Energy Efficiency Directive, SecNumCloud framework, CSRD... Data centers must comply with an extensive body of regulations. A close look at this sometimes little-known aspect of the data center ecosystem.
Like many companies in the IT sector, data centers are subject to a very extensive legislative environment. Energy efficiency, personal data protection, digital sovereignty, quality, safety and environment (QSE)... The applicable regulations have many facets.
The EED directive for energy efficiency
To see this, just look at the new version of the European Energy Efficiency Directive (EED, or DEE in French, for Directive sur l'efficacité énergétique). This revised version was adopted by the Council of the European Union on July 25, 2023 and officially published in the Official Journal of the European Union on September 20, 2023, eleven years after its initial version was published (2012) and five years after its first revision (2018).
Data centers with a total power above 1 MW will have to reuse their waste heat
Data centers are directly affected by the revised version of this regulation. In 2018, their energy consumption in the European Union amounted to 76.8 TWh. This figure is expected to reach 98.5 TWh by 2030, an increase of 28%. This increase in absolute terms can also be seen in relative terms: within the EU, data centers accounted for 2.7% of electricity demand in 2018 and will reach 3.21% by 2030 if the current trajectory continues, according to figures from the European Commission.
The EED provides that new data center installations or substantial renovations with a total power above 1 MW will have to reuse their waste heat, for example through a district heating network, unless this is technically or economically unfeasible. Waste heat is the thermal energy indirectly produced by the servers and other equipment in the data center.
Data centers with a power above 500 kW will also be required to report information on their energy performance to the public every year, starting in May 2024. This information will cover, among other things, floor area, installed power, energy consumption and waste heat utilization.
It is worth noting that members of the Climate Neutral Data Center Pact (CNDCP), a trade organization representing 90% of European data center operators, have committed to the European Commission to limit their water consumption to 400 ml of water per kWh of IT energy consumed by 2040.
The SecNumCloud framework at the heart of sovereignty issues
Another major issue for data center specialists is digital sovereignty, which raises concerns at both the national and international levels. A number of non-European laws, such as the Cloud Act or FISA (Foreign Intelligence Surveillance Act), can indeed pose risks to data hosted in data centers that use solutions provided by American companies.
Version 3.2 of the SecNumCloud framework provides protection against non-European laws
In France, the SecNumCloud framework, developed in 2016 by ANSSI, enables the qualification of cloud service providers, whatever their specialization: SaaS (Software-as-a-Service), PaaS (Platform-as-a-Service) and IaaS (Infrastructure-as-a-Service). It sets out a series of security rules that guarantee a high level of technical and operational requirements.
In its version 3.2, published in March 2022, this framework complies with European requirements on personal data protection. It takes into account the consequences of the "Schrems II" ruling by the Court of Justice of the European Union. This ruling reaffirmed the requirement to guarantee protection equivalent to that offered by the General Data Protection Regulation (GDPR) when personal data of European citizens is transferred outside the European Union. The framework also meets the requirements of the French government's "Cloud at the center" doctrine, which requires public administrations to use highly secure solutions to host sensitive data.
Note that the CNIL's decision to authorize hosting a health data warehouse (EMC2) on Microsoft's cloud has raised many concerns about the risk of US laws with extraterritorial reach being applied (Cloud Act, FISA / Foreign Intelligence Surveillance Act…). EMC2 is a European project led by the European Medicines Agency (EMA). It plans to use automated data processing to advance pharmacoepidemiological research.
NIS 2: stronger security requirements
The "Network and Information Security" directive, known as "NIS 1" (Network and Information System Security), which dates from 2016, will become NIS 2 in the second half of 2024. To counter increasingly effective hackers, it broadens its scope and introduces a proportionality mechanism that distinguishes two categories of regulated entities according to their level of criticality: essential entities (EE) and important entities (IE).
NIS 2 also extends the number of sectors covered. While the NIS 1 directive covered 19 sectors of activity, NIS 2 covers 35, including industry, agri-food, manufacturing and waste management. The companies targeted are those with more than 50 employees and annual revenue above €1 million.
NIS 2 also strengthens the penalties that can be imposed on entities that fail to comply with its rules. Fines can reach €10 million or 2% of worldwide annual revenue for EEs, and €7 million or 1.4% of worldwide annual revenue for IEs.
The CSRD to highlight non-financial information
The European CSRD directive (Corporate Sustainability Reporting Directive), applicable since January 1, 2024, sets new non-financial reporting obligations for large companies and listed SMEs. It succeeds the Non-Financial Reporting Directive (2014) and aims to harmonize the non-financial reporting of European companies.
The company data that falls within the scope of the CSRD is its ESG (Environmental, Social and Governance) data:
- Environmental data: climate change mitigation and adaptation, biodiversity, use of natural resources...
- Social data: equal opportunities, working conditions and respect for human rights and fundamental freedoms...
- Governance: role of administrative bodies, lobbying activities, management of relationships with business partners...
Discover the offering from PHOCEA DC, a provider of sovereign, eco-responsible data centers. Phocea DC is based in Marseille. Its data center covers 1,700 m² with 1.2 MW of power. Compliant with the Tier III standard, it will combine reliability and energy efficiency. Its hosting services are intended for local and national players: local authorities, businesses, telecom operators and managed service providers.
