study on the economic detriment to small and medium-sized ... · study on the economic detriment to...

[Written by EY] [November – 2018]

Justice and

Consumers

Study on the Economic

Detriment to Small and Medium-Sized Enterprises

Arising from Unfair and

Unbalanced Cloud Computing Contracts

Final Report

Study on the economic detriment to small and medium-sized enterprises arising from

unfair and unbalanced cloud computing contracts

EUROPEAN COMMISSION

Directorate-General for Justice and Consumers Directorate A: Civil and commercial justice Unit A2 – Contract Law Contact: Unit A2 E-mail: [email protected] European Commission B-1049 Brussels

EUROPEAN COMMISSION

Directorate-General for Justice and Consumers Directorate A: Civil and commercial justice

Study on the economic detriment to small and

medium-sized enterprises arising from unfair and

unbalanced cloud computing

contracts

Final Report

Study on the economic detriment to small and medium-sized enterprises arising from unfair

and unbalanced cloud computing contracts

This document has been prepared for the European Commission however it reflects the views

only of the authors, and the Commission cannot be held responsible for any use which may

be made of the information contained therein.

More information on the European Union is available on the Internet (http://europa.eu).

Print ISBN 978-92-79-45908-5 doi:10.2838/397707 DS-AU-15-001-EN-C

PDF ISBN 978-92-79-96750-4 doi: 10.2838/962608 DS-03-18-421-EN-N

© European Union, 2019

Printed by Imprimerie Central

The European Commission is not liable for any consequence stemming from the reuse of this publication.

Luxembourg: Publications Office of the European Union, 2019

© European Union, 2019 Reuse is authorised provided the source is acknowledged. The reuse policy of European Commission documents is regulated by Decision 2011/833/EU (OJ L 330, 14.12.2011, p. 39). For any use or reproduction of photos or other material that is not under the copyright of the European

Union, permission must be sought directly from the copyright holders.

Europe Direct is a service to help you find answers

to your questions about the European Union.

Freephone number (*):

00 800 6 7 8 9 10 11

(*) The information given is free, as are most calls (though some operators, phone boxes or hotels may charge you).

http://europa.eu/http://europa.eu.int/citizensrights/signpost/about/index_en.htm#note1#note1



1

CONTENTS

List of abbreviations ................................................................................................... 2

Glossary.................................................................................................................... 4

1 Introduction ........................................................................................................ 7

1.1 The importance of contract-related problems ..................................................... 7

1.2 Objectives and scope of the study .................................................................. 10

1.3 Structure of this report ................................................................................. 12

2 Research methodology ....................................................................................... 14

2.1 Overview of the approach ............................................................................. 14

2.2 Main limitations encountered ......................................................................... 35

3 Usage of cloud computing across EU SMEs: the state of play................................... 37

3.1 Cloud computing usage rate .......................................................................... 37

3.2 Types of cloud computing services contracted ................................................. 38

3.3 Types of contracts and relative costs .............................................................. 41

4 Contract-related problems encountered by SMEs ................................................... 46

4.1 Types and frequency of encountered problems ................................................ 46

4.2 The most serious problems encountered ......................................................... 49

4.3 Causes of the most serious problems encountered ........................................... 51

4.4 Actions taken by SMEs .................................................................................. 53

5 Consequences of the encountered problems .......................................................... 57

5.1 Qualitative assessment ................................................................................. 57

5.2 Quantitative assessment ............................................................................... 59

6 Impacts of the economic detriment ...................................................................... 72

6.1 Direct impacts ............................................................................................. 73

6.2 Indirect impacts ........................................................................................... 74

6.3 Other qualitative impacts of contract-related problems ..................................... 75

7 Conclusions ...................................................................................................... 77

Annex 1. Methodology for the Survey of SMEs ........................................................ 82

Annex 2. Stakeholders list .................................................................................... 84

Annex 3. Bibliography .......................................................................................... 86

Annex 4. Survey questionnaire.............................................................................. 90

Annex 5. SME Survey results .............................................................................. 101

Annex 6. Economic detriment – further results ...................................................... 114

Annex 7. Impacts on jobs and growth, detailed results .......................................... 136

Annex 8. Case study questionnaires by stakeholder type ........................................ 146

Annex 9. Case study analysis .............................................................................. 154



2

List of abbreviations

Acronym Description

CATI Computer Assisted Telephone Interviews

CT&C Contract terms and conditions

DG JUST Directorate-General Justice and Consumers

EC European Commission

EEN Enterprise Europe Network

EU European Union

EU13 Bulgaria, Croatia, Cyprus, the Czech Republic, Estonia, Hungary, Latvia, Lithuania, Malta, Poland, Romania, Slovakia and Slovenia

Eurostat Statistical Office of the European Communities

GDP Gross Domestic Product

GDPR General Data Protection Regulation

GE250 Large enterprises of more than 250 employees

GFD Gross Financial Detriment

GVA Gross Value Added

IaaS Infrastructure as a Service

IOS International Organization for Standardization

MS Member State

NFD Net Financial Detriment

PaaS Platform as a Service

PC Personal computer

PPP Purchasing power parity

R Value of any redress

SaaS Software as a Service

SLA Service level agreement

SLALOM Service Level Agreement ‐ Legal and Open Model

SMEs Micro, small and medium-sized enterprise



3

EU Member States

AT Austria

BE Belgium

BG Bulgaria

CY Cyprus

CZ The Czech Republic

DE Germany

DK Denmark

EE Estonia

EL Greece

ES Spain

FI Finland

FR France

HR Croatia

HU Hungary

IE Ireland

IT Italy

LV Latvia

LT Lithuania

LU Luxembourg

MT Malta

NL The Netherlands

PL Poland

PT Portugal

RO Romania

SE Sweden

SI Slovenia

SK Slovakia

UK The United Kingdom



4

Glossary

Term Definition Source

Active enterprise

An enterprise that had either turnover or employment at any time during the reference

period.

Eurostat

Cloud computing

A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (such as networks, servers, storage, applications, and

services) that can be rapidly provisioned and released with minimal management effort and

service provider intervention.

National Institute of Standards and Technology, The NIST Definition of Cloud Computing, 2011

Cloud Service

One or more capabilities offered via cloud computing, invoked by using a defined interface.

European Commission, Cloud service level agreement standardisation guidelines,

2014

Cloud service provider

A party which makes cloud services available. European Commission, Cloud service level agreement standardisation guidelines, 2014

Cloud service agreement

The Cloud Service Agreement or CSA is the main document which sets out the terms and conditions of the contractual relationship between

the provider and the user in relation to the provision of cloud services.

Slalom Project, Model contract for Cloud Computing, 2016

Data portability

Ability to easily transfer data from one system to another without being required to re-enter data.

It is the ease of moving the data that is the essence here. This might be achieved by the source system supplying the data in exactly the format that is accepted by the target system. But even if the formats do not match, the

transformation between them may be simple and straightforward to achieve with commonly available tools. On the other hand, a process of printing out the data and rekeying it for the

target system could not be described as ‘easy’.

International Organisation for Standardization, Information technology — Cloud computing — Overview and vocabulary, 2014

EU13 Bulgaria, Croatia, Cyprus, the Czech Republic, Estonia, Hungary, Latvia, Lithuania, Malta, Poland, Romania, Slovakia and Slovenia.

Eurostat

EU15 Austria, Belgium, Denmark, Finland, France, Germany, Greece, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Spain, Sweden and the

United Kingdom.

Eurostat

EU28 Belgium, Bulgaria, Czech Republic, Denmark, Germany, Estonia, Ireland, Greece, Spain, France, Croatia, Italy, Cyprus, Latvia, Lithuania, Luxembourg, Hungary, Malta, Netherlands,

Austria, Poland, Portugal, Romania, Slovenia, Slovakia, Finland, Sweden, United Kingdom.

Eurostat



5


Frequency

(F)

The frequency shows how often the mentioned problem appeared and it is measured on a scale from 1 to 4: 1 meaning ‘rarely’ (at least once in the last 12 months);2 meaning ‘occasionally’ (at least once every 3 months); 3 meaning ‘frequently’ (at least once a month); and 4 meaning ‘very frequently’ (at least once a week).

EY Survey of SMEs, 2018

Incidence

(I)

Number of SMEs that encountered the problem during 2016-2017/Number of SMEs that contracted at least one cloud computing service during 2016-2017.

EY Survey of SMEs, 2018

Infrastructure as a Service (IaaS)

The capabilities provided to the cloud-service customer include processing, storage, networks, and other fundamental computing resources where the cloud-service customer is able to deploy and run arbitrary software, which may

include operating systems and applications. The cloud-service customer does not manage or control the underlying cloud infrastructure, but does have control over operating systems, storage, and deployed applications, and possibly limited control of select networking components

(such as host firewalls).

European Commission, Cloud service level agreement standardisation guidelines, 2014

NACE Statistical Classification of Economic Activities in

the European Community

Eurostat

Purchasing power parity

(PPP)

The rate of currency conversion that equalises the purchasing power of different currencies by

eliminating the differences in price levels between countries. In its simplest form, PPP shows the ratio of prices in the national currency of the same good or service in different countries.

Eurostat

Platform as a

Service (PaaS)

The capability provided to the cloud-service

customer is to deploy onto the cloud infrastructure customer-created or acquired applications created using programming languages, libraries, services, and tools

supported by the cloud-service provider. The cloud-service customer does not manage or control the underlying cloud infrastructure

including network, servers, operating systems, or storage, but does have control over the deployed applications and possibly configuration settings for the application-hosting environment.

European Commission, Cloud

service level agreement standardisation guidelines, 2014

Service level agreement

A Service Level Agreement (SLA) is the service contract component between a service provider

and customer. An SLA provides specific and measurable aspects related to service offerings.

European Commission, Cloud service level agreement

standardisation guidelines, 2014



6


Software as a Service (SaaS)

The capability provided to the cloud-service customer to use the provider’s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (for example, web-based e-mail), or a programme interface. The user does

not manage or control the underlying cloud infrastructure, including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application

configuration settings.


Service availability

The property of being accessible and usable on demand by an authorised entity.

European Commission, Cloud service level agreement standardisation guidelines,

2014

Service performance

The problem faced by SMEs characterised by the difficulty in understanding the level of performance or the quality of services that has been promised in the contract.


SMEs The category of small and medium-sized enterprises (SMEs) includes enterprises which employ fewer than 250 persons and which have

an annual turnover not exceeding €50 million, and/or an annual balance sheet total not exceeding €43 million.

Within the SME category, a small enterprise is defined as an enterprise which employs fewer than 50 persons and whose annual turnover and/or annual balance sheet total does not exceed €10 million.

Within the SME category, a microenterprise is defined as an enterprise which employs fewer

than 10 persons and whose annual turnover and/or annual balance sheet total does not exceed €2 million.

Commission Recommendation of 6 May 2003 concerning the definition of micro, small and

medium-sized enterprises (notified under document number C(2003) 1422)

Virtual Data Centre

A pool or collection of cloud infrastructure resources specifically designed for enterprise business needs. The basic resources are the

processor (CPU), memory (RAM), storage (disk space) and networking (bandwidth). It is a virtual representation of a physical data centre, complete with servers, storage clusters and many networking components, all of which reside in a virtual space being hosted by one or more actual

data centres.

Altman & Alt, A Digital Library for the Dissemination and Replication of Quantitative

Social Science Research: The Virtual Data Centre, 2001



7

1 Introduction

This report represents the final deliverable responding to the request for services

JUST/2016/RCON/FW/CIVI/0176 (2017/03) concerning a Study on the economic

detriment to small and medium-sized enterprises arising from unfair and

unbalanced cloud computing contracts. The Request for service was issued by the

European Commission, Directorate-General Justice and Consumers (DG JUST), Unit A2 -

Contract Law.

1.1 The importance of contract-related problems

Cloud computing has been credited with increasing competitiveness through cost reduction,

greater flexibility and optimal resource utilisation.1 By using cloud computing services,

enterprises are only paying for the amount of storage they are actually consuming and are

not responsible for the daily maintenance of the storage infrastructure.

Demonstrable tangible economic benefits have been estimated in 2011. A report published

by the European Commission ‘Quantitative Estimates of the Demand for Cloud Computing in

Europe and the Likely Barriers to Up-take’2 identified as main benefits: the lower IT costs,

more effective mobile working, higher productivity, standardisation of processes, better ability

to enter new business areas, and the ability to open up in new locations.

All in all, increasing the usage of cloud computing can have a relevant impact in terms of

increasing EU Gross Domestic Product (GDP) by up to €250 billion and creating 3.8 million

jobs by 2020 compared to 2012.3

While the list of the above benefits is not exhaustive, it certainly provides a perspective on

the potential economic advantages of the usage of cloud computing compared to more

traditional alternatives such as on-premises information technology infrastructure.4

1 Rittinghouse, J., Ransome, J. (2009), Cloud Computing, Boca Raton, CRC Press, USA. 2 Based on a 2011 survey conducted on 479 enterprises already using cloud computing for their businesses, 81% reported lower IT costs with a 10% to 20% reduction being typical, but 12% reported

savings of 30% or more. Business benefits included more effective mobile working (46%), higher

productivity (41%), more use of standard processes (35%), better ability to enter new business areas (33%) and the ability to open up in new locations (32%). European Commission (2012), Quantitative Estimates of the Demand for Cloud Computing in Europe and the Likely Barriers to Up-take, SMART 2011/0045, Brussels. 3 European Commission (2012), Quantitative Estimates of the Demand for Cloud Computing in Europe

and the Likely Barriers to Up-take, SMART 2011/0045, Brussels. 4 Traditional on-premises infrastructures consist of various pieces of hardware, such as desktop computers, which are connected to a network via a remote server. This server is typically installed on the premises of an enterprise, and provides all employees using the hardware with access to the company’s stored data and applications. Enterprises with this type of information technology model must purchase additional hardware and upgrades in order to scale up their data storage and services to support more users. Mandatory software upgrades are also required with traditional information

technology infrastructure to ensure that failsafe systems are in place to in case a hardware failure occurs. For many enterprises with information technology data centres, an in-house information

technology department is needed to install and maintain the hardware.



8

However, Eurostat data indicate that in 2016 only 21% of EU small and medium-sized

enterprises (SMEs, i.e. 10 – 250 employees) bought cloud computing services used over the

internet,5 mostly for hosting their e-mail systems and electronically storing files.

If micro enterprises (i.e. 1 – 9 employees) are considered, Eurostat data are available only

for few countries (the United Kingdom, Slovakia, Sweden, Portugal and Spain). For these

countries the percentage of micro enterprises that were buying cloud computing services used

over the internet in 2016 was around 11%.

With regard to the main factors affecting the adoption of cloud computing, in most

sectors, enterprises reported6 that insufficient knowledge of cloud computing prevented them

from using it (Figure 1). Expertise and sufficient knowledge of contractual and legal aspects

and the details of technical implementation are necessary prerequisites for an enterprise in

deciding to purchase cloud computing services. In addition, the risk of a security breach was

a key consideration for enterprises: the concern over the risk of a security breach scored

highest for both large enterprises and small and medium-sized enterprises (SMEs) (57%

and 38% respectively).7

Figure 1: Factors that limit cloud use

Source: Eurostat (2016)

Clearly, enterprises attach importance to the protection of their information technology

systems, but the issue can be seen in the wider context of resilience to possible security

breaches when using the cloud. Therefore, from the enterprises’ point of view (regardless of

their size), the risk of a security breach may be a matter of service providers’ liability and

accountability, as well as a technical issue.

A study commissioned by the Commission8 looked at the main contractual issues that are

of particular interest in a cloud context: description of the service and Service Level

Agreement (SLA), acceptable-use policy, data protection and disclosure of personal data,

intellectual property and other proprietary rights and duties over content, warranties, direct

and indirect liability, indemnification for third party claims, the effect on data preservation of

contract termination, modification of the contract terms and conditions (CT&C) and security,

protection of data and loss of data.

5 Eurostat data consider all enterprises with the exception of those in the financial sector, consulted in April 2018. 6 Eurostat, Cloud computing - statistics on the use by enterprises, Brussels. 7 Ibidem. 8 European Commission (2015), Comparative Study on Cloud Computing Contracts, Publications Office

of the European Union, Luxembourg.

http://appsso.eurostat.ec.europa.eu/nui/submitViewTableAction.dohttps://ec.europa.eu/eurostat/statistics-explained/index.php/Cloud_computing_-_statistics_on_the_use_by_enterprises



9

The Commission acknowledged the role of cloud contracts, notably in relation to data

portability,9 as ‘contracts often exclude, or severely limit, the contractual liability of the cloud

provider if the data is no longer available or is unusable, or they make it difficult to terminate

the contract’.10

Contract-related problems have been addressed by the Commission through various

initiatives.

Firstly, in 2013 the Commission set up an Expert Working Group on Cloud Computing

Contracts11 to work on identifying safe and fair contract terms for cloud computing services

with a view to addressing concerns of consumers and enterprises.

Secondly, specific actions have been taken forward on business-to-business cloud computing

contracts beyond the legislative field, including:

the work of the European Cloud Partnership and the ISO (International Organization

for Standardization) towards the standardisation of cloud SLAs;

the SLA standardisation guidelines prepared in June 2014 by the Cloud Select Industry

Group on Service Level Agreements Subgroup (C-SIG SLA);12

the ‘Service Level Agreement Legal and Open Model’ (SLALOM) project13 funded under

the Horizon 2020 Framework Programme, which delivered a set of common legal

clauses to cover cloud SLAs and contracts and a standard technical SLA specification.

Finally, in April 2016 the Commission gave a new impetus to its work on cloud computing by

adopting the Communication on the European Cloud Initiative - Building a competitive

data and knowledge economy in Europe14 where further complementary actions under the

Digital Single Market strategy covering cloud contracts for business users and switching of

cloud services providers have been announced.

Thus, over recent years, the Commission has adopted a true European Cloud Computing

Strategy aimed at removing barriers to cloud computing. Additionally, work is under way

towards a Code of conduct on switching and porting cloud data and services.

A further development of this topic is represented by the ‘Proposal for a Regulation of the

European Parliament and of the Council on a framework for the free flow of non-personal data

in the European Union’, launched in 2017.15

The objective of this proposal is to unlock the potential of the EU data market. In order to do

so, the proposal aims to address the following issues:

9 Please see the Glossary for further information. 10 European Commission (2012), Unleashing the Potential of Cloud Computing in Europe, COM(2012)529 final, Brussels. 11 The Group has been set up within the framework of the Commission Communication (2015) ‘A Digital

Single Market Strategy for Europe’, which aims at enhancing trust in cloud computing services and unlocking its potential for boosting economic productivity in Europe. 12 European Commission (2013), Cloud Select Industry Group on Service Level Agreements, accessed 01 May 2018. 13 The SLALOM project, accessed 1 May 2018. 14 European Commission (2016), European Cloud Initiative - Building a competitive data and knowledge economy in Europe, COM(2016) 178 final, Brussels. 15 European Commission (2017), Proposal for a Regulation of the European Parliament and of the Council on a framework for the free flow of non-personal data in the European Union, COM(2017) 495 final,

Brussels.

https://ec.europa.eu/digital-single-market/en/cloud-select-industry-group-service-level-agreementshttp://slalom-project.eu/



10

improving the mobility of non-personal data across borders in the Single Market,

which is limited today in many Member States by localisation restrictions or legal

uncertainty in the market;

ensuring that the powers of competent authorities to request and receive access to

data for regulatory control purposes, such as for inspection and audit, remain

unaffected; and

making it easier for professional users of data storage or other processing services to

switch service providers and to port data, while not creating an excessive burden on

service providers or distorting the market.

The impact assessment study16 that accompanies the legislative proposal addresses barriers

such as the legislative and administrative localisation restrictions; data localisation driven by

legal uncertainty and the lack of trust in the market which is considered to inhibit data

mobility. The impact assessment identifies as a preferred option a policy that would enhance

legal certainty, maintain the current levels of security of data storage and processing and that

would rely on self-regulation by industry through the development of codes of conduct for

facilitating switching between providers and, finally, that would positive economic effects,

resulting in lower compliance costs for cloud service providers. The study took into

consideration that actions at the Member State level would not be able to achieve the legal

certainty necessary for conducting this type of business across the EU, or to remedy the lack

of trust that is slowing the development of a thriving data storage and/or processing sector.

It is presumed that an EU intervention would contribute to further development of secure data

storage capacity for the entire EU.

1.2 Objectives and scope of the study

Objectives

The study’s main objective is to deliver the necessary evidence to support the Commission

in its assessment of the need for, and extent of, any further EU efforts to increase SMEs’ trust

in cloud services and allow them to bring in the full potential benefits of these types of

services.

The main specific objectives of the study are:

to identify the prevalence, nature, scope and scale of the contract-related problems

that SMEs encounter in relation to cloud computing services;

to analyse whether and to what extent enterprises are able to protect themselves

against problems, for example by means of enforcement of rules on business-to-

business unfair contract terms (where they exist);

to quantify the financial detriment as well as the detriment arising from time loss and

consequential damages (such as business interruption) suffered by SMEs in relation

to the contract-related problems encountered;

to complement the quantitative measurement with a qualitative assessment of the

detriment suffered by SMEs;

to model (in quantitative terms) the impact on growth and jobs of the quantified SME

detriment identified and provide a qualitative evaluation of the overall impact of the

problems encountered by SMEs in terms of market functioning/failures and

competitiveness.

16 European Parliament (2017), Commission Staff Working Document, Impact Assessment

Accompanying the document, Proposal for a Regulation of the European Parliament and of the Council on a framework for the free flow of non-personal data in the European Union, SWD(2017) 304 final, Brussels.



11

Scope

Cloud computing services covered

The study covers the cloud computing services most commonly used by SMEs, taking into

account: i) the general delivery models used by the provider, i.e. Infrastructure as a Service

(IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS);17 ii) the core

categories of cloud services available in the market.

The study covers cloud computing services provided both in exchange for money and provided

free of charge (i.e. not provided in exchange for a monetary counter-performance).

Contract-related problems encountered by SMEs

The study investigates the prevalence, nature, scope and scale of:

problems in relation to the conformity of the service with the contract;

problems with unfair CT&C;

problems in exercising the user's rights to remedies for non-conformity of the

service with the contract.

Territorial scope

The study assesses the contract-related problems faced by SMEs in all EU28 Member States.

Timeline

The study covers the usage of cloud computing services by EU SMEs over the period 2016 –

2017.

Stakeholders

The following categories of stakeholders are covered:

EU SMEs that contracted cloud computing services over the period 2016 – 2017;

cloud computing providers;

cloud computing brokers;

National authorities competent in fields related to cloud computing (such as data

privacy protection, personal data processing and data security);

the National SMEs Envoys Network;18

Chambers of Commerce;

the Enterprise Europe Network (EEN);19

SMEs associations.

Please refer to Annex 2 for the full list of stakeholders.

For the purpose of this study and in order to make the present report more intelligible

whenever the term SMEs is used in the text, it refers to:

medium-sized enterprises defined as enterprises which employ fewer than 250

persons (50-249) and whose annual turnover and/or annual balance sheet total does

not exceed €50 million;

17 See the Glossary for the definition of these terms. 18 The network of national SME Envoys was set up in 2011 as part of the review of the Small Business Act (SEC(2008) 2101). Each EU country has nominated a national SME Envoy to complement the role of the EU national SME Envoy who chairs the network. The group of national SME Envoys makes up an SBA advisory group that promotes SME friendly regulation and policy making in all EU countries. More

information is available at http://ec.europa.eu/growth/smes/business-friendly-environment/small-

business-act/sme-envoys_en. 19 The Enterprise Europe Network helps businesses innovate and grow on an international scale. It is the world’s largest support network for SMEs with international ambitions.

https://een.ec.europa.eu/



12

small enterprises defined as enterprises which employ fewer than 50 persons (10-

49) and whose annual turnover and/or annual balance sheet total does not exceed

€10 million;

micro enterprises defined as enterprises which employ fewer than 10 persons and

whose annual turnover and/or annual balance sheet total does not exceed €2 million.

1.3 Structure of this report

The report is structured as follow:

Chapter 1 recaps the objectives and the scope of the study and provides information

about the background of the study that justified the request for service;

Chapter 2 presents the methodological framework and the main limitations

encountered. Chapter 3 covers the findings related to:

- the usage of cloud computing among EU SMEs over the period 2016-2017 and

the reasons for the limitations of the use of cloud computing;

- types of cloud computing services that were contracted by SMEs

(complexity of the subscribed cloud computing packages, the frequency of the

number of contracted services and the services contracted by SMEs size);

- types of cloud computing contracts and relative costs, including the

negotiability of contract terms and conditions (CT&T).

Chapter 4 is dedicated to the analysis of contract-related problems encountered

by SMEs, specifically types and frequency of encountered problems and actions taken

by SMEs to address these problems;

Chapter 5 presents a qualitative assessment of the consequences faced by SMEs due

to contract-related problems. These refer to:

- negative effects on the business activity (i.e. loss of turnover or profit, loss of

clients and/or reputation damages);

- extra work done with internal or external resources while trying to resolve the

encountered problems;

- legal actions taken to exercise the user's rights to remedies for non-conformity

of service.

Where possible these consequences have been quantified and monetised in order to

assess the economic detriment suffered by SMEs.

Chapter 6 is dedicated to the impacts of the economic detriment. The analysis

concerns:

- direct impacts, meaning the Gross Value Added (GVA) and employment

contents of the turnover lost by SMEs that are affected directly by the contract-

related problems;

- indirect impacts in the supplier sectors.

This chapter also discusses (in qualitative manner) impacts on market functioning and

competitiveness;

Chapter 7 presents the conclusions of the overall analysis:

Annexes, including the following:

- methodology for the survey of SMEs;

- the list of stakeholders that have been involved in the case studies;

- bibliography of consulted and relevant documents;

- survey questionnaire used for conducting the survey of SMEs;

- results of the survey of SMEs;

- further results of the economic analysis;



13

- detailed results of the impacts on jobs and growth;

- case study questionnaires by stakeholder type;

- case study interviews and webinars analysis.



14

2 Research methodology

2.1 Overview of the approach

The study envisaged three main Tasks:

Task 0 – Preparatory task. Defining the methodological framework and the topics

to be investigated during the research, as well as defining the standards and tools to

be used.

Task 1 - Survey of SMEs. Conducting an online survey on a representative sample

of SMEs and start-ups, which are using cloud computing for the purposes of

conducting their business.

Task 2 - Economic detriment. Quantification of the overall economic detriment

sustained by SMEs in relation to the problems identified under Task 1. Based on these

results, the impact on growth and jobs and on the economy as a whole has been

measured.

Figure 2 provides an overview of the approach followed, synthesising the main activities,

objectives, and methods/tools.

Figure 2: Overview of the project Tasks



15

Task 0 – Preparatory Task

This Task envisaged undertaking desk research that allowed the team to clearly define the

methodological framework of the study in terms of:

cloud computing services commonly used by micro, small and medium-sized

enterprises;

potential contract-related problems that may be encountered while using cloud

computing;

problem definition, which provides an overview of the main causes and effects of the

identified problems. It was used to:

- better understand the context in which the problems occurred;

- identify the intermediate effects and the main drivers;

- structure the data collection tools (i.e. questionnaires for Computer Assisted

Telephone Interviews [CATI] and the online survey);

selecting a sample of countries and sectors to be analysed in depth in order to achieve

the project objectives. The sampling strategy included:

- the identification of a sample of Member States (MS) and economic sectors to

be analysed in depth;

- the definition of a target for a representative sample of micro, small and

medium-sized enterprises to be addressed through the survey under Task 1;

- ensuring representativeness of the sample size.

Table 1 provides the list of cloud computing services identified under Task 0.

Table 1: Cloud computing services commonly used

Cloud computing

model

Cloud computing services

Details

SaaS Business applications

Applications used for: accounting, invoicing, planning, payments, payroll, human resources management

Collaboration and communication services

Video conference system, business visualisation technology,

instant communications applications, e-mail account, virtual desktop, antivirus for server or PC, applications for customer relationship management, social media monitoring

Service and support tools

Project and portfolio management solutions, services operations management

Big data Business intelligence and data analytics applications

Networking services Creation of an internal private cloud and virtual local networks, utilising a pooled server for storing enterprise data and running applications needed each day

Security services Secure content management, end point protection, malware

protection

PaaS Sales and marketing services

Web configuration forms for marketing and sales purposes

Cloud enablement and information

technology operations

Application integration and monitoring, business process management, information technology operation/risk

management

Data management Data/content management



16

Cloud

computing

model

Cloud computing services

Details

Mobile Usage of managed mobility to serve a multitude of mobile devices anywhere, anytime

Platform to create

software applications

Conception and creation of applications, through testing and

deployment

Internet of things Asset tracking, deployable components, intelligent spaces

IaaS Storage and hosting services

Server platform for online storage, sharing, hosting web-sites, files, images and similar content

Virtual data centre Usage of a pool of virtualised infrastructure as processor,

memory, storage space and networking components

High performance computing

Usage of high performance computing clusters, workloads and applications

Source: EY desk research20

The following potential contract-related problems have been identified:

lack of timely updates of the cloud service;

forced updates to the service that eliminated or changed a necessary function;

unsatisfactory amount of data that could be processed;

failure of the cloud provider to identify, analyse, and correct hazards and to prevent

future re-occurrences (incidence management);

low speed of the service;

unsatisfactory availability or discontinuity of the service (due to a crash, unannounced

maintenance or other interruptions of service);

unsatisfactory number of users that could access the service;

lack of compatibility of the service with user hardware or software;

limited data portability;

limited data retrievability;

extra costs imposed for data portability;

data deletion upon contract termination;

destruction or loss of data;

loss or alteration of data transmitted, stored or processed via the cloud service;

unauthorised disclosure of, or access to data;

lack of protection of the data stored in the cloud against theft or viruses;

lack of clarity and completeness of the instructions and information regarding access

and/or download of the cloud service;

unilateral modification of the service/contract by the cloud provider;

limited liability of the cloud provider;

termination of the contract and interruption of the service by the service provider with

no or little prior notice to the user;

lack of clarity and transparency of CT&C.

Based on the results of desk research the team finalised the methodological approach that

included: the definition of the problem tree to clearly understand the links between problems

encountered by enterprises and possible consequences; the preparation of the data collection

tools, including the questionnaires for the survey of SMEs and the case study template.

20 The bibliography serving as basis for the desk research can be found in Annex 3.



17

Additionally, desk research revealed that cloud computing users may encounter the following

problems in exercising their rights to remedy the non-conformity of service with the

contract:

absence of a contact point to make a complaint or attempt to resolve issues;

length and high cost of the procedure;

applicability of foreign jurisdiction;

language difficulties;

impossibility to enforce the decision after the resolution.

The problem definition was structured around the above-mentioned key contract-related

problems and their short- and long-term effects. Essentially, the problem definition allowed

the team to:

identify the main/-core problems and the underlying causes;

identify who and what is affected and to what extent;

foresee the possible evolution of the problems identified.

Following the problem definition, a problem tree (Box 1) was structured in order to summarise

the identified problems and related causes, as well as the links between them.

Box 1: Definition of the problem tree

A problem tree or “hierarchy of problems” is useful in providing an overview of the main causes and effects of the identified problems. It is used to better understand the context in which the problems occur, what the intermediate effects and the main drivers are.

The analysis performed during the creation of a problem tree aims at identifying the real bottlenecks

to which stakeholders attach a high priority and which they wish to overcome. A clear problem analysis thus provides a sound foundation on which to develop a set of relevant and focused project objectives.

A problem tree analysis begins with the establishment of the core problem. Using desk research, the problem can be formulated in a more specific way. Once the core problem has been identified, we consider the direct causes and effects of the problem. Each cause statement is written in negative terms. These items should respect the MECE principle, in that they should be Mutually Exclusive and Collectively Exhaustive. In many respects the problem analysis is the most critical stage of project

planning, as it then guides all subsequent analysis and decision-making on priorities.

Once complete, the problem tree represents a summary picture of the existing negative situation that can be further used by the decision makers in order to analyse the objectives, by reversing the negative statements into possible solutions, and then choose the most appropriate solution to be implemented.

Source: European Commission - Aid Delivery Methods (Vol 1: Project Cycle Management Guideline)

Among the most important sources of information that helped in refining the problem tree,

especially with regard to the contract-related problems, were:21

European Commission (2012), ‘Unleashing the Potential of Cloud Computing in

Europe’, COM(2012)529 final, Brussels;

Cloud Computing Experts Groups meetings 2013-2014;

Cloud Service Level Agreement Standardisation Guidelines from 24 June 2014;

European Commission (2015), ‘Comparative Study on cloud computing contracts’;

European Commission (2016), ‘Study on measuring the economic impact of cloud

computing in Europe’;

European Commission consultations about Cloud Computing (2016);

IDC (2016), ‘Switching of Cloud Services Providers’;

Eurostat (2016), ‘Cloud computing - statistics on the use by enterprises and Business

Structure Statistics’;

21 The results of the survey of SMEs, as well as the case study results have been used in order to update the problem tree.



18

European Commission (2017) ‘Final results of the European Market study measuring

the size and trends of the EU data economy’;

European Commission (2017), ‘Proposal for a Regulation of the European Parliament

and of the Council on a framework for the free flow of non-personal data in the

European Union’;

European Parliament (2017), Commission Staff Working Document, Impact

Assessment Accompanying the document, ‘Proposal for a Regulation of the European

Parliament and of the Council on a framework for the free flow of non-personal data

in the European Union’.

Figure 3 illustrates the problem tree that was created based on the study’s desk research.

The drivers of cloud computing problems are acknowledged in the different sources of

information consulted such as the Digital Single Market strategy. This strategy identifies

concerns related to ‘security, compliance with fundamental rights and data

protection’22 as a result of technical and legislative barriers.

Moreover, the fragmentation of regulation across the EU could be a factor that limits the

usage of cloud computing due to the need for large providers to adapt their services to each

country’s laws that regulate cloud computing.23

A lack of fairness and balance in CT&C is considered a driver as ‘contracts often exclude,

or severely limit, the contractual liability of the cloud provider’.24 By the same token,

the unilateral modifications of the contract and the difficulties in exercising the user’s

rights are problems arising from the unfairness of CT&C. Moreover, when targeting SMEs,

‘the contract is likely to be a take it or leave it contract’.25

The limited technical knowledge among SMEs is also a factor affecting the emergence of

the different problems shown in Figure 3. The limited technical knowledge of the users has

been considered when creating a Cloud Select Industry Group in Service Level Agreements

Subgroup.26 This subgroup worked towards the development of standardisation guidelines

between cloud providers and cloud customers and these efforts coincide with complementary

action under the Digital Single Market strategy.

The mentioned contract-related problems lead to a loss of business opportunities. Within one

of the Expert Group Meetings it was concluded that an uninformed choice of terms and

conditions may lead to damages.27 Other experts28 have stated that ‘certain losses are

potentially huge and cannot be compensated’.29 The present study tested the hypothesis that

contract-related problems may lead to losses of profit, turnover, clients and reputation

damage for SMEs over the short term. Over the long term, such problems can have a

negative impact on growth and jobs.

Over time, the lack of awareness of the benefits of cloud computing limits its usage and can

deter businesses from tapping into the full potential of the cloud. Over the long term this

could also have a negative effect on GDP and jobs creation. Although this scenario was

22 European Commission (2015), A digital Single Market Strategy for Europe, COM(2015) 192 final,

Brussels. 23 Ibidem. 24 Ibidem. 25 European Commission (2013), Cloud Select Industry Group on Service Level Agreements, accessed 01 May 2017. 26 Expert Group Meeting on Cloud Computing Contracts, Synthesis of the meeting of 29/30 January 2014. 27 Ibidem. 28 Expert Group Meeting on Cloud Computing Contracts, Synthesis of the meeting of 9/10 April 2014. 29 For example due to the unavailability of the service.

https://ec.europa.eu/digital-single-market/en/cloud-select-industry-group-service-level-agreements



19

included in the problem tree, it is not the purpose of this study to examine these larger

macroeconomic impacts.30

The problem tree allowed the team to gain an understanding of the main issues to be

investigated within the study and for which evidence from stakeholders was needed.

This understanding was reflected in the data collection tools. These included:

The Survey questionnaire: The structure of the survey questionnaire31 reflected the

different layers of the problem tree. It first focused on the usage of cloud computing

and the types of contracts SMEs tend to sign, corresponding to the drivers section.

Furthermore, it addresses the problems that SMEs encounter, the actions taken in

order to resolve them and the associated economic detriment32 in order to provide

information for the problems and short-term effects sections of the tree.

Interview guidelines for case studies and webinars: Findings from the interviews and

the webinars were used to complement the quantitative analysis with detailed

information on the contract-related problems and the costs sustained by SMEs while

trying to resolve the encountered problems

All collected information supported the estimations on the loss of GDP and the loss of jobs at

the EU level.

30 The European Commission estimated that cloud computing can increase EU GDP up to €250 billion and create 3.8 million jobs. More information available in European Commission (2011), Quantitative Estimates of the Demand for Cloud Computing in Europe and the Likely Barriers to Up-Take, SMART 2011/0045, Brussels. 31 Annex 4 presents the structure of the CATI and online questionnaire. 32 The sections B, C, D and E cover: use of cloud computing, problems encountered with cloud computing services, actions taken by the enterprise in order to address the most serious problem and the economic detriment related to the most serious problem encountered.

Study on the economic detriment to small and medium-sized enterprises arising from unfair and unbalanced cloud computing

contracts

20

Figure 3: Problem tree33

Source: EY desk research34

33 L/T stands for ‘long-term effects’ and S/T for ‘short-term effects’. 34 Annex 3 contains the bibliography serving as basis for the desk research.



21

Under Task 0, the team also defined the sampling strategy to select 12 MS, five economic

sectors to be investigated in depth as well as the sample size of SMEs to be involved in the

survey.

For the selection of the MS, three criteria were considered (Table 2). In particular, the

percentage of enterprises buying cloud computing services, as per 2016 Eurostat

statistics, was considered to be the best proxy variable35 available for the usage of cloud

computing and it has been used as one of the criteria for defining the sample of countries to

be analysed in greater depth:

Table 2: Criteria used for MS selection

Criteria for MS selection Details (Table 3) Source

Percentage of enterprises

buying cloud computing

services

Number of SMEs that

declared they bought at

least one cloud computing service in 2016 out of the total number of SMEs active in the MS

Data on cloud computing service

usage among SMEs Eurostat, 2017

[isoc_cicce_use]

Relevance of the country to the

study objectives

Number of SMEs that

declared they bought at least one cloud computing service in 2016 out of the total number of SMEs active in the EU28

Data on cloud computing service

usage among SMEs Eurostat, 2017 [isoc_cicce_use]

Structural Business Statistics, Eurostat, 2017 [sbs_sc_sca_r2]

Geographical balance Balanced number of EU15

and EU13 MS in the sample

N/A

Based on the above-mentioned criteria, the following 12 MS were selected: the Czech

Republic, Estonia, France, Germany, Ireland, Italy, Poland, Portugal, Romania, Sweden,

Spain, and the Netherlands (Table 3).

A high level of representativeness of the EU is ensured because the selected sample:

involves eight MS from the EU15 and four MS from the EU13;

refers to countries where more than 70% of the EU SMEs that bought at least one of

the cloud computing services in 2016 (Figure 4) were established.

35 A proxy variable is a variable that is used instead of the variable of interest when that variable of interest cannot be measured directly.

http://appsso.eurostat.ec.europa.eu/nui/show.do?dataset=isoc_cicce_use&lang=enhttp://appsso.eurostat.ec.europa.eu/nui/show.do?dataset=isoc_cicce_use&lang=enhttp://ec.europa.eu/eurostat/web/structural-business-statistics/data/database

Study on the economic detriment to small and medium-sized enterprises arising from unfair and unbalanced cloud computing

contracts

22

Table 3: SMEs buying cloud computing services, 2016

EU MS

A B C D E=B+D F=E/(A+C) E/Total EU28

EU15 /EU13

# of active enterprises with 10-250 employees

# of enterprises (10-250 empl.) buying CC services

# of enterprises with 1-9 employees

# of enter. (1-9 empl.) buying CC services 36

Total active SMEs

% (Country level)

% (EU28 level)

AT 40,393 6,462.88 280,850 31,959 38,422 11.96 1.37 EU15

BE 31,302 8,139 569,950 64,858 72,996 12.14 2.61 EU15

BG 26,991 1,619 298,559 33,975 35,594 10.93 1.27 EU13

CY n/a n/a n/a n/a n/a n/a n/a EU13

CZ 38,203 6,877 961,287 109,390 116,267 11.63 4.16 EU13

DE 411,527 61,729 1,985,471 225,938 287,667 12.00 10.29 EU15

DK 22,681 9,072 187,367 21,322 30,394 14.47 1.09 EU15

EE 6,439 1,417 61,513 7,000 8,416 12.39 0.30 EU13

EL 15,368 1,383 764,471 86,993 88,376 11.33 3.16 EU15

ES 125,000 21,250 2,337,621 116,881 138,131 5.61 4.94 EU15

FI 19,187 10,361 209,328 23,821 34,182 14.96 1.22 EU15

FR 139,335 22,294 2,765,282 314,677 336,970 11.60 12.05 EU15

HR 12,249 2,695 134,007 15,249 17,944 12.27 0.64 EU13

HU 30,852 3,394 504,904 57,456 60,850 11.36 2.18 EU13

IE 5,514 1,930 224,742 25,575 27,505 11.95 0.98 EU15

IT 182,182 38,258 3,497,783 398,032 436,290 11.86 15.60 EU15

LT 13,604 2,177 172,527 19,633 21,809 11.72 0.78 EU13

LU 3,939 670 27,841 3,168 3,838 12.08 0.14 EU15

LV 9,226 738 100,216 11,404 12,142 11.09 0.43 EU13

MT 1,885 509 24,123 2,745 3,254 12.51 0.12 EU13

NL 48,115 15,397 1,042,588 118,642 134,039 12.29 4.79 EU15

PL 69,282 4,850 1,534,086 174,572 179,422 11.19 6.42 EU13

PT 37,353 6,350 769,043 53,833 60,183 7.46 2.15 EU15

RO 50,987 3,569 405,493 46,143 49,712 10.89 1.78 EU13

SE 36,047 16,221 649,412 155,859 172,080 25.10 6.15 EU15

SI 6,912 1,382 127,603 14,521 15,903 11.82 0.57 EU13

SK 14,363 2,442 414,630 33,170 35,612 8.30 1.27 EU13

UK 199,528 65,844 1,734,989 312,298 378,142 19.55 13.52 EU15

Tot EU28

1,598,464 317,028 21,785,686 2,479,112 2,796,141 12 100

Selected Countries

Source: Eurostat (Cloud Computing Service [isoc_cicce_use], Structural Business Statistics [sbs_sc_sca_r2])

36 The percentage of micro enterprises (i.e. enterprises with fewer than 10 employees) that bought at least one CC service is only available for the United Kingdom, Slovakia, Sweden, Portugal and Spain. For the other EU countries, the average from those countries (11.38%) has been used.



23

Figure 4: The percentage of enterprises which bought cloud computing services in the

selected EU countries as compared to the total EU28 (2016)

Source: Eurostat (Cloud Computing Service [isoc_cicce_use], Structural Business Statistics

[sbs_sc_sca_r2])

For the selection of the economic sectors to be analysed in depth, Eurostat statistics on the

percentage of enterprises buying cloud computing services were used in order to

identify those sectors with the highest usage of cloud computing.

Eurostat statistics are available only for some sectors (Table 4) and only for the category 10

persons employed or more which also includes enterprises with more than 250 employees (i.e.

large enterprises, GE250).

However, Eurostat statistics have been considered to be relevant in selecting the sectors to be

analysed in depth as the number of enterprises with more than 250 employees represents a

negligible percentage of the overall number of active enterprises at the EU28 level (i.e. around

45,000 out of 23 million enterprises, corresponding to 0.2% of the total).

The sampling strategy envisaged the use of the same criteria used for the selection of MS (i.e.

percentage of enterprises buying cloud computing services; relevance of the sector to the

study objectives).

As a result, the five sectors selected included (grey rows in Table 4):

manufacturing (NACE37 code: C);

wholesale and retail trade; repair of motor vehicles and motorcycles (NACE code: G);

professional, scientific and technical activities (NACE code: M69-M74, hereinafter

referred to as M);

administrative and support service activities (NACE code: N);

information and communication (NACE code: J).

37 Eurostat, Nomenclature des Activités Économiques dans la Communauté Européenne, Brussels.

https://ec.europa.eu/eurostat/web/nace-rev2



24

Table 4: Economic sectors and usage of cloud computing services (2016)

NACE Code

Sectors

A B C = B/100 x

A C/D

# of active enter. (with

more than 10 empl.) at

EU28 level

% of enter. (with more

than 10 empl.)

buying CC services

# of enter. (with more

than 10 empl.)

buying CC services

% out of the total

C Manufacturing 364,432 17 61,953 23%

D+E Electricity, gas, steam, air conditioning and water supply

18,732 19 3,559 1%

F Construction 200,369 15 30,055 11%

G Wholesale and retail trade; repair of motor vehicles and

motorcycles

351,278 18 63,230 24%

H Transportation and storage 90,718 16 14,514 5%

I55 Accommodation 15,969 23 3,672 1%

J Information and communication

55,905 52 29,070 11%

L Real estate activities 10,661 24 2,558 1%

M Professional, scientific and technical activities

97,073 34 33,004 12%

N Administrative and support

service activities 121,657 22 26,764 10%

Total 1,326,794 21 268,384 (D) 100%

Selected Sectors

Source: Cloud computing services for 2016 (Eurostat [isoc_cicce_use]), Business Structure Statistics for 2015 (Eurostat [sbs_sc_sca_r2])

Although the financial and insurance activities sector (K under its respective NACE code) is

considered as one of the economic sectors with the highest usage of cloud computing,38 it has

been excluded because of its limited relative weight at the EU28 level.39

With the purpose of achieving statistically significant results, a target of 500 SMEs that

use cloud computing has been defined. This sample size has been chosen in order to ensure a

95% confidence interval and a maximum margin of error of 5% for all the estimates. The

sample target size, together with the random selection of the respondents, ensure that - with

a probability of 95% - the true values of a phenomenon (e.g. average incidence of cloud

computing problems) in the entire population (i.e. all EU SMEs) is equal to the average values

observed in the studied sample plus/minus the margin error.

The box below presents the methodology behind the definition of the sample size.

38 76% based on European Commission (2016), Measuring the economic impact of cloud computing in

Europe. 39 Based on the ‘Annual detailed enterprise statistics for services’ [sbs_na_1a_se_r2], it was observed that in 2015, for the respective financial and insurance activities, a total of approximately 14,000 enterprises were active in the EU28, that is 0.1% of the total active enterprises.

http://appsso.eurostat.ec.europa.eu/nui/show.do?dataset=isoc_cicce_use&lang=enhttp://appsso.eurostat.ec.europa.eu/nui/show.do?dataset=sbs_sc_sca_r2&lang=enhttp://appsso.eurostat.ec.europa.eu/nui/show.do?dataset=sbs_na_1a_se_r2&lang=en



25

Box 2: Definition of the size of the sample

The formula for computing the representative sample size is:

Sample size = [z2 *p(1-p)/e2]/[1 +( z2 *p(1-p)/e2N]

Where:

N= population size; e = margin of error (as a decimal); z = Z-score: constant value; e.g. 1.645 for a 90% confidence interval, 1.96 for a 95% confidence interval, 2.58 for a 99% confidence interval;

and p = average value of a specific indicator as observed in the population (as a decimal).

Our case:

From Table 3 we have

N= 2,796,141 is the estimated number of SMEs that are using CC services

e = 5%

Z = 1.96

P = when this value is not known conventionally is used the value 0.5

We can conclude that a target of 500 enterprise using CC services is appropriate to ensure a 95% confidence interval with a margin of error of 4.38%. When we put the confidence level and the confidence interval together, we can say that we are 95% sure that the true percentage of a phenomenon in the population is between +4.38% and -4.38% of the value observed in the studied sample. For example, if we ask a sample of 500 SMEs using CC if they encountered a certain problem,

and 70% say ‘Yes’, we can be 95% certain that between 65.62% and 74.38% of all EU SMEs using CC encountered the same problem.

Task 1 – Survey of SMEs

Task one was aimed at identifying:

the types of cloud services most frequently contracted;

the types of CT&C used to regulate the business relationships between users and

providers (for example, determining whether enterprises are able to negotiate CT&C

and/or to customise them to their needs);

the types, the incidence and the frequency of contract-related problems;

the types of actions taken by the enterprises in order to resolve the encountered

problems and the results of these actions.

The collection of data was based on a questionnaire (see Annex 8) submitted through two

complementary channels:

an online questionnaire (online Survey);

CATI.

The online questionnaire was translated into the official languages of the MS covered by the

study. Likewise, the CATI was conducted by native speakers in order to avoid language

barriers.

The online survey and the CATI have been developed, tested and conducted on a

representative sample of EU SMEs, which use the cloud for the purpose of conducting their

business.

In order to achieve the above presented target (i.e. 500 SMEs using CC services):

the contacts of 13,000 SMEs were identified during the design of the sampling strategy;

3,173 SMEs were reached within the 12 MS and the five sectors selected. Table 5

presents the distribution of the reached SMEs;



26

1,009 SMEs were willing to participate in the survey

Table 5: Distribution of SMEs reached per country and sector (# of respondents: 3,173)

Sector

Country

Admin. and support service

activities

Inform. and comm.

Manufact.

Profess. scientific

and technical activities

Wholesale

and retail trade

Total

CZ 13 17 62 30 52 174

EE 5 22 8 12 15 62

FR 184 129 262 126 308 1,009

DE 99 123 185 226 249 882

IE 4 18 6 6 13 47

IT 8 9 100 7 15 139

NL 36 49

24 37 146

PL 24 69 16 78 92 279

PT 7 2 9 2 24 44

RO 8 20 2 27 15 72

ES 7 11

26 21 65

SE 41 33 59 30 91 254

Total 436 502 709 594 932 3,173

Source: Survey of SMEs (2018)

Table 6 presents the participation rate per MS of the 1,009 SMEs that agreed to provide

information about their use of cloud computing.



27

Table 6: Participation rate by MS (# of respondents: 3,173)

Country

Number of

enterprises that expressed refusal

Number of enterprises

that were willing to participate in the survey

Total Participation

rate (%)

A B C = A + B B/C

CZ 131 43 174 25%

DE 33 158 191 83%

EE 715 29 744 4%

ES 724 54 778 7%

FR 16 294 310 95%

IE 24 31 55 56%

IT 97 115 212 54%

NL 152 49 201 24%

PL 11 127 138 92%

PT 48 33 81 41%

RO 11 24 35 69%

SE 202 52 254 20%

Total 2,164 1,009 3,173 32%


The study targeted all different size categories, the largest share of respondent being

represented by medium sized-enterprises (60%, Figure 5). Contrary to the SMEs distribution

at the EU level, the micro enterprises represented the smallest share of participants in the

survey. The smaller the size of the enterprise, the lower was its willingness to participate in

the survey.

Figure 5: Distribution of participants in the survey by SME size (# of respondents: 1,009)


The same applies to SME age: enterprises active for more than 10 years are better represented

in our sample as compared to younger enterprises (Figure 6). This reflects their willingness to

participate as well as the greater difficulties encountered in reaching younger enterprises.



28

Figure 6: Distribution of enterprises involved in the survey of SMEs by age (# of respondents:

1,009)


Task 2 – Economic detriment and impacts on jobs and growth

Consequences of encountered problems at the micro level

The economic detriment was quantified along the lines recommended in the Guidelines on

impact assessment of the Better Regulation toolbox40 based on data collected from Task 1 and

on data from Eurostat Business Structure Statistics.

The measurement of economic detriment41 considered a monetary assessment of the effects

of the problems faced by each SME in the survey and includes the following main dimensions:

the gross financial detriment (GFD) associated with the problems encountered;

the net financial detriment (NFD) associated with the problems encountered which

corresponds to the GFD associated with the problem encountered minus any remedies

offered by the cloud provider.

The GFD incorporated the following components:

𝐺𝐹𝐷 = 𝐿 + 𝐻𝑅 + 𝑂𝐶

Where:

L is alternatively the loss of turnover or profits as perceived by each SME;

HR is the costs of the human resources invested by each SME while taking action to

resolve or remedy the most serious encountered problem;

OC other costs declared by each SME. These include costs such as the costs related to

ensuring an alternative service, the costs related to fixing the cloud service problem

using external support, any legal costs, costs related to reputation damage and costs

related to loss of client(s), and other residual costs.

To allow for the measurement of the NFD, the value of any redress (R) offered by the service

provider for the damages caused to each SME as reported in the survey questions was

computed.

40 The Better Regulation Toolbox is a set of general guidelines that set out the principles that the European Commission follows when preparing new initiatives and proposals and when managing and evaluating existing legislation. In this study, those principles were considered generally as they were central in

defining the survey, the sample and also the methodologies to measure economic detriment and estimate

the impact on growth and jobs. 41 Measured using the principles put forward in European Commission (2017), Operational guidance document on measuring personal consumer detriment, Brussels.

https://ec.europa.eu/info/better-regulation-toolbox_enhttps://ec.europa.eu/info/publications/study-measuring-consumer-detriment-european-union_enhttps://ec.europa.eu/info/publications/study-measuring-consumer-detriment-european-union_en



29

The detailed procedure used to estimate the economic detriment at the EU28 level included

three main steps.

The first step was the computation of the following parameters from the survey with the 95%

confidence interval level and 5% margin of error:

the loss of turnover or profits perceived by each SME;

the costs of the human resources invested by each SME while taking action to resolve

or remedy the most serious problem;

the other costs covered by each SME while taking action to resolve or remedy the most

serious problem;

the value of any redress offered by the service provider for the damages caused to

each SME.

The second step required the definition of the number of enterprises affected by contract-

related problems (𝑁𝑝):

𝑁𝑝 = 𝑒𝑢 × 𝑒𝑝 × 𝐸

Where:

𝑒𝑢 is the proportion (i.e. the percentage) of enterprises that use cloud computing services;

𝑒𝑝 is the incidence (i.e. the percentage) of contract-related problems; E is the total number of active enterprises.

The incidence rates of contract-related problems (𝑒𝑝) by country and sector or country and size class, and the proportion of enterprises that use cloud-computing services (𝑒𝑢) by country and sector or country and size cannot be estimated from the sample with the 95% confidence

interval level and 5% margin of error, given that the sample is only representative at the EU

level overall.

In order to be able to estimate the total number of enterprises experiencing contract-

related problems by country and sector and by country and size class, an RAS-based42

procedure has been applied.

Box 3: RAS method for estimating the total number of enterprises experiencing contract-

related problems by country and sector

The RAS method is a well-known method for data reconciliation whose aim is to achieve consistency between the entries of some non-negative matrix and pre-specified row and column totals. Mathematically, the method is an iterative scaling method that can be applied in this case as we just

have non-negative matrices. We redistribute proportionally the differences arising from applying the EU level sectorial or size class incidence rates or from country incidence levels, considering in this

case as the binding constraint the country level incidence, which has been estimated with confidence from the sample (we ensure that the incidence per country is respected).

The procedure started with a preliminary estimation of the number of enterprises (𝑁𝑖𝑗𝑝)

experiencing contract-related problems in country i and sector or size class j using the following

formula:

𝑁𝑖𝑗𝑝 = (

𝑒𝑖𝑢 + 𝑒𝑗

𝑢

2) × (

𝑒𝑖𝑝 + 𝑒𝑗

𝑝

2) × 𝐸𝑖𝑗

42 See more information at https://ec.europa.eu/eurostat/cros/content/ras-method_en.

https://ec.europa.eu/eurostat/cros/content/ras-method_en



30

Where:

for countries included in our sample

- 𝑁𝑖𝑗𝑝 is the preliminary estimation of the number of enterprises experiencing cloud

computing problems in country i and sector or size class j;

- 𝑒𝑖𝑢 is the proportion of enterprises using cloud computing services in country i43

computed from the survey;

- 𝑒𝑗𝑢 is the proportion of enterprises using cloud computing services in sector or

size class j44 for all the countries in the sample;

- 𝑒𝑖𝑝 is the incidence of cloud computing problems in country i computed from the

survey;

- 𝑒𝑗𝑝 is the incidence of cloud computing problems in sector or size class j

computed from the survey for the whole sample;

- 𝐸𝑖𝑗 is the total number of enterprises in country i and sector or size class j,

extracted from the Eurostat Business Structure Statistics for 2015 (Eurostat

[sbs_sc_sca_r2]).

While for countries not included in the sample

- 𝑁𝑖𝑗𝑝 is the preliminary estimation of the number of enterprises experiencing cloud

computing problems in country i and sector or size class j;

- 𝑒𝑖𝑢 is the average proportion of enterprises using cloud computing services in all

countries of the sample computed from the survey;

- 𝑒𝑗𝑢 is the proportion of enterprises using cloud computing services in sector or

size class j45 for all of the countries in the sample;

- 𝑒𝑖𝑝 is the average incidence of cloud computing problems in all countries of the

sample as computed from the survey;

- 𝑒𝑗𝑝 is the incidence of cloud computing problems in sector/size class j computed

from the survey;

- 𝐸𝑖𝑗 is the total number of enterprises in country i and sector or size class j,

extracted from the Eurostat, Business Structure Statistics for 2015 (Eurostat

[sbs_sc_sca_r2]).

In practice, this formula takes the joint incidence by country and sector or by country and size

class to be the average of the two marginal incidences, which would be the case if the two

distributions were independent. In this way, it allows a preliminary estimation of the number

of enterprises experiencing cloud computing problems in country i and sector or size class j.

43 We use two alternative measures of incidence, allowing us to develop two scenarios. From the survey data, we compute the incidence by country and sector and country and size class considering the answers given by respondents in two alternative ways. In one case, we compute the incidence as the ratio of

those enterprises that declared they are using cloud computing to all enterprises contacted that declared they are either using or not using cloud computing or that refused to respond to the survey based on criteria that can be seen as meaning that the survey does not apply to them (around 16%). Alternatively, also from the survey data we can compute the incidence of cloud computing usage as the ratio of those that declared they are using cloud services to the sum of those that explicitly mentioned that they are either using or not using cloud services (around 50%). This second scenario can be considered as a theoretical but most unlikely future scenario where a consistent number of EU SMEs use

cloud computing. 44 See the previous footnote. 45 See the previous footnote.



31

After obtaining that preliminary estimation 𝑁𝑖𝑗𝑝, the RAS method of reconciliation is applied by

considering as the binding constraint the total number of enterprises experiencing problems,

as that value was estimated directly from the sample with the required confidence and error

levels.

This reconciliation of totals performed by the RAS method dismisses the assumption of

independence as it distributes the error across the margins.

Concerning the sectors not covered in the sample,46 the total number of enterprises

experiencing contract-related problems by country and sector can also be computed by

following the same procedure as above. In that case, sector incidence would be replaced by

the European average incidence on the other sectors. Given the sampling procedure that was

followed, in which the sectors with the highest incidence of cloud computing usage were

selected to be covered by the survey, applying those incidences of use of cloud computing as

representative to the other sectors would overestimate the impacts. Given this situation, only

the results for the selected sectors are presented and this constitutes a lower threshold for the

true detriment.47

Once the values of the number of enterprises experiencing cloud computing problems for each

country and sector and country and size class are computed, they can be aggregated to the

EU level just by summing up the number of enterprises experiencing cloud computing service

problems per country.

Finally, the third step was the computation of the total loss/cost/value of redress by country,

sector and size class, by multiplying the number of enterprises that experienced contract-

related problems (as computed using the RAS model) by the 95% trimmed mean values

per enterprise for each variable (from the survey).48

The GFD is then computed considering alternatively lost turnover and lost profits and adding

the human resource costs and the other costs. NFD is computed taking the two measures of

GFD and subtracting the value of any redress offered by the service provider for the damages

caused to each SME.

Afterwards, two measures are obtained, covering both GFD and NFD computed at country and

sector, country and size class, and at EU level.

Consequences of encountered problems at the macro level

Following the quantification of the economic detriment, the consequent impact on growth

and jobs was estimated using one of the methodologies suggested in the impact assessment

toolbox presented by the Joint Research Centre49 of the European Commission.

The goal was to estimate the overall GVA and employment content of the detriment. In order

to do that, the following methodology was used.

The starting point was the declared turnover loss, one of the components of total detriment,

aggregated by country and sector and by country and SME size. We first estimated the financial

detriment suffered by each enterprise by considering the different components of detriment,

then we aggregated these effects to the EU28 level by summing up the effects suffered by

46 As previously stated, only the following sectors were covered by the study: Manufacturing (C); Wholesale and retail trade; repair of motor vehicles and motorcycles (G); Professional, scientific and technical activities (M); Administrative and support service activities (N); and Information and communication (J). 47 Recall that the selected sectors comprise a total of 79.7% of SMEs and GE250 using cloud computing

services. 48 Given each variable, the 95% trimmed version was obtained by discarding the 5% lowest and highest observations: it is a statistic in the middle of the data range. 49 EU Science Hub (2016), Input-output economics, Brussels.

https://ec.europa.eu/jrc/en/research-topic/input-output-economics



32

each enterprise across all enterprises. When estimating the macroeconomic effects of the

contract-related cloud computing problems, one must consider the overall turnover loss that

was suffered by all enterprises that experienced those problems as turnover is the variable

that best summarises the overall enterprise-level effects that are transmitted into the

economic system through the supply chains and that can be related to aggregate economic

variables, thus avoiding double counting.

This allowed the team to estimate the so-called direct impacts (the direct consequences in

the enterprises that face contract-related cloud c

study on the economic detriment to small and medium-sized ... · study on the economic detriment to...

Documents