Digital infrastructure creates new forms of dependence that the traditional concept of sovereignty was not designed to address.
The New Sovereignty Problem
Traditional sovereignty — the principle that a state has exclusive authority over its territory and the activities within it — was developed in an era when the most consequential activities within a territory occurred physically within it. The factory, the financial institution, the communications infrastructure, the administrative apparatus of governance — all were physically located within the territory and therefore physically subject to the sovereign's authority. Digital infrastructure has changed this in ways that the traditional concept of sovereignty cannot fully accommodate.
The cloud infrastructure that stores a state's most sensitive data may be physically located in a foreign jurisdiction and operated by a foreign company subject to that jurisdiction's laws. The communication platforms through which its citizens and institutions exchange information are operated by foreign companies whose algorithms shape public discourse in ways that no territorial authority controls. The financial infrastructure that processes its economic transactions runs on protocols developed and governed by actors outside its territorial authority. The state retains formal sovereignty over its territory but has lost practical control over significant dimensions of the economic and social activity that occurs within it.
The Gap Made Concrete: Two Cases
The clearest illustration of this gap is not hypothetical. In a decision referred to as Schrems II, the Court of Justice of the European Union invalidated the EU-U.S. Privacy Shield in July 2020, the legal mechanism that had permitted routine transfer of personal data from the EU to the United States. The Schrems cases challenged the adequacy of U.S. data protection measures and ultimately invalidated two successive EU–U.S. data transfer frameworks, forcing a complete restructuring of how personal data flows between Europe and the United States until a new Data Privacy Framework was instituted in 2023. Crucially, the Court's reasoning bypassed the question of physical data location almost entirely: it found that the data surveillance laws and compliance requirements for data processors in the United States made it impossible to ensure equivalent protections, specifically identifying Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333 as inconsistent with rights guaranteed in the EU Charter. No amount of contractual assurance or server placement could resolve this; the dispute could only be settled by changing the source country's own surveillance law. That change arrived through an Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities, signed by President Biden in October 2022, on the basis of which the European Commission adopted its adequacy decision on the EU-U.S. Data Privacy Framework in July 2023, restoring the data transfer mechanism. Sovereignty over EU citizens' data, in other words, was never secured by territory; it was negotiated, lost, and partially recovered at the level of foreign surveillance statute and executive order — a layer no EU border control could reach.
China illustrates the opposite strategy: rather than negotiating access to a foreign legal layer, assert direct territorial control by law. China's Personal Information Protection Law was enacted in August 2021 and became effective on November 1 of that year. Critical information infrastructure operators handling data tied to informational networks, infrastructure, and natural resources must ensure that data generated in China is stored in China, subject to a security self-assessment before any of it is sent abroad, and the law extends localisation duties beyond such operators to any company processing personal information above a volume threshold set by the Cyberspace Administration of China. The law applies to companies whether they are physically located in China or outside it, so long as they handle the data of Chinese residents. The compliance costs predicted by the localisation strategy have followed accordingly: once processing volumes cross the relevant threshold, a data handler must also appoint a dedicated information protection officer to supervise compliance, and cross-border transfers require formal government clearance rather than a mere contractual undertaking.
Digital Sovereignty Strategies
States pursuing digital sovereignty — the meaningful assertion of territorial authority over digital infrastructure and activity — have developed several strategies with different cost-benefit profiles, and the two cases above sit at opposite ends of the spectrum. Data localisation, as China's regime demonstrates, provides the most direct form of territorial control but imposes significant costs on the efficiency of data processing and creates compliance burdens for international companies. The European path shows a second strategy: regulatory and diplomatic intervention at the layer where actual control resides, rather than at the territorial layer where it does not — trading the certainty of localisation for the flexibility (and fragility) of a negotiated adequacy regime that can be challenged and invalidated again. Indigenous infrastructure development — state investment in domestically-owned cloud, semiconductor, and communications infrastructure — provides a more durable form of sovereignty than either, but requires massive long-term investment and produces infrastructure that is likely to be less efficient than the global alternatives for years.
Digital sovereignty is not the same as analogue sovereignty. The state that controls its territory does not thereby control the digital infrastructure through which most of its consequential economic and social activity now occurs. Achieving genuine sovereignty in the digital domain requires investments, regulatory interventions, and international negotiations that traditional sovereignty doctrine provides no guidance for.
Discussion