Complicated situation for cloud services

Hi Pär, can you give us some background - what is the case?

- While public cloud computing offers significant benefits to the public sector, it also challenges established regulatory frameworks and raises questions about the security of different types of services. In particular, the question of whether US cloud services should be considered secure, given that US law can compel US companies to assist their authorities in certain criminal investigations, has been controversial. For example, the inter-agency group eSam issued a legal opinion in November 2018 stating that current legislation does not allow outsourcing of IT operations to companies outside the EU and, in particular, the United States. This lack of clarity has led to a hesitant public sector. Against this background, a government inquiry was set up at the end of 2019 to examine, among other things, the legal conditions for outsourcing IT operations in the public sector.

The investigation is delayed, what does this mean?

- That the legal situation remains unclear, which contributes to a slower digitization of the public sector. According to estimates made by the analysis company Radar on our behalf, the locked market has so far led to missed efficiency gains in the public sector equivalent to approximately SEK 4.6 billion(link to the report). It is therefore important that the inquiry produces legislative proposals that work in practice in the market and that further delays do not occur during the continued preparation of the inquiry's proposals.

What do IT&Telecom companies do?

- Our task is to drive the process of developing sustainable rules for outsourcing IT operations so that the market can function again as quickly as possible. An important part is to continue to participate in the investigation and ensure that they reach the goal with proposals that work for the industry. Much of the work is done in the Data Council, where we work with our member companies to develop our policy positions and meet various decision-makers. We are also out in the debate to highlight the costs that the lack of clear rules gives rise to.

Our debate article on unclear rules in the cloud computing market in Computer Sweden provoked a reaction. Some providers responded - is the industry divided on the issue?

- Yes indeed. But it should be remembered that the issue is also very complicated. Our approach is, of course, always based on what is good for the industry, the market and development as a whole. The important thing is that the rules of the game are clarified, something that both customers and suppliers want. Ambiguity comes at a high price. That was our point in the debate article. Companies also have slightly different views on which rules and which way forward is the best.

- Of course, we at IT&Telecomföretagen do not take a stand for one solution or company or another, but for a market-driven development and we know that the interaction in the market works better if customers and suppliers know the rules of the game. Then the various market players can be responsive to the varying needs that exist and contribute with different types of customized solutions. At the same time, I think that the industry is more united today than before. One reason for this may be that we have many companies participating in the Data Council's meetings, including several of those who signed the article, and that we have managed to develop a common industry position on outsourcing of IT services for the public sector, despite the division of opinion.

What will happen next?

- The inquiry will present interim legislative proposals on outsourcing in January. Hopefully, these will be good proposals that can help create more clarity in market conditions. Here, the industry's collective work aims to ensure that private suppliers are not excluded from the public market and we call for an adapted and clarified regulatory framework. Another piece of the puzzle is a proposal for a duty of confidentiality for private providers of IT operations services, which will be voted on in Parliament this fall. Whether it will be enough is unclear. What is clear, however, is that both the industry and the public sector need clearer rules that enable the industry to contribute its innovative and effective solutions while ensuring security and legal compliance.