![Sample our Law journals, sign in here to start your FREE access for 14 days]({"type":"image" , "src" : "/sda/5942/TOC-Subject-Sample-2021-Law.jpg"})
Abstract
Cloud computing brings important benefits and it is expected to play a key role in facilitating the uptake of emerging technologies and applications, including artificial intelligence, blockchain, and high-performance computing. Despite its potential to deliver cost and time-efficient services, the majority of businesses in the EU have still not implemented cloud computing. This illustrates the need for a more widespread adoption of the technology. Yet, recent regulatory initiatives may obstruct the uptake of cloud services. This is arguably because such initiatives do not reflect a proper understanding of the market, which our paper intends to provide. To that end, the paper examines what cloud computing is and how it works. It subsequently discusses the EU’s attempts to regulate cloud computing, including the Digital Markets Act, the Digital Services Act, and the Data Act proposal. Our analysis demonstrates that the logic of these instruments and the obligations they establish do not fit the characteristics and workings of cloud computing. The paper concludes by noting that future regulation must mirror the specificities of the cloud, which has a value chain and traits that differ significantly from other digital services, most notably online platforms.
Acknowledgments
The authors would like to thank Dimitrios Katsifis and Alexandru Circiumaru for their excellent research assistance and comments on earlier drafts.
Disclosure statement
No potential conflict of interest was reported by the author(s).
Notes
1 Gabriella Cattaneo, Filippo Vanara and Alessandra Massaro, ‘Advanced Technologies for Industry – AT Watch: Technology Focus on Cloud Computing’ (ATI Watch Report Series, European Commission, Europa, 2020) <https://ati.ec.europa.eu/reports/technology-watch/technology-focus-cloud-computing> accessed 13 September 2023.
2 European Commission, ‘Shaping Europe’s Digital Future: Backbone Networks for Pan-European Cloud Federations’ Europa (21 October 2022) <https://digital-strategy.ec.europa.eu/en/activities/backbone-networks-cloud-federations> accessed 13 September 2023.
3 Will Forrest and others, ‘Cloud’s Trillion-dollar Prize is Up for Grabs’ McKinsey Quarterly (26 February 2021) <www.mckinsey.com/business-functions/mckinsey-digital/our-insights/clouds-trillion-dollar-prize-is-up-for-grabs> accessed 13 September 2023.
4 Grand View Research, ‘Cloud Gaming Market Size, Share & Trends Analysis Report By Type (File Streaming, Video Streaming), By Device, By Gamer Type, By Region, and Segment Forecasts, 2022–2030’ (2023) <www.grandviewresearch.com/industry-analysis/cloud-gaming-market> accessed 13 September 2023.
5 For example, in 2021 only 41% of businesses across the EU had implemented cloud computing. See: Eurostat, ‘Cloud Computing – Statistics on the Use by Enterprises’ Europa (2021) <https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Cloud_computing_-_statistics_on_the_use_by_enterprises> accessed 13 September 2023.
6 Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) [2022] OJ L 265/1 (‘DMA’).
7 Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) [2022] OJ L 277/1 (‘DSA’).
8 European Commission, ‘Proposal for a Regulation of The European Parliament and of The Council on harmonised rules on fair access to and use of data (Data Act)’ COM (2022) 68 final (‘DA Proposal’).
9 Microsoft Azure, ‘What is Cloud Computing? A Beginner’s Guide’ <https://azure.microsoft.com/en-us/resources/cloud-computing-dictionary/what-is-cloud-computing/> accessed 13 September 2023.
10 Peter Mell and Tim Grance, ‘The NIST Definition of Cloud Computing’ (NIST, 2011) <https://csrc.nist.gov/publications/detail/sp/800-145/final> accessed 13 September 2023.
11 Derrick Rountree and Ilena Castrillo, ‘The Basics of Cloud Computing: Understanding the Fundamentals of Cloud Computing in Theory and Practice’ (Syngress, 2013) 3–4.
12 IBM Cloud Education, ‘What is Virtualization’ <www.ibm.com/cloud/learn/virtualization-a-complete-guide> accessed 13 September 2023.
13 Stephen Watts and Muhammad Raza, ‘SaaS vs PaaS vs IaaS: What’s The Difference & How to Choose’ BMC Blogs (15 June 2019) <www.bmc.com/blogs/saas-vs-paas-vs-iaas-whats-the-difference-and-how-to-choose/> accessed 13 September 2023.
14 Hossein Ashtari, ‘Platform as a Service (PaaS) vs. Software as a Service (SaaS): Key Differences and Similarities’ Spiceworks (18 February 2022) <www.spiceworks.com/tech/cloud/articles/paas-vs-saas/#:~:text=It%20is%20more%20common%20for,marketed%20exclusively%20for%20B2B%20applications> accessed 13 September 2023.
15 Timothy Shim, ‘15 Popular Platform as a Service (PaaS) Examples’ Web Hosting Services Revealed (16 February 2023) <www.webhostingsecretrevealed.net/blog/web-business-ideas/paas-examples/> accessed 13 September 2023.
16 Sophia Bernazzani, ‘IaaS vs. PaaS vs. SaaS: Here's What You Need to Know About Each’ HubSpot Blog (4 July 2022) <https://blog.hubspot.com/service/iaas-paas-saas> accessed 13 September 2023.
17 Microsoft Azure, ‘Serverless Computing – An Introduction to Serverless Technologies’ <https://azure.microsoft.com/en-us/resources/cloud-computing-dictionary/what-is-serverless-computing/> accessed 13 September 2023.
18 DMA (n 6) Article 2(1)(i).
19 ibid. Recital (1).
20 ibid. Recitals (3) (referring to reduced contestability) and (4) (referring to the risk of serious imbalances in bargaining power and of unfair practices and conditions for business users, as well as end users of core platform services).
21 ibid. Article 2(13), referring to Article 4(19) of Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union [2016] OJ L 194/1.
22 Mario Mariniello and Catarina Martins, ‘Which Platforms will be Caught by the Digital Markets Act? The ‘Gatekeeper’ Dilemma’ Bruegel (14 December 2021) <www.bruegel.org/blog-post/which-platforms-will-be-caught-digital-markets-act-gatekeeper-dilemma> accessed 13 September 2023.
23 Heike Schweitzer, ‘The Art to Make Gatekeeper Positions Contestable and the Challenge to Know What is Fair: A Discussion of the Digital Markets Act Proposal’ (2021) 3 Zeitschrift fur Europaisches Privatrecht 503.
24 OECD, ‘Oligopoly Markets’ <www.oecd.org/daf/competition/oligopoly-markets.htm> accessed 13 September 2023.
25 See, for example: Nico Grant, ‘Google is Searching for a Way to Win the Cloud’ Bloomberg (2 February 2022) <www.bloomberg.com/news/articles/2022-02-02/google-searches-for-way-to-win-cloud-share-from-amazon-web-services-microsoft> accessed 13 September 2023.
26 DMA (n 6) Article 3(1)(b).
27 See for example: DMA (n 6) Recital (2) (referring to the multi-sidedness of CPS as one of their main characteristics); Recital (3) (referring to the ability to connect many business users with many end users); Recital (15) (explaining that the DMA obligations should only apply to undertakings designated as gatekeepers, and should only apply to those of their core platform services that individually constitute an important gateway for business users to reach end users).
28 European Commission, ‘Commission Staff Working Document – Impact Assessment Report Accompanying the Proposal for a Regulation of the European Parliament and of the Council on contestable and fair markets in the digital sector (Digital Markets Act)’, SWD(2020) 363 final (‘DMA Impact Assessment’) 38, explaining that video streaming services and video on-demand services were considered but eventually excluded from the scope of core platform services as they ‘lack multi-sided market characteristics’.
29 See, for example: Rima Alaily and Casper Klynge, ‘Microsoft Supports New Rules for Gatekeepers’ Microsoft EU Policy Blog (3 May 2021) <https://blogs.microsoft.com/eupolicy/2021/05/03/microsoft-supports-new-rules-for-gatekeepers/> accessed 13 September 2023.
30 See DMA Impact Assessment (n 28) 114–115, explaining that online intermediation services can ‘become a key access point for business users to reach end users’ and online search engines have ‘the capacity to affect a large number of end users and businesses alike.’ As regards cloud computing services, however, the Impact Assessment merely explains that such services provide ‘infrastructure to support and enable functionality in digital services offered by others and at the same time offer a range of products.’ Yet, this does not explain how cloud computing services intermediate between businesses and their users.
31 Article 3(2)(b) of the DMA (n 6) provides that an undertaking shall be presumed to provide a core platform service which serves as an ‘important gateway’ between business users and end users if the core platform service has more than 45 million monthly active end users established or located in the EU and more than 10,000 yearly active business users established in the EU.
32 The Annex defines end users as ‘unique end users who engaged with the online intermediation service at least once in the month […] or concluded a transaction through the online intermediation service at least once in the month.’ Business users are defined as ‘unique business users who had at least one item listed in the online intermediation service during the whole year or concluded a transaction enabled by the online intermediation service during the year.’
33 DMA (n 6) Article 5(2).
34 ibid. Article 5(8).
35 ibid. Article 6(2).
36 ibid. Article 6(9).
37 ibid. Article 6(10).
38 European Commission, ‘Digital Markets Act: Commission designates six gatekeepers’ – Press release Europa (6 September 2023) <https://ec.europa.eu/commission/presscorner/detail/en/ip_23_4328> accessed 6 September 2023.
39 ibid. Article 3(5).
40 ibid. Recital (23): ‘In its assessment of the evidence and arguments produced, the Commission should take into account only those elements which directly relate to the quantitative criteria, namely the impact of the undertaking providing core platform services on the internal market beyond revenue or market cap, such as its size in absolute terms, and the number of Member States in which it is present; by how much the actual business user and end user numbers exceed the thresholds and the importance of the undertaking’s core platform service considering the overall scale of activities of the respective core platform service; and the number of years for which the thresholds have been met.’
41 DMA (n 6) Article 3(8).
42 Consolidated Version of the Treaty on the Functioning of the European Union [2012] OJ C 326/47, Article 263.
43 From a procedural point of view, the undertaking would contest the designation decision, and then incidentally challenge the DMA (or parts thereof). This is preferable to filing an action for annulment of the DMA (or parts thereof), as it is much harder for undertakings to establish standing to challenge a Regulation.
44 DSA (n 7) Article 1(1).
45 ibid. Article 2(1).
46 ibid. Recital (27a).
47 ibid. Recital (13).
48 ibid.
49 It is worth mentioning that the DSA (n 7) attempts to clarify when cloud services do not qualify as platforms. Recital (13) notes that ‘cloud computing services […] when serving as infrastructure, such as the underlining infrastructural storage and computing services of an internet-based application, website or online platform, should not in themselves be considered as disseminating to the public information stored or processed at the request of a recipient of the application, website or online platform which they host’. Recital (13) implies that the only type of cloud services that may not qualify as platforms are IaaS.
50 DSA (n 7) Articles 14 et seq.
51 Microsoft, ‘Microsoft’s Comments on the European Commission’s Proposed Digital Services Act’ Europa (31 March 2021) <https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12417-Digital-Services-Act-deepening-the-internal-market-and-clarifying-responsibilities-for-digital-services/F2164152_en> accessed 13 September 2023.
52 European Commission, ‘Data Act: Commission Proposes Measures for a Fair and Innovative Data Economy – Press Release’ Europa (23 February 2022) <https://digital-strategy.ec.europa.eu/en/news/data-act-commission-proposes-measures-fair-and-innovative-data-economy> accessed 13 September 2023.
53 DA proposal (n 8) 7.
54 ibid. Article 2(1).
55 ibid. Article 2(6).
56 Microsoft, ‘Microsoft Position Paper on the Data Act’ (October 2022) 4.
57 ibid.
58 ibid.
59 ibid.
60 ibid.
61 DA proposal (n 8) Article 2(13).
62 ibid. Article 2(12). Recital (69) explicitly refers to cloud computing services as examples of data processing services.
63 Microsoft (n 56) 5.
64 ibid.
65 ibid. In its position on the DA proposal, the European Parliament proposes an amendment whereby the providers of a data processing service should take measures to enable switching ‘within their capacity’. This is arguably not sufficient clear. See Amendments adopted by the European Parliament on 14 March 2023 on the proposal for a regulation of the European Parliament and of the Council on harmonized rules on fair access to and use of data (Data Act) (COM(2022)0068 – C9-0051/2022–2022/0047(COD), Article 23(1).
66 DA proposal (n 8) Chapter VI.
67 Microsoft (n 56) 14.
68 Council of the European Union. Proposal for a Regulation of the European Parliament and of the Council on harmonized rules on fair access to and use of data (Data Act) – Mandate for negotiations with the European Parliament. Article 26(1).
69 European Parliament position on the DA proposal (n 65), Article 26(1).
70 ibid. 15.
71 ibid. 16.
72 DA proposal (n 8) Article 29(1)(c).
73 ibid.
74 ibid.