Both initiatives reduce near-term friction for EU expansion, but the legal exposure on the confidentiality clause is material and unresolved

Decision Lens

A confidentiality clause inserted into EU law in 2024 — drafted by Microsoft and lobby group DigitalEurope and adopted near-verbatim by the European Commission — blocks public access to individual data center energy KPIs under the EU Energy Efficiency Directive. Legal experts, including the former president of the Belgian Constitutional Court, argue the provision violates the Aarhus Convention and the EU Charter of Fundamental Rights. For energy heads managing EU-based portfolios, the regulatory stability of this clause is not assured. If the provision is challenged and overturned, granular facility-level energy and water consumption data becomes subject to public disclosure — on a timeline and scope that is currently unknown.

90-Second Brief

This week, the European Commission codified a blanket confidentiality rule in March 2024 that classifies all individual data center energy and water performance data as commercially sensitive, preventing access by communities, researchers, and journalists. The clause was proposed in identical language by Microsoft and DigitalEurope during the consultation process and inserted almost word-for-word into Article 5 of the implementing regulation under Directive 2023/1791. Ten legal scholars have assessed the provision as likely incompatible with the EU’s obligations under the Aarhus Convention. Separately, the Commission’s own reporting data shows only 36% of eligible EU facilities have submitted environmental metrics, with 80% of that subset considered accurate and reliable.

What’s Actually Happening

The mechanism here is regulatory capture at the drafting stage. When the Commission circulated its first implementation text in December 2023, it proposed publishing data “in aggregated form.” Microsoft and DigitalEurope submitted feedback in early 2024 recommending a new article classifying all individual facility data as confidential — explicitly to prevent access even via freedom of information requests. The final March 2024 text adopted their language. In early 2025, a senior Commission official emailed national authorities instructing them they were “obliged to keep confidential all information and key performance indicators for individual data centers.”

The practical outcome: only broad national-level aggregates are public. Facility-specific energy use intensity, water consumption, and related KPIs remain outside the reach of regulators in other jurisdictions, civil society, and academic researchers. A parallel lobbying track pushed for fast-tracked environmental impact assessments and capped 90-day community consultation windows for major construction projects — a proposal still under review as of April 2026. Both initiatives reduce near-term friction for EU expansion, but the legal exposure on the confidentiality clause is material and unresolved.

Why It Matters for Global Heads of Data Center Energy?

The near-term operational read is favorable: reduced disclosure requirements lower the risk of localized opposition to new facilities and limit the data available to challenge siting decisions. For portfolios actively expanding in markets like Spain — where Amazon’s €33 billion commitment has helped make Aragón a major EU hub — the permitting streamlining proposals add additional near-term velocity.

The structural risk runs in the opposite direction. If the Aarhus Convention challenge succeeds — and the legal consensus among cited experts is that the blanket confidentiality approach is indefensible — the disclosure regime could be reconstructed under judicial or treaty-body pressure, with potentially less predictable outcomes than a negotiated rulemaking would produce. Energy heads should also note that the Commission’s own compliance data is weak: with only 36% of eligible facilities reporting, the data set the industry sought to protect is incomplete. Regulators operating with incomplete, industry-shielded data are poorly positioned to forecast grid impact, creating downstream risk for interconnection planning across EU markets. A disclosure correction, when it arrives, is likely to be disruptive rather than orderly.

The Forward View

The EU is projected to triple data center capacity over the next five years, supported by €176 billion in anticipated investment. That scale of build-out will intensify scrutiny of energy and water consumption at the facility level — from grid operators, municipal authorities, and environmental bodies — regardless of what Article 5 currently permits. The fast-tracked permitting proposal under Commission review could reduce planning friction in the near term, but legal challenges to the confidentiality clause from Aarhus Convention compliance bodies or EU member state courts would likely force a renegotiation of what must be disclosed and at what granularity. The Commission has indicated it will publish sustainability scores covering a limited set of indicators for individual facilities — a partial concession that signals internal awareness of the clause’s vulnerability. Energy heads should treat current disclosure protection as provisionally stable, not durable.

What We’re Uncertain About?

  • Whether the Aarhus Convention challenge will proceed formally and on what timeline. Ten legal scholars have assessed the clause as likely non-compliant, but no formal compliance proceeding has been confirmed in the source reporting. Resolution would come from a ruling by the Aarhus Convention Compliance Committee or an EU court referral.

  • What a reconstructed disclosure regime would require operators to publish. The current confidentiality protection is blanket; any replacement regime could range from aggregate-plus-scores to full facility-level KPI publication. The outcome would depend on which legal body rules and under what standard.

  • Whether the 64% of unreported EU facilities face enforcement consequences. The Commission’s own data shows compliance is weak, but no enforcement mechanism or timeline is specified in the source material. Clarity here would materially affect how operators weigh voluntary disclosure against regulatory risk.

  • How the fast-tracked permitting proposal will be amended during EU review. The proposal caps community consultation at 90 days and sets hard administrative deadlines, but it remains under legislative review. Civil society opposition and legal constraints could alter the final text significantly before enactment.

One Question to Bring to Your Team

If the Article 5 confidentiality provision is invalidated within the next 18–36 months and facility-level energy KPIs become subject to public access requests, which of our EU sites have performance characteristics that would generate regulatory, community, or reputational exposure — and are we managing those sites to a standard that assumes disclosure?

Sources

  • Techpolicy — How Big Tech Lobbied the EU to Hide Data Centers’ Environmental Toll (Link)

Tags