Sovereignty incidents — cloud & data
Microsoft France CLOUD Act testimony (10 June 2025)
Claim
Anton Carniaux, Director of Public and Legal Affairs at Microsoft France, testified under oath to a French Senate inquiry into public buying and digital sovereignty that he could not guarantee French citizens’ data held in Microsoft’s EU data centres would never be handed to US authorities without France’s consent. Asked directly, he said “No, I cannot guarantee that.” The law that makes this possible is the US CLOUD Act of 2018.
Sources
- Sénat de la République française, Commission d’enquête sur la commande publique et la souveraineté numérique, Audition d’Anton Carniaux, 10 June 2025
- Lindsay Clark, “Microsoft exec admits it cannot guarantee data sovereignty,” The Register, 25 July 2025 ↗
- Cristiano Lima-Strong, “Microsoft tells French lawmakers it can’t protect user data from US demands,” SDxCentral, 21 July 2025 ↗
Referenced in
- Framework §2 (illustrative incident)
- AI-SAF-N Infrastructure pillar
- AI-SAF-C Infrastructure pillar
- Refining §3.3