Hermann-Josef Haag, DSAG Board Member for Human Resources & Public Sector, is positive: "SAP Germany's move is clearly a first step towards a sovereign cloud for the public sector, which is already possible for selective processes."

© DSAG

The German-speaking SAP User Group (DSAG) has repeatedly pointed out that SAP must create a sustainable basis so that the public sector can actually use SAP personnel functions in the cloud. The software manufacturer has now taken a first step towards fulfilling this requirement: SAP Germany wants to establish a company together with a partner that will operate cloud locations based on the Microsoft Azure infrastructure in Germany, which will be used exclusively by the public sector.

According to SAP information, the new company will be the sole owner of the planned platform. The data centers and the existing public cloud infrastructure in Germany are to be operated independently of the global Microsoft data centers. SAP describes this as offering a sovereign cloud platform from both a legal and technical perspective. According to SAP, the cloud locations should also be suitable for operating S/4HANA in the cloud and other solutions at a later date - this also applies to non-SAP and non-Microsoft solutions. At the same time, public administration data centers are to be enabled to operate instances there themselves in the sense of a cloud broker model.

Diverse requirements for the cloud

From DSAG's point of view, the procedure is a big step in the right direction. "It is positive that something is happening and that our voice as users is being heard," says Hermann-Josef Haag. Overall, the requirements of public administration are diverse when it comes to the cloud. "Public administration faces challenges when it comes to data protection and, in particular, the issue of personal data," says Hermann-Josef Haag. This is because the processed personnel data is particularly worthy of protection under various state laws and also results legally from Section 50 sentence 3 of the Civil Servants Status Act (BeamtStG), which expressly regulates the confidential handling of personnel file data, and Art. 9 para. 1 GDPR, as special categories of personal data (e.g. health data) are also processed, at least in part.

Bridge to the cloud

The planned company is building a bridge for public administration on the way to the cloud. "The fact that data may not be transferred abroad was confirmed in July 2020 by the 'Schrems II' ruling of the European Court of Justice (ECJ). The new company would keep the data in Germany and the public administration could comply with the Schrems II requirements," explains Hermann-Josef Haag. The U.S. Cloud Act, which came into force in 2018, would also no longer play a role for the public administration in this way.

The U.S. Cloud Act stipulates that a provider is obliged to hand over stored data. It does not matter whether the data is stored at the provider or at another location. "It is sufficient that the provider has legal access to the data. It doesn't matter whether the data is located inside or outside the United States," says Hermann-Josef Haag. The EU, on the other hand, considers all personal data on its territory to be protected from access by third parties under EU law. The U.S. Cloud Act could be circumvented by those responsible for managing personal data in the cloud switching to a service provider in the European Union or in a country with an adequate level of data protection. "For public authorities, the location would again be limited to Germany. Furthermore, in view of the legal obligations of public administration, it is important to check whether the requirements for data protection and IT security in particular are met and whether personal data is only stored or processed in Germany and no data is transferred to other countries," says the DSAG board member.

A step in the right direction

From DSAG's point of view, it is now up to public administrations. They must decide whether they also want to move very sensitive processes to the cloud via the new offering. The expert assumes that this will initially require some time to rethink. Nevertheless, Hermann-Josef Haag is positive: "SAP Germany's initiative is clearly a first step towards a sovereign cloud for the public sector, which is already possible for selective processes." Overall, the interest group sees great potential in the SAP initiative. "The new offering could represent a breakthrough for the digitalization of public administration in Germany," Hermann-Josef Haag is certain. It not only provides access to the cloud, but also offers the opportunity to exploit the innovation potential of the technology in the long term. The new model is currently limited to Germany. Whether the model can also be replicated in smaller countries such as Austria and Switzerland must be evaluated separately.