Introduction
Public Clouds Confederation project
Open proceedings before Federal Administrative Court
Comment
The "Public Clouds Confederation" project aims to centralise the supply of cloud computing services for administration purposes through a privileged and simplified relationship with leading cloud service providers. The administrative offices would thus benefit from quick access to various services and technologies from public clouds when needed.
Public Clouds Confederation project
In a press release (in French, German and Italian) on 27 September 2022, the Federal Chancellery announced that the contracts with the suppliers for the implementation of the Public Clouds Confederation project had been signed. As a reminder, the Federal Chancellery had announced the preparation of these contracts in the press release of 1 March 2022.
In concrete terms, this project aims to facilitate the implementation and use of information technology and cloud technologies by the administration when it wishes to set up a public cloud. The Federal Office of Information Technology, Systems and Telecommunications will act as an intermediary between the administration and service providers to select the best service from the five providers selected in the OMC-20007 market (Amazon Web Services, Microsoft Azure, Alibaba, IBM and Oracle). In this capacity, it will assist and advise the requesting offices, in particular, to ensure that they comply with information security, data protection and professional secrecy requirements.
However, the Federal Chancellery points out that the services based on the Public Clouds Confederation project will mainly deal with public data and data without special protection requirements. Administrative offices wishing to use them in this context will in any case have to draw up specifications independent of the suppliers and carry out detailed clarifications relating, among other things, to the legality of outsourcing and processing data in a public cloud and to protection requirements.
Open proceedings before Federal Administrative Court
A case concerning the legality of the outsourcing of data and data processing to foreign providers was recently brought before the courts.
On 18 January 2022, a private person asked the Federal Chancellery for information on the legal basis on which the outsourcing of data and its processing was based. As he did not deem the Federal Chancellery's answer satisfactory, the plaintiff appealed to the Federal Administrative Court to request, among other things:
- the immediate cessation of all activities in the field of cloud computing with a foreign provider; and
- a finding that the federal administration's cloud computing activities with a foreign provider did not have the necessary legal basis.
The plaintiff also requested provisional measures to suspend all work related to the implementation of the Public Clouds Confederation project until a decision is reached regarding its outcome.
On 31 March 2022, the Federal Administrative Court denied the request for provisional measures, and, on 20 April 2022, the plaintiff lodged an appeal with Switzerland's highest court, the Federal Supreme Court. The Federal Court granted the appeal on the basis of the denial of justice pleaded by the plaintiff and referred the case back to the Federal Administrative Court.(1) Consequently, and taking into account the urgency invoked as well as the irrevocability of a disclosure of personal data, the Federal Administrative Court had to decide again on the adoption of provisional measures.
In a decision published on 27 October 2022, the Federal Administrative Court rejected the request for provisional measures on the grounds that there is currently no concrete risk of outsourcing the appellant's personal data to a foreign public cloud. The court argued that, as the entire project is only at the implementation stage and no actual outsourcing is planned at this time, the urgency required to grant injunctive relief is lacking and the request must be rejected. The Federal Administrative Court nevertheless suggests that provisional measures could be pronounced ex officio, during the appeal procedure on the merits, if the Federal Chancellery were to consider transferring the appellant's personal data to a public (foreign) cloud.(2)
This is a promising development. Indeed, absent further judicial developments, this should allow the implementation and deployment of the Public Clouds Confederation project to proceed.
For further information on this topic please contact Jürg Schneider, Hugh Reeves or Kilian Bosson at Walder Wyss by telephone (+41 58 658 58 58) or email ([email protected], [email protected] or [email protected]). The Walder Wyss website can be accessed at www.walderwyss.com.
Endnotes
(1) Federal Supreme Court decision 1C_216/2022 of 28 July 2022.
(2) Interim order of the Federal Administrative Court A-661/2022 dated 27 October 2022.