27
Institutions: European Commission
Subjects: Community certification, administrative reform, computer applications, electronic commerce, impact of information technology, information technology applications, information technology industry, technological change

EUROPEAN COMMISSION 

Brussels, 27.9.2012  
COM(2012) 529 final 

COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN 
PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL 
COMMITTEE AND THE COMMITTEE OF THE REGIONS 

Unleashing the Potential of Cloud Computing in Europe 

(Text with EEA relevance) 

{SWD(2012) 271 final} 

EN 

   EN 

 
 
  
 
COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN 
PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL 
COMMITTEE AND THE COMMITTEE OF THE REGIONS 

Unleashing the Potential of Cloud Computing in Europe 

(Text with EEA relevance) 

1. 

INTRODUCTION 

‘Cloud computing’ in simplified terms can be understood as the storing, processing and use of 
data  on  remotely  located  computers  accessed  over  the  internet.  This  means  that  users  can 
command almost unlimited computing power on demand, that they do not have to make major 
capital investments to fulfil their needs and that they can get to their data from anywhere with 
an internet connection. Cloud computing has the potential to slash users' IT expenditure and 
to enable many new services to be developed. Using the cloud, even the smallest firms can 
reach  out  to  ever  larger  markets  while  governments  can  make  their  services  more  attractive 
and efficient even while reining in spending. 

Where the World Wide Web makes  information available everywhere and to anyone, cloud 
computing makes computing power available everywhere and to anyone. Like the web, cloud 
computing  is  a  technological  development  that  has  been  ongoing  for  some  time  and  will 
continue to develop. Unlike the web, cloud computing is still at a comparatively early stage, 
giving Europe a chance to act to ensure being at the forefront of its further development and 
to  benefit  on  both  demand  and  supply  side  through  wide-spread  cloud  use  and  cloud 
provision.  

The  Commission  therefore  aims  at  enabling  and  facilitating  faster  adoption  of  cloud 
computing  throughout  all  sectors  of  the  economy  which  can  cut  ICT  costs,  and  when 
combined  with  new  digital  business  practices1, can boost productivity,  growth  and jobs. On 
the basis of an analysis of the overall policy, regulatory and technology landscapes and a wide 
consultation  of  stakeholders,  undertaken  to  identify  what  needs  to  be  done  to  achieve  that 
goal, this document sets out the most important and urgent additional actions. It delivers one 
of  the  main  actions  foreseen  in  the  Communication  on  e-Commerce  and  online  services;2  it 
represents a political commitment of the Commission and serves as a call on all stakeholders 
to participate in the implementation of these actions, which could mean an additional EUR 45 
billion  of  direct  spend  on  Cloud  Computing  in  the  EU  in  2020  as  well  as  an  overall 
cumulative impact on GDP of EUR 957 billion, and 3.8 million jobs, by 2020.3 

1 

2  

3 

Kretschmer,  T.  (2012),  “Information  and  Communication  Technologies  and  Productivity  Growth:  A 
the  Literature”,  OECD  Digital  Economy  Papers,  No.  195,  OECD  Publishing. 
Survey  of 
http://dx.doi.org/10.1787/5k9bh3jllgs7-en 
Communication, "A coherent framework for building trust in the Digital Single Market for e-Commerce 
and online services", COM (2011) 942 final. 
IDC  (2012)  "Quantitative  Estimates  of  the  Demand  for  Cloud  Computing  in  Europe  and  the  Likely 
Barriers  to  Take-up";  also  see  for  more  details  the  SWD  accompanying  this  Communication,  section 
3.1.  The  importance  of  cloud  computing  for  the  creation  of  jobs  is  also  recognised  in  "A  Set  of  Key 

EN 

2 

   EN 

                                                 
Several  of  the  identified  actions  are  designed  to  address  the  perception,  by  many  potential 
adopters of cloud computing, that the use of this technology may bring additional risks.4 The 
actions do so by aiming at more clarity and knowledge about the applicable legal framework, 
by  making  it  easier  to  signal  and  verify  compliance  with  the  legal  framework  (e.g.  through 
standards  and  certification)  and  by  developing  it  further  (e.g.  through  a  forthcoming 
legislative initiative on cyber security). 

Addressing  the  specific  challenges  of  cloud  computing  would  mean  a  faster  and  more 
harmonised  adoption  of  the  technology  by  Europe's  businesses,  organisations  and  public 
authorities,  resulting,  on  the  demand  side,  in  accelerated  productivity  growth  and  increased 
competitiveness across the whole economy as well as, on the supply-side, in a larger market 
in which Europe becomes a key global player. Here, the European ICT sector stands to benefit 
from  important  new  opportunities;  given  the  right  context,  Europe's  traditional  strengths  in 
telecommunications equipment, networks and services could be deployed very effectively for 
cloud  infrastructures.  Beyond  that,  European  application  developers  large  and  small  could 
benefit from rising demand. 

2. 

NATURE AND BENEFITS OF CLOUD COMPUTING 

Cloud computing has a range of defining features (which make a general definition elusive5), 
namely: 

• 

• 

• 

• 

• 

4  

5 

hardware  (computers,  storage  devices)  is  owned  by  the  cloud  computing  provider, 
not by the user who interacts with it via the internet;  

the use of hardware is dynamically optimised across a network of computers, so that 
the  exact  location  of  data  or  processes,  as  well  as  the  information  which  piece  of 
hardware  is  actually  serving  a  particular  user  at  a  given  moment,  does  not  in 
principle have to concern the user, even though it may have an important bearing on 
the applicable legal environment;  

cloud providers often move their users' workloads around (e.g. from one computer to 
another or from one data centre to another) to optimise the use of available hardware; 

the  remote  hardware  stores  and  processes  data  and  makes  it  available,  e.g.  through 
applications (so that a company could use its cloud-based computing in just the same 
way as consumers already today use their webmail accounts);  

organisations and individuals  can  access  their content, and use their software when 
and where they need it, e.g. on desktop computers, laptops, tablets and smartphones;  

Actions  for  ICT  Employment",  annex  to  the  Commission  Communication  "Towards  a  job-rich 
recovery", COM(2012) 173 final. 
For  example,  organisations  may  worry  about  business  continuity  in  the  case  of  service  disruption 
whereas  individuals  may  have  concerns  about  what  happens  with  their  personal  information.  Such 
worries slow down the overall speed of adoption of cloud computing. 
Many such definitions are highly abstract: One well-known definition speaks of "a model for enabling 
convenient,  on-demand  network  access  to  a  shared  pool  of  configurable  computing  resources  …  that 
can  be  rapidly  provisioned  and  released  with  minimal  effort  or  service  provider  interaction"  NIST 
(2009), US National Institute for Standards and Technology. 

EN 

3 

   EN 

                                                                                                                                                         
• 

• 

• 

a cloud set-up consists of layers: hardware, middleware or platform, and application 
software.  Standardisation  is  important  especially  at  the  middle  layer  because  it 
enables  developers  to  address  a  wide  range  of  potential  customers  and  gives  users 
choice; 

users normally pay by usage, avoiding the large upfront and fixed costs necessary to 
set up and operate sophisticated computing equipment;  

at the same time, users can very easily modify the amount of hardware they use (e.g. 
bring new storage capacity online in a matter of seconds with a few mouse clicks). 

Consumers  can  use  cloud  services  to  store  information  (e.g.  pictures  or  e-mail)  and  to  use 
software  (e.g.  social  networks,  streamed  video  and  music,  and  games).  Organisations, 
including public administrations, can use cloud services to successively replace internally run 
data centres and information and communication technology (ICT) departments. Companies 
can use cloud services to quickly test and scale up what they offer to their customers because 
they  can  do  so  without  investing  in  and  building  physical  infrastructures.  Overall,  cloud 
computing  represents  a  further  industrialisation  (standardisation,  scaling-up,  wide-spread 
availability)  of  the  provision  of  computing  power  ("utility  computing")  in  the  same  way  as 
power  plants  industrialised  the  provision  of  electrical  power.  Thanks  to  standardised 
interfaces (the equivalent to electrical power plugs) users can leave the details (how to build, 
power, run and secure a data centre) to experts who achieve much better economies of scale 
(by serving many users) than individual users ever could. Moreover, cloud services offer very 
large  economies  of  scale  meaning  that  go-it-alone  efforts  at  national  level  are  unlikely  to 
deliver optimal cost efficiencies. The benefits of adopting cloud computing can be illustrated 
by a 2011 survey for the Commission which shows that as a result of the adoption of cloud 
computing  80%  of  organisations  reduce  costs  by  10-20%.  Other  benefits  include  enhanced 
mobile  working  (46%),  productivity  (41%),  standardisation  (35%),  as  well  as  new  business 
opportunities  (33%)  and  markets  (32%).6  All  available  economic  studies  also  confirm  the 
importance of cloud computing which is expected to grow rapidly worldwide.7 

The unprecedented increase of data flow and processing of information over the Internet has a 
significant environmental impact through energy and water consumption, and greenhouse gas 
emissions. Cloud computing can help mitigate these problems thanks to more efficient use of 
hardware as well as, more specifically, by building data centres to use low-energy servers and 
green  energy.8  For  example,  according  to  some  estimates,  large  companies  in  the  US  could 
save $12.3 billion annually in energy consumption by adopting cloud computing.9  

Therefore,  substantial  efficiency  improvements  across  the  whole  economy  can  be  expected 
from cloud adoption by businesses and other organisations, especially SMEs. The cloud could 
be  especially  important  for  small  businesses  in  struggling  economies  or  remote  and  rural 
regions  to  tap  into  markets  in  more  buoyant  regions.  For  example  using  broadband 
infrastructures to overcome the "tyranny  of distance", the whole range from high tech start-
ups to small traders or artisans can leverage the cloud to tap into remote markets. This opens 

6 

7 

8 
9 

IDC  (2012)  "Quantitative  Estimates  of  the  Demand  for  Cloud  Computing  in  Europe  and  the  Likely 
Barriers to Take-up". 
E.g. one study foresees the cloud market to grow threefold by 2014. Another study sees 11 million jobs 
added to the economy by that time. See the SWD, section 4.1. 
See: Greenpeace (2012) How clean is your cloud? 
See: 
embargo.pdf  

http://www.broadbandcommission.org/net/broadband/Documents/bbcomm-climate-full-report-

EN 

4 

   EN 

                                                 
up  new  economic  development  opportunities  to  any  region  that  has  ideas,  talent  and  a  high 
speed broadband infrastructure. Also, the cloud could bring jobs to ICT-savvy workers rather 
than uprooting them in pursuit of work, thus bringing jobs and cash to less favoured regions. 
Many  apparently  local  products  and  services  could  get  global  reach,  increase  web  presence 
(and  discoverability  through  Internet  search  engines)  and  –  particularly  where  small  firms 
group  together  –  achieve  the  critical  mass  needed  to  negotiate  preferential  terms  with  key 
business  partners  (e.g.  delivery/transport,  tourism  operators  and  finance  companies).  Public 
authorities  also  stand  to  gain  substantially  from  cloud  adoption  both  in  terms  of  efficiency 
savings and in terms of services that are more flexible and tuned to the needs of citizens and 
business. The most immediate saving would be in terms of lower IT costs by reducing capital 
and operating expenditure and increasing hardware utilization rates which today can be as low 
as  10%  on  public  sector  infrastructures.10  Further  benefits  would  come  from  process  re-
engineering through lower cost and more frequent upgrade possibilities and the scope to share 
infrastructures between agencies.  

Beyond  pure  costs  savings,  cloud  computing  can  help  drive  the  transition  to  21st  century 
public  services  that  are  interoperable,  scalable  and  in  line  with  the  needs  of  a  mobile 
population and businesses that want to benefit from the European digital single market. The 
first  incremental  steps  would  be  improved  service  performance  such  as  improved  security, 
more user-friendly services, the ability to roll out new services cheaply, fast and flexibly, the 
relative  ease  of  using  cloud  computing  for  creating  social  engagement  platforms  or  for 
specific campaigns and the scope to monitor outcomes better. But looking forward ten years 
cloud could help realise the vision of "Every European Digital", able to enjoy full electronic 
public services rather than a paper bureaucracy. Cloud computing could help to drive public 
costs  down  and  push  public  benefits  up  and  give  a  broader  base  for  economic  activity 
involving the whole population. 

3. 

STEPS TO BE TAKEN 

The preparatory work undertaken by the Commission shows the key areas where actions are 
needed:  

• 
Fragmentation of the digital single market due to differing national legal frameworks 
and  uncertainties  over  applicable  law,  digital  content  and  data  location  ranked  highest 
amongst  the  concerns  of  potential  cloud  computing  adopters  and  providers.  This  is  in 
particular  related  to  the  complexities  of  managing  services  and  usage  patterns  that  span 
multiple  jurisdictions  and  in  relation  to  trust  and  security  in  fields  such  as  data  protection, 
contracts and consumer protection or criminal law.  

• 
Problems  with  contracts  were  related  to  worries  over  data  access  and  portability, 
change control and ownership of the data. For example there are concerns over how liability 
for  service  failures  such  as  downtime  or  loss  of  data  will  be  compensated,  user  rights  in 
relation to system upgrades decided unilaterally by the provider, ownership of data created in 
cloud applications or how disputes will be resolved.  

A  jungle  of  standards  generates  confusion  by,  on  one  hand,  a  proliferation  of 
• 
standards  and  on  the  other  hand  a  lack  of  certainty  as  to  which  standards  provide  adequate 
levels of interoperability of data formats to permit portability; the extent to which safeguards 

10 

HM Government (2011) Government Cloud Strategy, www.cabinetoffice.gov.uk  

EN 

5 

   EN 

                                                 
are in place for the protection of personal data; or the problem of the data breaches and the 
protection against cyberattacks. 

This  strategy  does  not  foresee  the  building  of  a  "European  Super-Cloud",  i.e.  a  dedicated 
hardware  infrastructure  to  provide  generic  cloud  computing  services  to  public  sector  users 
across Europe. However, one of the aims is to have publicly available cloud offerings ("public 
cloud"11)  that  meet  European  standards  not  only  in  regulatory  terms  but  in  terms  of  being 
competitive,  open  and  secure.  This  does  not  preclude  public  authorities  from  setting  up 
dedicated private clouds for the treatment of sensitive data, but in general even cloud services 
used by the public sector should – as far as feasible – be subject to competition on the market 
to ensure best value for money, while conforming to regulatory obligations or wider public-
policy  objectives  in  respect  of  key  operating  criteria  such  as  security  and  protection  of 
sensitive data. 

3.1. 

Cloud Computing and the Digital Agenda (Digital Single Market) 

Because of its inherent freedom from locational constraints, cloud computing could raise the 
digital  single  market  to  a  new  level.  But  this  will  only  be  the  case  if  we  achieve  effective 
implementation of single market rules. The gains are potentially huge. The preparatory study 
undertaken for the Commission estimates that the public cloud would generate €250 billion in 
GDP in 2020 with cloud-friendly policies in place against €88 billion in the "no intervention" 
scenario,  leading  to  extra  cumulative  impacts  from  2015  to  2020  of  €600  billion.  This 
translates into the creation of 2.5 million extra jobs.12 

Many of the necessary steps to make Europe cloud-friendly were already identified as actions 
of  the  Single  Market  Pillar  of  the  Digital  Agenda  for  Europe  and  the  Single  Market  Act13. 
Most of these actions are now on the table of the legislators and a quick move to adopt and 
implement  these  proposals  will  make  a  major  contribution  towards  realising  the  economic 
gains of cloud computing. 

Digital Agenda Actions "opening-up access to content" 

In  the  Digital  Agenda  for  Europe,  the  Commission  set  itself  the  objective  to  "simplify 
copyright clearance, management and cross-border licensing."14 The key actions identified in 
the  Digital  Agenda  to  reach  these  goals  are  on  track  and  will  enhance  Europe's  capacity  to 
exploit the exciting new opportunities of cloud computing for both producers and consumers 
of digital content. 

For  the  cloud  to  work  well  as  a  platform  for  digital  content  services,  including  mobile 
services, there is a need for content distribution models that enhance access to and use of all 
sorts  of  content  (music,  audiovisual  or  books)  across  different  devices  and  in  different 

11 

12 

13 
14 

By contrast, a private cloud is a service or infrastructure dedicated to a particular client that is not open 
for use by others. 
IDC  (2012)  "Quantitative  Estimates  of  the  Demand  for  Cloud  Computing  in  Europe  and  the  Likely 
Barriers to Take-up" estimates that in the “Policy-driven” scenario cloud-related workers could exceed 
3.8 million, against some 1.3 million in the “No Intervention” scenario, i.e. 2.5 million additional jobs 
could be brought about by the policy.  
Communication Single Market Act COM(2011) 206 final 
The constituent actions were to propose a Directive on Collective Rights Management COM(2012) 372 
final; a Directive on Orphan Works COM(2011) 289 final; and to review of the Directive on Re-Use of 
Public Sector Information, COM(2011) 877 final, all of which have been done. 

EN 

6 

   EN 

                                                 
territories. Cloud service providers and right holders may agree commercial terms for licences 
allowing customers to access their personal account from multiple devices, irrespective of the 
territory from which the account is accessed. Such flexible licensing agreements are already 
being  reached  in  the  market,  although  agreement  is  proving  more  difficult  in  some  cases. 
Providers  need  easy  ways  to  acquire  licences  for  such  services.  Consumers  should  be  able, 
lawfully, to consume content away from home across the EU without losing access to services 
they  paid  for  in  any  other  Member  State.  For  rights  holders  such  licensing  arrangements 
would promote service innovation and thus create new revenue streams. A rapid adoption of 
the Commission proposal for a Directive on Collective Rights Management will address many 
of  the  cross-border  licensing  needs  for  cloud  content  as  regards  music.  The  Commission  is 
also considering further actions as a follow-up to the Audiovisual Green Paper15, for example 
by  promoting  and  facilitating  the  licensing  of  audiovisual  works  for  online  distribution,  in 
particular across borders. A cloud computing service may also permit content storage in the 
cloud. The consumer can use the cloud as a digital locker for content and a synchronisation 
tool  to  access  content  from  different  devices.  Therefore  questions  arise  on  the  possible 
collection  of  private  copy  levies  for  any  private  copying  of  content  to,  from  or  within  the 
cloud.  

These questions, among others, are being examined in an on-going mediation process led by 
Mr. Antonio Vitorino.16 On the basis of the outcome of this process the Commission will inter 
alia assess whether there is a need to clarify the scope of the private copying exception and 
the applicability of levies, in particular the extent to which cloud computing services allowing 
for the direct remuneration of right holders are excluded from the private copy levy regime. 

Digital  Agenda  Actions 
Straightforward" 

to  "Make  Online  and  Cross-Border  Transactions 

The recent review of the e-commerce directive undertaken as an action in the Digital Agenda 
reaffirmed its role as an essential foundation of digital services growth in Europe through the 
exemption from liability of information society service providers when they host or transmit 
illegal information that has been provided by a third party. Many such online services are now 
migrating  onto  cloud  infrastructures  which  facilitates  the  offer  of  more  integrated  services. 
This gives rise to more complex value chains frequently spanning multiple jurisdictions which 
in turn raises questions related to the determination of the applicable law (e.g. establishment) 
and the application of the notification procedures concerning (alleged) illegal information and 
activities to these emerging services. These issues are being addressed in the follow-up to the 
Communication  on  the  Digital  Single  Market  for  e-commerce  and  online  services,  in  the 
Commission's initiative on notice and action procedures.17 

Secure  eAuthentication  methods  for  internet  transactions  are  also  essential  for  the 
development  of  the  digital  single  market.  The  more  complex  value  chains  and  the  nested 
nature of many services in cloud computing makes reliable authentication necessary both to 

15 

16 

17  

Green Paper on the online distribution of audiovisual works in the European Union: opportunities and 
challenges towards a digital single market, COM(2011) 427. 
See Commission Communication "A Single Market for Intellectual Property Rights" COM(2011) 287 – 
Action  8  –  which  launched  this  mediation  process  in  order  to  "explor[e]  possible  approaches  with  a 
view to harmonising the methodology used to impose levies [....]" and stated that a "concerted effort on 
all sides to resolve outstanding issues should lay the ground for comprehensive legislative action at EU 
level".  The  eCommerce  Communication,  COM(2011)  942  final,  envisages  a  legislative  initiative  on 
private copying in 2013. 
eCommerce Communication, COM(2011) 942 final, p. 15. 

EN 

7 

   EN 

                                                 
secure trust and to streamline the use of the services. For example single sign-on procedures 
makes the use of a set of services much smoother but require more sophisticated and reliable 
authentication  methods  than  simple  self-created  passwords  to  enhance  trust  in  the  set  of 
providers concerned. The adoption of common standards that permit safe but seamless use of 
services  requiring  reliable  authentication  and  authorisation  would  be  a  major  boon  to  cloud 
adoption.  The  provision  of  such  solutions  will  be  greatly  enhanced  by  the  adoption  of  the 
Commission's proposals on e-identification and authentication.18 

The Commission will in the coming months address general cyber security challenges in its 
Strategy  for  Cyber  Security.  The  strategy  will  address  all  information  society  providers 
including  cloud  computing  service  providers.  It  will  inter  alia  indicate appropriate technical 
and organisational measures that should be taken to manage security risks as well  reporting 
obligations to competent authorities of significant incidents.  

Digital Agenda Actions on Building Digital Confidence 

Data protection emerged from the consultation and the studies launched by the Commission 
as  a  key  area  of  concern  that  could  impede  the  adoption  of  cloud  computing.  In  particular, 
faced  with  27  partly  diverging  national  legislative  frameworks,  it  is  very  hard  to  provide  a 
cost-effective  cloud  solution  at  the  level  of  digital  single  market.  In  addition,  given  the 
cloud’s global scope, there was a call for clarity on how international data transfers would be 
regulated.  These  concerns  have  been  addressed,  in  completion  of  another  Digital  Agenda 
Action, by the proposal of a strong and uniform legal framework providing legal certainty on 
data  protection  by  the  Commission  on  25  January  2012.  The  proposed  regulation  addresses 
the issues raised by the cloud. Centrally, it clarifies the important question of applicable law, 
by ensuring that a single set of rules would apply directly and uniformly across all 27 Member 
States.  It  will  be  good  for  business  and  citizens  by  bringing  about  a  level  playing  field  and 
reduced administrative burden and compliance costs throughout Europe for businesses, while 
ensuring  a  high  level  of  protection  for  individuals  and  giving  them  more  control  over  their 
data.  Increased  transparency  of  data  processing  will  also  help  increase  consumer  trust.  The 
proposal  facilitates  transfers  of  personal  data  to  countries  outside  the  EU  and  EEA  while 
ensuring the continuity of protection of the concerned individuals. The new legal framework 
will provide for the necessary conditions for the adoption of codes of conduct and standards 
for  the  cloud,  where  stakeholders  see  a  need  for  certification  schemes  that  verify  that  the 
provider  has  implemented  the  appropriate  IT  security  standards  and  safeguards  for  data 
transfers. 

Given  that  data  protection  concerns  were  identified  as  one  of  the  most  serious  barriers  to 
cloud  computing  take-up,  it  is  all  the  more  important  that  Council  and  Parliament  work 
swiftly towards the adoption of the proposed regulation as soon as possible in 2013. 

Meanwhile,  as  cloud  computing  involves  chains  of  providers  and  other  actors  such  as 
infrastructure or communications providers, guidance is required on how to apply the existing 
EU  Data  Protection  Directive,  notably  to  identify  and  distinguish  the  data  protection  rights 
and obligations of data controllers and processors for cloud service providers, or actors in the 
cloud  computing  value  chain.  Moreover,  due  to  the  specific  nature  of  the  cloud,  questions 
have been raised about applicable law in case where the relevant place of establishment of a 
cloud  provider  may  be  hard  to  determine,  e.g.  for  a  non-EU  user  of  a  non-EU  provider 

18 

Proposal for a Regulation on electronic identification and trust services for electronic transactions in the 
internal market COM(2012)238/2.  

EN 

8 

   EN 

                                                 
operating  equipment  in  the  EU.  In  this  context,  the  Commission  welcomes  the  guidance  on 
how  to  apply  the  existing  EU  Data  Protection  Directive  given  in  the  Opinion  of  the  data 
protection working party, the so called "Article 29 Working Party" on cloud computing of 1 
July 2012.19 The Commission considers that the Article 29 Working Party Opinion provides a 
good  basis  for  the  transition  from  the  current  EU  Data  Protection  Directive  to  the  new  EU 
Data  Protection  Regulation  and  that  it  should  guide  the  work  of  national  authorities  and  of 
businesses, thereby offering maximum clarity and legal certainty on the basis of the existing 
legal framework. 

Moreover, once the proposed regulation is adopted, the Commission will make use of the new 
mechanisms  set  out  therein  to  provide,  in  close  cooperation  with  national  data  protection 
authorities, any necessary additional guidance on the application of European data protection 
law in respect of cloud services. 

Contract  law  was  also  an  area  of  concern  for  negatively  affecting  the  digital  confidence  of 
consumers who did not have certainty about their rights and lacked protection and traders who 
needed  a  framework  which  would  make  it  easier  for  them  to  offer  their  products  online.  In 
this  context,  the  Commission  has  already  proposed  a  Regulation  for  a  Common  European 
Sales Law.20 

3.2. 

Specific Key Actions on Cloud Computing 

Completing  the  Digital  Single  Market  by  moving  as  rapidly  as  possible  to  adoption  and 
implementation of the Digital Agenda proposals that are on the table is the essential first step 
towards  making  Europe  cloud-friendly.  But  to  move  up  a  notch  to  become  cloud-active,  a 
climate of certainty and trust must be further developed so as to stimulate the active adoption 
of cloud computing in Europe.  

There is a need for a chain of confidence-building steps to create trust in cloud solutions. This 
chain starts with the identification of an appropriate set of standards that can be certified in 
order  to  allow  public  and  private  procurers  to  be  confident  that  they  have  met  their 
compliance obligations and that they are getting an appropriate solution to meet their needs 
when  adopting  cloud  services.  These  standards  and  certificates  in  turn  can  be  referenced  in 
terms and conditions so  that providers and  users feel confident that the contract is fair. The 
preparatory  work  mentioned  above  indicates  the  need  for  specific  frameworks  for  Cloud 
Computing in relation to both standards and certification and contract terms and conditions.  

Public authorities have a role to play in forging a trusted cloud environment in Europe. They 
have an opportunity to use their procurement weight to promote the development and uptake 
of cloud computing in Europe based on open technologies and secure platforms. Establishing 
a clear and protective framework for public sector adoption will ensure that this technology 
provides  trusted  access  for  international  users  and  make  Europe  a  hot  spot  of  cloud  service 
innovation.  In  addition,  take-up  amongst  public  procurers  of  trusted  cloud  solutions  could 
encourage SMEs to adopt as well.  

19 

20 

See:  Article  29  Data  Protection  Working  Party,  WP196  –  Opinion  05/2012  on  Cloud  Computing, 
adopted  July  1st  2012,  http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-
recommendation/index_en.htm#h2-1.  
COM (2011) 635 final 

EN 

9 

   EN 

                                                 
There are also concerns that the economic impact of cloud computing will not reach its full 
potential  unless  the  technology  is  adopted  by  both  public  authorities  and  small  to  medium 
sized  enterprises  (SMEs).  In  both  cases  adoption  so  far  is  marginal  due  to  the  difficulty  of 
assessing the risks of cloud adoption. 

To deliver on these goals therefore the European Commission will launch three cloud-specific 
actions:  

(1) 

(2) 

(3) 

Key Action 1: Cutting through the Jungle of Standards 

Key Action 2: Safe and Fair Contract Terms and Conditions  

Key  Action  3:  Establishing  a  European  Cloud  Partnership  to  drive  innovation  and 
growth from the public sector.  

3.3. 

Key Action 1 – Cutting through the Jungle of Standards 

A wider use of standards, the certification of cloud services to show they meet these standards 
and  the  endorsement  of  such  certificates  by  regulatory  authorities  as  indicating  compliance 
with legal obligations will help cloud take-off.  

Currently,  individual  vendors  have  an  incentive  to  fight  for  dominance  by  locking  in  their 
customers, 
approaches.  Despite  numerous 
standardisation  efforts,  mostly  led  by  suppliers,  clouds  may  develop  in  a  way  that  lacks 
interoperability, data portability and reversibility, all crucial for the avoidance of lock-in. 

industry-wide 

standardised, 

inhibiting 

Standards  in  the  cloud  will  also  affect  stakeholders  beyond  the  ICT  industry,  in  particular 
SMEs,  public  sector  users  and  consumers.  Such  users  are  rarely  able  to  evaluate  suppliers' 
claims as to their implementation of standards, the interoperability of their clouds or the ease 
with  which  data  can  be  moved  from  one  provider  to  another.  For  this,  independent,  trusted 
certification is needed. 

Standardisation  and  certification  actions  for  cloud  computing  are  already  taking  place.  The 
U.S.  National  Institute  for  Standards  and  Technology  (NIST)  has  published  a  series  of 
documents including a widely accepted set of definitions. The European Telecommunications 
Standards Institute (ETSI) has set up a Cloud Group to consider cloud standardisation needs 
and  conformity  with  interoperability  standards.  Additional  standards  setting  initiatives  will 
clearly  be  needed.  However,  the  priority  now  is  to  deploy  existing  standards  to  develop 
confidence  in  cloud  computing  via  comparable  service  stacks  as  well  as  interoperable  and 
diverse offerings. In addition to identifying the concerned standards compliance certification 
is needed.  

Many,  and  certainly  all  larger  organisations,  require  certification  of  their  IT  systems' 
compliance  with  legal  and  audit  requirements  and  that  applications  and  systems  are 
interoperable. The Commission will: 

• 

Promote  trusted  and  reliable  cloud  offerings  by  tasking  ETSI  to  coordinate 
with stakeholders in a transparent and open way to identify by 2013 a detailed 
map  of  the  necessary  standards  (inter  alia  for  security,  interoperability,  data 
portability and reversibility).  

EN 

10 

   EN 

• 

 Enhance  trust  in  cloud  computing  services  by  recognising  at  EU-level 
technical  specifications  in  the  field  of  information  and  communication 
technologies for the protection of personal information in accordance with the 
new Regulation on European Standardisation21. 

•  Work  with  the  support  of  ENISA  and  other  relevant  bodies  to  assist  the 
development of EU-wide voluntary certification  schemes  in the area  of cloud 
computing  (including  as  regards  data  protection)  and  establish  a  list  of  such 
schemes by 2014.  

• 

Address the environmental challenges of increased cloud use by agreeing, with 
industry,  harmonised  metrics  for  the  energy  consumption,  water  consumption 
and carbon emissions of cloud services by 2014.22 

3.4. 

Key Action 2: Safe and Fair Contract Terms and Conditions 

Traditional IT outsourcing arrangements were typically negotiated and related to data storage, 
processing  facilities  and  services  defined  and  described  in  detail  and  up-front.  Cloud 
computing contracts, on the other hand, essentially create a framework in which the user has 
access  to  infinitely  scalable  and  flexible  IT  capabilities  according  to  his  needs.  However, 
currently the greater flexibility of cloud computing as compared to traditional outsourcing is 
often counterbalanced by reduced certainty for the customer due to insufficiently specific and 
balanced contracts with cloud providers. 

The  complexity  and  uncertainty  of  the  legal  framework  for  cloud  services  providers  means 
that  they  often  use  complex  contracts  or  service  level  agreements23  with  extensive 
disclaimers.  The  use  of  "take-it-or-leave-it"  standard  contracts  might  be  cost-saving  for  the 
provider  but  is  often  undesirable  for  the  user,  including  the  final  consumer.  Such  contracts 
may also impose the choice of applicable law or inhibit data recovery. Even larger companies 
have little negotiation power and contracts often do not provide for liability for data integrity, 
confidentiality or service continuity.24 

As regards professional users, the development of the model terms for cloud computing of the 
service  level  agreements  for  professional  users  were  one  of  the  most  important  issues  that 
arose during the consultation process. The service level agreements determine the relationship 
between the  cloud provider and professional  users, and  thus essentially  provide  the basis of 
trust cloud users can have in a cloud provider's ability to deliver services.  

Concerning  consumers  and  small  firms,  the  Commission's  proposal,  as  an  action  aiming  at 
building  digital  confidence  under  the  Digital  Agenda,  for  a  Regulation  on  a  Common 
European  Sales  Law25,  addresses  many  of  the  obstacles  stemming  from  diverging  national 
sales  law  rules  by  providing  contractual  parties  with  a  uniform  set  of  rules.  The  proposal 

21 

22 
23 

24 

25 

Adopted  on  11  September  2012  on  the  basis  of  the  Commission's  proposal,  COM  (2011)  315,  and 
entering into force on 1 January 2013. 
http://www.ict-footprint.eu 
An SLA specifies the technical conditions of service delivery, e.g. the extent of guaranteed availability 
as a percentage. 
See the opinion of the Article 29 Working Party on cloud computing, http://ec.europa.eu/justice/data-
protection/article-29/documentation/opinion-recommendation/index_en.htm#h2-1. 
COM(2011) 635 final 

EN 

11 

   EN 

                                                 
includes  rules  adapted  to  the  supply  of  "digital  content"  that  cover  some  aspects  of  cloud 
computing.26 

Specific  complementary  work  for  those  issues  that  lie  beyond  the  Common  European  Sales 
Law  is  needed  to  make  sure  that  other  contractual  questions  relevant  for  cloud  computing 
services  can  be  covered  as  well,  by  a  similar  optional  instrument  approach.  This 
complementary  work  should  cover  such  issues  as  data  preservation  after  termination  of  the 
contract, data disclosure and integrity, data location and transfer, direct and indirect liability, 
ownership of the data, change of service by cloud providers and subcontracting. 

Although  existing  EU  legislation  protects  users  of  cloud  services,  consumers  are  often 
unaware  of  their  relevant  rights  especially  including  the  applicable  law  and  jurisdiction  in 
civil  and  commercial  matters,  notably  when  it  comes  to  contract  law  questions.27 
Development  of  model  contract  terms  was  identified  in  the  consultation28  as  desirable  to 
overcome  these  problems.  Industrial  users  and  suppliers  have  called  for  self-regulatory 
agreements or standardisation. For contracts with consumers and small firms European model 
contract terms and conditions based on an optional contract law instrument may be needed to 
create transparent and fair cloud services contracts. 

Identifying and disseminating best practices in respect of model contract terms will accelerate 
the take up-of cloud computing by increasing the trust of prospective customers. 

Appropriate actions on contract terms can also help in the crucial area of data protection. As 
noted above, the proposed Regulation on personal Data Protection will guarantee a high level 
of  protection  for  individuals  by  ensuring  continuity  of  protection  when  data  is  transferred 
outside the EU and EEA, namely through standard contractual clauses governing international 
data transfers and establishment of the necessary conditions for the adoption of cloud-friendly 
binding corporate rules. These changes will ensure the EU data protection rules cater for the 
geographical and technical realities of cloud computing. The Commission will by end 2013:  

• 

• 

Develop  with  stakeholders  model  terms  for  cloud  computing  service  level 
agreements for contracts between cloud providers and professional cloud users, 
taking into account the developing EU acquis in this field.  

In line with the Communication on a Common European Sales Law29, propose 
to  consumers  and  small  firms  European  model  contract  terms  and  conditions 
for  those  issues  that  fall  within  the  Common  European  Sales  Law  proposal. 
The  aim  is  to  standardise  key  contract  terms  and  conditions,  providing  best 

26 

27 

28 
29 

The proposal for a Regulation on a Common European Sales Law applies to some of the contracts for 
the supply of digital content, i.e. “data which are produced and supplied in digital form, whether or not 
according to the buyer's specifications, including video, audio, picture or written digital content, digital 
games,  software  and  digital  content  which  makes  it  possible  to  personalise  existing  hardware  or 
software”  (digital  content)  which  can  be  stored,  processed  or  accessed,  and  re-used  by  the  user  but 
excludes “electronic communications services and networks, and associated facilities and services” as 
well as ”the creation of new digital content and the amendment of existing digital content”. 
See: Regulation (EC) No 593/2008 on the law applicable to contractual obligations (Rome I), OJ L 177, 
4.7.2008  and  Regulation  (EC)  No  44/2001  on  jurisdiction  and  the  recognition  and  enforcement  of 
judgments in civil and commercial matters, OJ L 12, 16.1.2001. 
http://ec.europa.eu/information_society/activities/cloudcomputing/docs/ccconsultationfinalreport.pdf 
Commission  Communication  "A  European  Consumer  Agenda  -  Boosting  confidence  and  growth", 
COM (2012) 225 final. 

EN 

12 

   EN 

                                                 
practice contract terms for cloud services on aspects related with the supply of 
"digital content". 

• 

• 

Task an expert group set up for this purpose and including industry to identify 
before  the  end  of  2013  safe  and  fair  contract  terms  and  conditions  for 
consumers  and  small  firms,  and  on  the  basis  of  a  similar  optional  instrument 
approach, for those cloud-related issues that lie beyond the Common European 
Sales Law . 

Facilitate  Europe's  participation  in  the  global  growth  of  cloud  computing  by: 
reviewing standard contractual clauses applicable to transfer of personal data to 
third countries and adapting them, as needed, to cloud services; and by calling 
upon  national  data  protection  authorities  to  approve  Binding  Corporate  Rules 
for cloud providers.30 

•  Work with industry to agree a code of conduct for cloud computing providers 
to  support  a  uniform  application  of  data  protection  rules  which  may  be 
submitted to the Article 29 Working Party for endorsement in order to ensure 
legal certainty and coherence between the code of conduct and EU law.  

3.5. 

Key  Action  3  –  Promoting  Common  Public  Sector  Leadership  through  a 
European Cloud Partnership 

The  public  sector  has  a  strong  role  to  play  in  shaping  the  cloud  computing  market.  As  the 
EU's largest buyer of IT services, it can set stringent requirements for features, performance, 
security, interoperability and data portability and compliance with technical requirements. It 
can also lay down requirements for certification. Several Member States have started national 
initiatives  such  as  Andromede  in  France,  G-Cloud  in  the  UK  and  Trusted  Cloud  in 
Germany.31 But with the public sector market fragmented, its requirements have little impact, 
services  integration  is  low  and  citizens  do  not  get  the  best  value  for  money.  Pooling  public 
requirements could bring higher efficiency and common sectoral requirements (e.g. eHealth, 
social care, assisted living, and eGovernment services such as open data32) would reduce costs 
and enable interoperability. 

The  private  sector  would  also  benefit  from  higher  quality  services,  more  competition,  rapid 
standardisation and better interoperability and market opportunites for high -tech SMEs. 

This  year,  the  Commission  is  therefore  setting  up  a  European  Cloud  Partnership  (ECP)  to 
provide  an  umbrella  for  comparable  initiatives  at  Member  State  level.  The  ECP  will  bring 
together  industry  expertise  and  public  sector  users  to  work  on  common  procurement 
requirements  for  cloud  computing  in  an  open  and  fully  transparent  way.  The  ECP  does  not 
aim  at  creating  a  physical  cloud  computing  infrastructure.  Rather,  via  procurement 

30 

31 

The relevant opinions of the Article 29 Working Party (See: WP 195 and WP 153) will serve as a basis 
for  a  Commission  draft.  Binding  Corporate  Rules  are  one  means  to  allow  for  legal  international  data 
transfers: they govern in an enforceable manner how the different parts of a corporation, regardless of 
their international location, deal with personal data. 
http://www.economie.gouv.fr/cloud-computing-investissements-d-avenir; 
http://www.cabinetoffice.gov.uk/sites/default/files/resources/government-cloud-
strategy_0.pdf;http://www.trusted-cloud.de/documents/aktionsprogramm-cloud-computing.pdf 
Communication on "Open data. An engine for innovation, growth and transparent governance", 

32 
COM(2011) 882 final. 

EN 

13 

   EN 

                                                 
requirements that will be promoted by participating Member States and public authorities for 
use throughout the EU, its aim is to ensure that the commercial offer in Europe is adapted to 
European needs. The ECP will also be instrumental for avoiding fragmentation and ensuring 
public cloud usage is interoperable as well as safe, secure and greener and fully in line with 
European  rules,  e.g.  in  the  areas  of  data  protection  and  security.  The  ECP  will,  under  the 
guidance  of  a  steering  board  bring  together  cooperating  public  authorities  working  with 
industry consortia to implement a pre-commercial procurement action to:  

• 

• 

• 

identify  public  sector  cloud  requirements;  develop  specifications  for  IT 
procurement  and  procure 
to  demonstrate 
conformance and performance.33 

implementations 

reference 

Advance  towards  joint  procurement  of  cloud  computing  services  by  public 
bodies based on the emerging common user requirements. 

Set  up  and  execute  other  actions  requiring  coordination  with  stakeholders  as 
described in this document. 

4. 

ADDITIONAL POLICY STEPS 

The  Commission  will  also  implement  a  series  of  flanking  actions  to  support  the  three  key 
actions. Other initiatives, such as on broadband access, roaming or open data also contribute 
to an environment conducive to faster cloud adoption, particularly for consumers and SMEs. 

4.1. 

Stimulation measures 

The  Commission  will  investigate  how  to  make  full  use  of  its  other  available  instruments 
notably  through  research  and  development  support  under  Horizon  2020  on  long-term 
challenges  specific  to  cloud  computing  as  well  as  assisting  the  migration  to  cloud-based 
solutions,  e.g.  software  for  switching  from  legacy  systems  to  cloud,  for  managing  hybrid 
services (combining cloud and non-cloud systems) and to avoid lock-in34.  

The  Commission  intends  to  launch  Digital  Service  Infrastructures  under  the  proposed 
Connecting  Europe  Facility35in  2014  as  ubiquitously  available  cloud-based  public  services 
for,  e.g.,  setting  up  businesses  online;  cross-border  procurement  and  eHealth  services;  and 
access  to  public  sector  information.  It  will  also  implement  its  own  cloud  plan  under  the 
eCommission  strategy,  including  a  programme  of  actions  to  move  public  services 
implemented under other Community programs into the cloud. 

Finally  it  will  take  action  (inter  alia  studies,  mentoring  and  counselling  schemes,  raising 
awareness)  to  promote  e-skills  skills  and  digital  entrepreneurship  with  regard  to  cloud 
computing.  

33 

34 

35 

This action will be funded from the Seventh Framework for Research (FP7) in 2013, the relevant call 
for proposals was published on 9 July 2012. 
See:  Cloud  Expert  Group  Report  "The  Future  of  cloud  computing.  Opportunities  for  European  cloud 
computing  beyond  2010  :  http://cordis.europa.eu/fp7/ict/ssai/docs/cloud-report-final.pdf    and  Cloud 
Expert  Group  Report  "Advances  in  Clouds":  http://cordis.europa.eu/fp7/ict/ssai/docs/future-cc-2may-
finalreport-experts.pdf 
Proposal for a Regulation establishing the Connecting Europe Facility, COM(2011) 665 

EN 

14 

   EN 

                                                 
4.2. 

International dialogue 

With no technical barriers to stop cloud services at geographical borders, there is a need not 
only to fully exploit the opportunities of the Digital Single Market but to look beyond the EU 
at the wider international situation for both the legal framework (e.g. on applicable law) and 
adoption-supporting measures.  

Cloud computing, being born global, calls for a reinforced international dialogue on safe and 
seamless  cross-border  use.  For  example,  the  international  dialogues  on  trade,  law 
enforcement,  security  and  cybercrime  all  need  to  fully  reflect  the  new  challenges  raised  by 
cloud computing.36 

More  third  countries  are  recognising  the  importance  of  cloud  computing.  The  USA,  Japan, 
Canada,  Australia  and  South  East  Asian  countries  such  as  Korea,  Malaysia  and  Singapore 
have  or  are  developing  cloud  computing  strategies.  The  main  axes  are  partnerships  to  drive 
take-up by public bodies; promotion of technological developments and standardisation; and 
international dialogue and coordination on legal and technical issues.The EU therefore needs 
to deepen its structured collaboration with international partners not just to share experiences 
and  do  joint  technological  development  but  also  for  legal  adjustments  to  promote  more 
efficient  and  effective  cloud  roll-out.37  These  dialogues  will  be  pursued  in  multilateral  fora 
such as the WTO and the OECD to advance common objectives for cloud computing services 
as well as by integrate cloud-computing-related issues in its free trade negotiations with India, 
Singapore etc. 

The Commission will also build on its on-going international dialogues with the USA, India, 
Japan  and  other  countries,  as  regards,  inter  alia,  key  themes  related  to  cloud  services  as 
discussed above, such as data protection; access to data by law enforcement agencies and the 
use of Mutual Legal Assistance Agreements to avoid confronting companies with conflicting 
requests  from  public  authorities;  coordination  of  data  security  at  the  global  level;  cyber-
security, 
interoperability 
requirements,  in  particular  for  public  services;  application  of  the  tax  law  to  cloud  services; 
and cooperation on research and technology development. 

intermediary  service  providers;  standards  and 

liability  of 

5. 

CONCLUSION 

Cloud computing touches a wide range of policy fields. Ongoing policy initiatives such as the 
data  protection  reform  and  the  Common  European  Sales  law  that  will  lower  barriers  to  the 
uptake of cloud computing in the EU should be adopted quickly. 

In parallel, the Commission will deliver on the key actions identified in this Communication 
in  2013,  notably  in  respect  of  the  actions  on  standardisation  and  certification  for  cloud 
computing, the development of safe and fair contract terms and conditions and the launch of 
the European Cloud Partnership. 

36 

37 

COM(2011)163 on Critical Information Infrastructure Protection identifies developing trust in the cloud 
as a priority and calls for "strengthen[ing] discussions on the best governance strategies". 
Such  dialogue  has  started  under  the  EU-US  Information  Society  Dialogue,  the  European  America 
Business  Council  and  the  EU-Japan  Information  Society  Dialogue.  Cloud  may  also  be  considered  by 
the Transatlantic Economic Council and the EU-US SME Cooperation.  

EN 

15 

   EN 

                                                 
The Commission will be vigilant on emerging policy issues which are likely to affect cloud 
computing's  economic  and  societal  potential  in  fields  such  as  taxation,  public  procurement, 
financial  regulation  or  law  enforcement,  where  cloud  computing's  inherent  cross-border 
nature raises questions regarding compliance and reporting obligations.  

The Commission will by the end of 2013 report on the progress on the full set of actions in 
this Strategy and present further policy and legislative proposals initiatives as needed. 

The next two years, during which the actions outlined above, will be developed and put into 
place will lay the foundation for Europe to become a world cloud computing powerhouse. The 
right  progress  during  this  preparation  phase  will  provide  a  stable  basis  for  a  rapid  take-off 
phase  from  2014-2020  during  which  use  of  publicly  available  cloud  computing  offerings 
could  achieve  a  38%  compound  annual  growth  rate  (around  double  the  rate  that  would  be 
achieved if the decisive policy steps are not implemented). 

The  Commission  calls  upon  Member  States  to  embrace  the  potential  of  cloud  computing. 
Member  States  should  develop  public  sector  cloud  use  based  on  common  approaches  that 
raise  performance  and  trust,  while  driving  down  costs.  Active  participation  in  the  European 
Cloud Partnership and deployment of its results will be crucial. 

The  Commission  also  calls  upon  industry  to  cooperate  closely  on  the  development  and 
adoption of common standards and interoperability measures. 

EN 

16 

   EN