Government Cloud Dependency And Sovereignty Concerns

1. Introduction

Government cloud dependency arises when public authorities increasingly rely on privately operated cloud-computing infrastructure for government data, identity systems, public services, defence applications, taxation, healthcare, policing, judicial records, procurement and critical infrastructure.

Cloud services can improve scalability, resilience and efficiency. However, where a government becomes heavily dependent on a small number of multinational cloud providers, questions arise concerning digital sovereignty, strategic autonomy, data jurisdiction, operational control, competition, national security, public procurement and continuity of government services.

The legal problem is therefore broader than ordinary data protection. It concerns whether a State can exercise effective sovereign authority when important governmental functions depend upon infrastructure, software, encryption systems, technical standards and administrative access controlled partly by private entities or foreign jurisdictions.

2. Meaning of Government Cloud Dependency

Government cloud dependency may exist where public authorities rely upon external providers for:

• Infrastructure-as-a-Service (IaaS);
• Platform-as-a-Service (PaaS);
• Software-as-a-Service (SaaS);
• government databases;
• digital identity;
• AI and machine-learning infrastructure;
• cybersecurity monitoring;
• government email and collaboration systems;
• cloud-based tax and customs systems;
• health and social-security databases;
• police and criminal-justice systems;
• defence and intelligence applications;
• public-sector procurement platforms; and
• disaster-recovery infrastructure.

Dependency becomes particularly significant when migration away from the provider is technically or economically difficult.

For example, a government may theoretically be free to change cloud providers but practically unable to do so because of:

1. proprietary APIs;
2. incompatible data formats;
3. high data-egress costs;
4. dependence on provider-specific AI services;
5. proprietary security systems;
6. long-term contractual commitments;
7. lack of alternative providers;
8. shortage of government technical expertise; and
9. integration with other government systems.

3. Government Cloud Dependency and Sovereignty

Sovereignty traditionally means the State possesses ultimate authority over its territory and governmental functions.

Cloud computing complicates this concept because data and computing resources may be distributed across:

Government → Cloud Provider → Data Centre → Subcontractors → Software Infrastructure → Foreign Jurisdiction

Consequently, the physical location of a server may not determine the entire legal position.

A government database could be physically located inside India or the EU while:

• the provider is incorporated elsewhere;
• its parent company is subject to another country's laws;
• encryption keys are administered outside the country;
• technical support is provided internationally;
• subcontractors operate in other jurisdictions; and
• foreign authorities may claim legal authority over the provider.

This produces a distinction between:

Territorial sovereignty

Where the physical infrastructure and data are located.

Data sovereignty

Whether the State controls the legal treatment and access to its data.

Operational sovereignty

Whether the government can independently operate its systems.

Technological sovereignty

Whether it possesses sufficient technological capability to avoid excessive dependence on foreign infrastructure.

Strategic sovereignty

Whether critical government functions can continue during geopolitical, commercial or technological disruption.

4. Major Sovereignty Concerns

A. Foreign Government Access

One of the most important concerns is the possibility that a cloud provider may be subject to foreign legal obligations.

The government may therefore face a conflict between:

Domestic secrecy/public-law obligations

and

foreign legal obligations imposed upon the cloud provider.

This is particularly significant for:

• defence information;
• intelligence information;
• tax records;
• health data;
• biometric information;
• judicial records;
• law-enforcement databases; and
• critical infrastructure information.

5. Data Location Does Not Necessarily Equal Data Sovereignty

Data localisation can reduce some risks, but physical localisation does not automatically establish complete sovereignty.

A government must consider:

• who controls encryption keys;
• who controls administrator accounts;
• who owns the underlying software;
• who can access metadata;
• where technical support personnel are located;
• which company's parent entity controls the service;
• which foreign laws apply to the provider;
• whether subcontractors can access the environment; and
• whether the government can independently migrate its data.

Thus:

Server sovereignty ≠ complete technological sovereignty.

6. Vendor Lock-In

Cloud dependency may create a competition problem through technological lock-in.

A government may initially select a provider through competitive procurement. Over time, however, the provider can become embedded within the public administration.

Switching costs can arise from:

• proprietary databases;
• proprietary APIs;
• provider-specific AI models;
• cloud-native applications;
• specialised security architecture;
• data-transfer expenses;
• employee training;
• software licences; and
• dependence upon proprietary monitoring systems.

This can transform a competitive procurement market into a highly dependent technological relationship.

7. Data-Egress and Switching Costs

A particularly important cloud competition issue is data egress.

Suppose Government Department A stores 10 petabytes of information with Provider X.

Moving the information to Provider Y could involve:

• enormous transfer costs;
• downtime;
• application redesign;
• compatibility problems;
• security testing;
• data-conversion expenses.

Even if Provider Y offers a cheaper service, switching may remain economically irrational.

This creates a phenomenon sometimes described as:

“competition for the contract” followed by “dependency after migration.”

8. Concentration of Government Cloud Infrastructure

Another concern is market concentration.

If a large proportion of government workloads are concentrated among a few providers, those providers can become systemically important technological intermediaries.

Potential consequences include:

• reduced bargaining power of governments;
• increased switching costs;
• reduced supplier diversity;
• systemic outage risks;
• common cybersecurity vulnerabilities;
• reduced innovation incentives; and
• greater dependence upon foreign technological ecosystems.

The problem becomes more serious where several government agencies use the same underlying infrastructure.

A single provider failure could then affect:

taxation + healthcare + social security + identity + justice + procurement.

9. Cloud Outages and Sovereign Continuity

Government services are different from ordinary commercial services.

If an online retailer suffers an outage, consumers may wait.

If a government cloud supporting:

• emergency services;
• tax administration;
• immigration;
• hospitals;
• courts;
• policing; or
• social-security payments

fails, the consequences may be much more serious.

Therefore government cloud procurement must consider continuity of sovereignty, not merely service-level agreements.

Important safeguards include:

• multi-cloud architecture;
• hybrid cloud;
• government-owned infrastructure;
• offline backups;
• independent disaster recovery;
• interoperable systems;
• encryption-key independence;
• exit plans; and
• alternative suppliers.

10. Government Cloud and National Security

Cloud infrastructure may contain information concerning:

• defence procurement;
• military logistics;
• critical infrastructure;
• intelligence;
• cybersecurity vulnerabilities;
• government personnel;
• diplomatic communications.

A foreign-controlled cloud environment can therefore create strategic dependencies.

The issue is not necessarily that a foreign provider will misuse information. Rather, the legal and structural concern is whether the government can guarantee exclusive and sovereign control over strategically sensitive systems.

11. Competition-Law Dimension

Government cloud dependency also intersects with competition law.

Relevant theories may include:

Abuse of dominance

A dominant cloud provider could potentially engage in:

• discriminatory access;
• tying;
• exclusionary rebates;
• interoperability restrictions;
• excessive switching costs;
• restrictive licensing;
• self-preferencing; or
• contractual practices that impede migration.

Essential-facilities reasoning

Where infrastructure becomes indispensable and duplication is practically impossible, questions may arise concerning access to essential technological infrastructure.

Vertical foreclosure

A provider controlling infrastructure could potentially favour its own:

• software;
• databases;
• cybersecurity products;
• AI systems;
• analytics services.

Conglomerate leveraging

A powerful cloud provider may use strength in cloud infrastructure to expand into:

• AI;
• cybersecurity;
• productivity software;
• government analytics;
• identity services.

12. Public Procurement Dimension

Government cloud procurement must reconcile two objectives:

Efficiency

and

strategic autonomy.

A procurement system focused exclusively on lowest price may overlook:

• long-term lock-in;
• switching costs;
• security dependence;
• foreign legal exposure;
• interoperability;
• concentration risk.

Accordingly, procurement evaluation can incorporate:

1. portability;
2. open standards;
3. exit rights;
4. interoperability;
5. data-location requirements;
6. encryption-key control;
7. subcontractor restrictions;
8. audit rights;
9. continuity obligations; and
10. supplier-diversification requirements.

13. Privacy and Data-Protection Dimension

Government cloud systems frequently process personal data.

This creates questions concerning:

• lawful processing;
• purpose limitation;
• security;
• international transfers;
• government surveillance;
• data-subject rights;
• judicial oversight; and
• effective remedies.

The European Court of Justice has been particularly important in establishing that international data transfers cannot simply be justified by contractual arrangements where foreign governmental access creates inadequate protection.

14. At Least 6 Important Case Laws

1. Schrems v Data Protection Commissioner — Schrems I

Court: Court of Justice of the European Union
Year: 2015

This case concerned the transfer of personal data from the EU to the United States under the Safe Harbour framework.

The CJEU invalidated the Safe Harbour arrangement because the framework did not provide sufficiently effective protection against interference by public authorities.

Importance for government cloud sovereignty

The case demonstrates that:

Cross-border technological infrastructure can create sovereignty and fundamental-rights problems even when contractual mechanisms exist.

For government cloud procurement, merely requiring contractual confidentiality may therefore be insufficient where foreign governmental access remains possible.

15. Schrems II

Court: Court of Justice of the European Union
Year: 2020

Schrems II is one of the most significant cases concerning international data transfers.

The CJEU invalidated the EU-US Privacy Shield while retaining the possibility of using Standard Contractual Clauses subject to adequate safeguards and assessment of the legal environment of the destination country.

Relevance

The decision is particularly important for government cloud infrastructure because it highlights the distinction between:

where data is stored

and

which legal system can potentially reach the data or provider.

It therefore strengthens the legal importance of:

• encryption;
• access controls;
• transfer assessments;
• supplementary safeguards;
• government oversight; and
• provider independence.

16. Digital Rights Ireland Ltd v Minister for Communications

Court: Court of Justice of the European Union
Year: 2014

The CJEU invalidated the EU Data Retention Directive because indiscriminate retention of communications data constituted a serious interference with fundamental rights.

Relevance to cloud sovereignty

The case establishes an important constitutional principle:

Large-scale technological data infrastructures remain subject to fundamental-rights limitations.

Government migration to cloud infrastructure therefore cannot be treated simply as an administrative IT decision.

Where cloud systems facilitate large-scale government surveillance or data retention, legality, necessity and proportionality remain relevant.

17. Tele2 Sverige AB v Post- och telestyrelsen / Watson

Court: CJEU
Year: 2016

The Court addressed general and indiscriminate retention of communications data and reinforced limits derived from EU fundamental rights.

Relevance

Cloud infrastructure can create enormous databases of:

• communications;
• location information;
• identity information;
• metadata.

Tele2 demonstrates that technological capability does not itself justify unrestricted governmental access.

It therefore provides an important constitutional framework for sovereign cloud systems.

18. La Quadrature du Net and Others

Court: CJEU
Year: 2020

The Court considered national security, electronic communications and data retention.

The judgments recognised that national security is a fundamental State responsibility but simultaneously imposed legal constraints concerning the processing and retention of communications data.

Relevance

This case illustrates the tension between:

State security

and

individual privacy/fundamental rights.

That tension becomes especially significant where cloud providers operate infrastructure used by intelligence or law-enforcement authorities.

19. Wirtschaftsakademie Schleswig-Holstein

Court: CJEU
Year: 2018

The case concerned responsibility for processing personal data through a Facebook fan page.

The Court recognised joint responsibility in circumstances involving the operation of a third-party technological platform.

Relevance to government cloud

The principle is relevant to government-cloud relationships because outsourcing processing does not necessarily eliminate the public authority's responsibility.

A government cannot simply argue:

“The cloud provider processes the data, therefore responsibility belongs entirely to the provider.”

Government authorities remain required to establish appropriate governance, security and legal controls.

20. Microsoft Corp. v United States

Court: United States Supreme Court
Year: 2018

The dispute concerned whether the US government could compel Microsoft to produce emails stored on a server located outside the United States.

Congress subsequently enacted the CLOUD Act, and the Supreme Court dismissed the case as moot.

Importance

The dispute nevertheless illustrates a fundamental cloud-sovereignty problem:

The physical location of data does not necessarily answer the question of governmental jurisdiction over a cloud provider.

This is particularly important where governments assume that storing data domestically completely prevents foreign governmental access.

21. United States v Microsoft and the CLOUD Act Problem

The broader Microsoft dispute demonstrates that cloud sovereignty has at least two dimensions:

Physical control

Where the data centre is located.

Corporate/legal control

Which entity controls the information and is subject to governmental legal authority.

Consequently, government procurement contracts increasingly need to examine the provider's:

• corporate structure;
• applicable foreign laws;
• disclosure obligations;
• transparency mechanisms;
• governmental-access procedures.

22. Google Spain SL, Google Inc. v AEPD and Mario Costeja González

Court: CJEU
Year: 2014

The CJEU recognised important responsibilities concerning search-engine processing of personal information and the right to request removal of certain search results.

Relevance

The case illustrates how private technological intermediaries can acquire significant control over the accessibility and visibility of information.

The principle has broader significance for government cloud systems:

Delegating information infrastructure to private intermediaries does not eliminate the State's responsibility to protect legally protected information interests.

23. Puttaswamy v Union of India

Court: Supreme Court of India
Year: 2017

The Supreme Court of India recognised privacy as a constitutionally protected fundamental right under Article 21 and related constitutional guarantees.

The judgment established a constitutional framework based on concepts including:

• legality;
• legitimate State purpose;
• proportionality; and
• safeguards against arbitrary interference.

Relevance to government cloud

When government agencies place personal information in cloud infrastructure, questions arise regarding:

• informational privacy;
• security;
• government access;
• surveillance;
• data processing;
• accountability.

Government cloud architecture must therefore be compatible with constitutional privacy principles.

24. Anuradha Bhasin v Union of India

Court: Supreme Court of India
Year: 2020

The Supreme Court examined restrictions involving internet access and emphasised principles of proportionality and constitutional review.

Relevance

Although not a cloud-computing case, it is significant for digital sovereignty because it recognises that governmental control over digital infrastructure and communications must remain subject to constitutional standards.

It supports the broader proposition that:

Digital infrastructure is not constitutionally neutral merely because it is technologically complex.

25. Key Legal Principles Emerging from the Cases

26. Government Cloud Dependency as a Competition Problem

The traditional competition model asks:

“Are consumers paying higher prices?”

Government cloud dependency requires a broader inquiry.

The relevant questions may instead be:

1. Can government switch providers?
2. Can data be exported without unreasonable cost?
3. Are APIs interoperable?
4. Can government applications run on alternative clouds?
5. Does the provider control critical technical standards?
6. Can the provider favour its own downstream services?
7. Is there sufficient supplier diversity?
8. Are government agencies collectively dependent on the same provider?
9. Does cloud concentration create systemic risks?
10. Does procurement reinforce an existing dominant position?

Thus zero-price or public-sector procurement markets can still present significant competition concerns.

27. Sovereignty Risk Matrix

Low dependency

Government retains:

• multiple suppliers;
• independent infrastructure;
• open standards;
• portable data;
• independent encryption keys.

Moderate dependency

Government relies substantially on one provider but maintains:

• contractual exit rights;
• backups;
• alternative suppliers;
• migration capability.

High dependency

Government systems become:

• provider-specific;
• difficult to migrate;
• technically integrated;
• dependent on proprietary services.

Strategic dependency

A provider becomes indispensable to:

• national identity;
• defence;
• healthcare;
• taxation;
• critical infrastructure;
• emergency services.

At this point, cloud dependency becomes a sovereignty and national-resilience issue, not merely an IT procurement issue.

28. Legal and Regulatory Safeguards

Governments can reduce sovereignty risks through:

1. Multi-cloud procurement

Avoiding complete dependence on one supplier.

2. Hybrid cloud

Combining government-controlled infrastructure with commercial cloud capacity.

3. Data portability

Contracts should guarantee extraction in usable formats.

4. Open standards

Government systems should avoid unnecessary dependence on proprietary protocols.

5. Independent encryption keys

Where appropriate, the government should retain meaningful control over cryptographic keys.

6. Exit clauses

Contracts should contain detailed migration obligations.

7. Data-location controls

Sensitive information may require specific geographical restrictions.

8. Subcontractor controls

Providers should disclose and control subcontracting arrangements.

9. Government audit rights

Authorities should be able to verify security and compliance.

10. Continuity requirements

Critical public services should have disaster-recovery and alternative-operation mechanisms.

29. Sovereign Cloud Does Not Necessarily Mean Government-Owned Cloud

“Sovereign cloud” should not automatically be understood as:

100% government-owned hardware.

A sovereign model can instead involve several layers:

Government legal control
↓
Domestic jurisdictional safeguards
↓
Independent encryption/control mechanisms
↓
Operational autonomy
↓
Interoperable technology
↓
Multiple suppliers
↓
Resilient infrastructure

The critical question is whether the government retains effective control over essential governmental functions.

30. Emerging AI and Cloud Sovereignty

The issue becomes even more important with government AI.

Modern AI services can depend on:

• GPUs;
• cloud inference;
• foundation models;
• proprietary APIs;
• training datasets;
• model registries;
• specialised accelerators.

A government may therefore migrate from:

cloud dependency

to

AI-cloud dependency.

If a government uses a provider's proprietary AI platform for:

• immigration decisions;
• tax fraud detection;
• welfare administration;
• policing;
• public procurement;
• defence analysis,

switching providers may become substantially harder because the dependency is no longer merely on storage and computing.

It may involve the entire decision-making infrastructure.

31. The “Sovereignty Stack”

Government cloud sovereignty can therefore be understood through a five-layer model:

Layer 1 — Data

Who possesses and controls government information?

Layer 2 — Compute

Who controls the computational infrastructure?

Layer 3 — Software

Can the government operate applications independently?

Layer 4 — Intelligence

Who controls AI models and analytical systems?

Layer 5 — Governance

Can the State continue performing sovereign functions if the provider becomes unavailable?

A government may achieve data localisation while remaining dependent at the compute, software or AI levels.

32. Overall Legal Assessment

Government cloud dependency sits at the intersection of:

• competition law;
• public procurement law;
• data-protection law;
• constitutional law;
• national-security law;
• cybersecurity regulation;
• administrative law; and
• digital-sovereignty policy.

The most important legal insight from the case law is that technological outsourcing does not automatically transfer governmental responsibility to a private cloud provider.

The Schrems cases demonstrate the importance of jurisdiction and governmental access; Digital Rights Ireland, Tele2 and La Quadrature du Net demonstrate constitutional constraints on large-scale digital data processing; Microsoft illustrates the difficulty of separating data location from provider jurisdiction; and Puttaswamy establishes the constitutional importance of privacy in India's digital governance framework.

33. Conclusion

Government cloud dependency creates a distinctive form of modern infrastructure dependence. The central issue is not simply whether government data is stored securely, but whether the State retains effective legal, technical and operational control over the infrastructure necessary to perform sovereign functions.

The principal risks are:

foreign jurisdiction + vendor lock-in + cloud concentration + data-access uncertainty + proprietary technology + switching costs + cybersecurity dependency + systemic outage + AI dependency.

Accordingly, a legally resilient government-cloud framework should combine competition safeguards, interoperability, portability, procurement controls, privacy protections, jurisdictional safeguards, security requirements, multi-provider architecture and credible exit mechanisms.