The Generalitat will invest 481 million in a sovereign public cloud to guarantee digital autonomy

BarcelonaThe Generalitat activates the creation of a "sovereign public cloud" in Catalonia to strengthen Catalan digital autonomy. The executive of Salvador Illa has opened the tender for the contract this Tuesday, with an estimated total value of up to 481 million euros during the first eight years, although the objective is to "maintain it once this period has passed". The new infrastructure will allow hosting 40% of the Catalan administration's digital services and data to "comply with the highest level of European sovereignty achievable today". According to the Government's forecasts, the service will come into operation during the second half of 2027 and will be fully operational during the third quarter of next year. The Minister of the Presidency, Albert Dalmau, has highlighted the capacity of the new Catalan cloud to "protect and store" citizens' data and public services.

Currently, 80% of the Generalitat's services are hosted in a private cloud, which concentrates systems with "specific security or operational control needs". Others, which can benefit from the scale offered by general technology service providers, are in the public cloud, which stores 20% of the total volume.

The new infrastructure guarantees the necessary security and control standards for strategic services, but "maintains the same performance and innovation capabilities offered by public clouds". Once the sovereign public cloud is operational, 40% of the administration's data will be hosted there, which will initially correspond to sensitive public services, such as health or security. As for the rest, 30% will remain in a private cloud, and the other 30% will operate from a public cloud to "take advantage of its innovation and scalability capacity".

Without "third-party dependencies"

According to the Generalitat, the proposed sovereign public cloud model is "pioneering" in the European Union for its level of compliance with digital sovereignty standards. The Catalan infrastructure will be the first of its kind to achieve SEAL Level 3 of the European cloud sovereignty framework; that is, it is capable of guaranteeing that all data hosted there will be under European control.

Furthermore, the asset will be able to continue operating autonomously "in the face of possible third-party dependencies or external interruptions". In this way, the service provider of the new Catalan cloud will be "subject exclusively to European legislation"; an indicator that, according to the executive, becomes " a guarantee of trust, security and quality" for the data of the administration and citizens.

The new sovereign public cloud must be located in Catalonia, and will connect to the rest of the country's infrastructures to "guarantee information protection, service traceability and compliance exceeding applicable regulatory requirements". The project is part of the Generalitat de Catalunya's Technological Autonomy Strategy (ESTRATEC), along with other long-term digital initiatives, such as the artificial intelligence gigafactory in Móra la Nova, now close to final selection by the community institutions. According to the Government, the two infrastructures "mutually reinforce each other and configure a comprehensive model" of digital autonomy and technological competitiveness in the Principality.

Dalmau has framed the initiative within the European technological repositioning in the face of competition between the United States and China. For the minister, the sovereign cloud project "sends a message of forcefulness" from the Generalitat. In statements to the media, he assured that the executive "believes in data protection based on the parameters of European jurisdiction"; always with community technologies.

Landing the Catalan cloud

The cloud is an essential infrastructure for the functioning of the internet as we know it. This digital space is based on enormous data centers that process, store, and host the data of any application used online, from emails or instant messaging to artificial intelligence. It is, therefore, an indispensable tool for maintaining the activity of any organization, including public administrations.

However, in this area, dependence on foreign actors is almost absolute: according to data from the European Parliament, 70% of the community cloud computing market is in the hands of Google, Amazon, and Microsoft; and nearly 80% of the investment by the Twenty-Seven in these infrastructures flies to the United States. This link is particularly problematic due to US legislation for the cloud, the so-called CLOUD Act, which obliges service operators to hand over any data requested by their government, even if their physical servers are not located in the United States.

In this regard, the model proposed by the Generalitat "reduces the dependence on non-European external jurisdictions or operators"; as it obliges the contractor to be subject solely to the Union's regulation. Therefore, the Catalan sovereign cloud will be able to prevent foreign powers from accessing the data of critical activities of Catalan administrations and citizens when it suits them, without renouncing the technical advantages offered by the public cloud compared to private servers.