Legal Opinion Confirms US Authorities' Access to European-Hosted Data, Urging German Government Action

A recent legal opinion by the University of Cologne reveals that US authorities retain the ability to access data hosted in the European Union by US companies or their subsidiaries, despite claims suggesting otherwise. This finding highlights serious concerns surrounding data sovereignty for European businesses and public institutions.

The Federal Association of IT SMEs (BITMi) has called on the German government to respond decisively to this recurring legal uncertainty by advancing policies that bolster digital sovereignty in Germany and across Europe. According to BITMi, organizations headquartered, managed, and owned within Europe provide the highest level of legal security for storing and processing sensitive data, making them the safest choice for entities focused on data protection, compliance, and strategic independence.

The commissioned legal opinion, titled "On the US Legal Situation Regarding Global Data Access by US Authorities," was funded by the Federal Ministry of the Interior and Community (BMI). It unequivocally demonstrates that US authorities can compel access to EU-hosted data held by US companies and their European operations. Interestingly, the opinion also notes EU-based companies with operations in the US may be subject to similar data handover requests by US authorities.

BITMi emphasizes that resilience and strict adherence to EU law should be key criteria when selecting digital solutions, especially in public administration. Rasmus Keller, spokesperson for BITMi’s IT law group, pointed out the limitation of US enforcement within EU territory, reinforcing that fully European-led companies remain the most secure option.

The report underlines the urgent necessity for German governmental action to ensure that European digital infrastructure and data management are protected from extraterritorial access risks. This is a critical step toward safeguarding data sovereignty and achieving greater compliance and trust in Europe’s digital ecosystem.