German Procurement Authority Rules US Data Transfers Unlawful for Government Contracts

A German procurement authority determined that reliance on US-based cloud services for government contracts constitutes an unlawful data transfer under the GDPR. This ruling extends the data transfer debate beyond privacy regulators into the procurement and government contracting sphere.

The Ruling

The procurement authority found that government entities cannot legally use cloud services that transfer data to the United States, given the inadequacy of current safeguards post-Schrems II. This applies to major US-based services including cloud infrastructure, productivity suites, and analytics platforms.

Why Procurement Matters

Public procurement decisions affect vast amounts of sensitive government data and set standards that often influence private sector practices. A procurement authority ruling against US cloud services creates practical barriers to their use in government contexts, regardless of whether privacy regulators have taken the same position.

Implications

This ruling signals that the GDPR data transfer issue affects not just privacy compliance but also government purchasing decisions, enterprise vendor selection, and the broader competitiveness of US-based cloud services in European markets. Organizations bidding for German government contracts must demonstrate that their technology stack does not involve unlawful data transfers.