4.3.1 Cloud data centres in EU28 Member States

As noted in the introduction the underlying economic tenet associated with data location restrictions is that regulations (restricting cross border data flow) will cause cloud data centres to be located in sub-optimal locations within the EU. It was highlighted that it is rational to assume that these additional costs, associated with locating in non-optimal locations, will be passed on to consumers eventually. But in the short-term market share strategies pursued by cloud service providers might absorb these costs. It is also possible that cloud providers might charge a premium for the use of cloud data centres in particular locations.

4.6 Cloud data centres in EU28 Member States

Cloud data centres are facilities that house large numbers of high-performance computers, known as servers, as well as networking equipment and communication links. Cloud data centres store, manage or process digital data at scale within secure, specialised, resilient and self-contained facilities. Essentially, a cloud data centre consolidates numerous separate IT functions within a single operating unit, thus delivering economies of scale, improved performance and efficiency.

The servers in the cloud data centres store data and offer services such as IaaS (infrastructure as a service), PaaS (platform as a service), SaaS (software as a service) and NaaS (network as a service).

Copenhagen Economics53 report cloud providers capture scale advantages by consolidating the storage and processing of data in large data centres, thereby shifting the landscape towards larger-scale, purpose-built facilities with a focus on operational costs and efficiency. In essence, data is cheap to transport and data centres are subject to large-scale economies. Concentration of the data keeps the costs of data storage and operations of its services down, which ultimately benefits all Internet users. Moreover, data security is an important aspect and cloud service providers focus heavily and invest accordingly to ensure that data is kept safe at their data centres.

4.3.1 Cloud data centres in EU28 Member States Leviathan Security Group54, in a 2015 study, found six ‘Infrastructure as a Service’ (IaaS) public cloud computing providers in EU28 Member States55. These were:

 Amazon Web Services - with data centres in France, Germany and Ireland;  DigitalOcean - UK and Netherlands (Amsterdam);  Google Compute Engine56 - Belgium (Mons), Finland, Ireland and the

Netherlands;  Linode - UK;

53 Copenhagen Economics. 2015. The economic impact of Google’s data centre in Belgium. 54 Leviathan Security Group. 2015. Quantifying the cost of forced localisation. The six EU28 cloud servers are described on page 10. 55 The Leviathan study focused on “Infrastructure as a Service” (IaaS) cloud computing providers. They excluded storage-only, routing-only, and other providers that, while they may well be general-access cloud providers, do not provide general computing instances (page 6). The study clearly differentiates between Europe, the Schengen Area and EU28 Member States 56 Copenhagen Economics. 2015. The economic impact of Google’s data centre in Belgium. reports that Google also operates data centres in Hamina, Finalnd and Dublin Ireland. A fourth is reported to be underway in Eemshaven, Netherlands.

 Microsoft Azure - Ireland and Netherlands;  Rackspace cloud servers - UK.

Figure 25 – The distribution of cloud data centres for the six largest cloud service providers in the European Union

Adapted from Leviathan Security Group. 2015.

Outside of the seven Member States where cloud data centres have been built (Belgium, Finland, France, Germany, Ireland, Netherlands and the UK), see Figure 25, cloud services users would have to use non-public cloud providers if regulations did not permit crossborder data flows. In these cases those using non-public cloud providers would probably have to build their own private cloud (presumably ‘on-premise’) or utilise a dedicated private cloud. In both these alternatives the decision of where the service would be provided would be made and paid for solely by the cloud user for their own private use.

Figure 26 - The number of data flow restrictions in EU Member States where leading cloud providers have located cloud data centres

Number of restrictions

Germany (1 data centre) 4 Belgium (1 data centre) 3 Netherlands (3 data centres) 3 Ireland (3 data centres) 2 Finland (1 data centre) 1 Note: Number of restrictions found in previous chapter analysis of compliance obligations

Figure 26 provides an insight to the number of data flow restrictions in EU Member States where leading cloud providers have located cloud data centres. Three Member States are amongst those with the most onerous cross-border data transfer regulations (Germany, Belgium and the Netherlands). But the other two Member States have relatively few