I remember the court case years ago when the US government wanted to access data in Azure that was physically stored in Ireland. I wrote lightly about this and linked to the article back in 2020. This has typically been more of a concern for the EU (and other countries) than the US, but I'm sure there are organizations in the US that use the cloud and don't want their data accessed by other countries' governments.

Recently, a Microsoft executive was asked about this in the French Senate. The Microsoft response was that they  (Microsoft) cannot guarantee data sovereignty for French customers. If the US government served a warrant under the Cloud Act, a US corporation would have to turn over the data.

While the Internet is fantastic in many ways, especially the ability to communicate and collaborate with others all around the world, we still have physical countries and governments. The rules, regulations, and more vary across different countries, but apparently, those rules aren't going to be enforced if the company doing business is based in the US.

This might be good for the US, but not for customers in other countries. In my mind, it's somewhat amazing that many other countries haven't had organizations build clouds that work inside their borders. I'm especially surprised the EU hasn't subsidized or assisted a company in growing as a cloud provider, though likely any organization that grew to a significant size was purchased by Amazon, Google, or Microsoft.

This access apparently hasn't happened to date, at least not in a way that is disclosed publicly. Proponents point out that this access would only be allowed with some level of evidence of a crime and a probable cause to access the data in question. That might be true, but we know from the past that a lot of government access to information is kept secret from public disclosure.

The longer I work with data, the more I find that few organizations truly care about data privacy and protection. They give lip service to the idea, and despite employees sometimes wanting to treat data with care, profit (or other) motivations often override other considerations. I've mostly given up on worrying about strong data protections and accepted a significant amount of my data is likely being used by more organizations than I'd like.