Data Sov­er­eign­ty

Data sov­er­eign­ty refers to the authority to dispose of data and serves as a col­lec­tive term for the many facets as­so­ci­at­ed with the pro­cess­ing of digital data – including data pro­tec­tion, en­cryp­tion, trans­mis­sion, and storage. Anyone who stores data in the cloud or uses IT services from external service providers must ensure ap­pro­pri­ate data pro­tec­tion measures and fa­mil­iar­ize them­selves with the legal reg­u­la­tions. What are the re­quire­ments for data sov­er­eign­ty and how do you maintain it?

Data sov­er­eign­ty is a legal term that refers to legal guide­lines relating to data. It is closely linked to data pro­tec­tion, cloud computing, and tech­no­log­i­cal sov­er­eign­ty. Data sov­er­eign­ty laws create rules for the authority of gov­ern­ments and companies to dispose of digital user and business data. Data sov­er­eign­ty thus refers specif­i­cal­ly to the following questions:

• Who owns the data?
• Who is allowed to store the data?
• How can data be stored?
• How can data be used?
• How is data protected?
• What happens in the event of data misuse?

Because a growing number of small and medium-sized companies ap­pre­ci­ate cloud computing, i.e. the out­sourc­ing of company data and tech­nol­o­gy to external servers, the im­por­tance of data sov­er­eign­ty cannot be un­der­es­ti­mat­ed. If servers are located in countries where data pro­tec­tion guide­lines do not meet European standards, the question of data sov­er­eign­ty should be clearly clarified.

The ad­van­tages of cloud computing are well known. However, as soon as sensitive data is not stored in-house but on external servers and possibly in other countries, questions over data security and data ownership arise.

Unless con­trac­tu­al­ly stip­u­lat­ed, third-party providers may be allowed to analyze and sell data. In the EU, companies that process personal data are obliged to guarantee the highest level of data security. Therefore, ver­i­fi­able data pro­tec­tion and modern com­pli­ance guide­lines are essential. Both for companies that outsource their IT and for companies that provide IT services. If a company loses or neglects data sov­er­eign­ty, this can have serious legal con­se­quences.

Data can take on the following three stages online, in en­ter­prise networks, and in the cloud:

• Data-in-use: Data currently in use
• Data-in-motion: Data currently being trans­mit­ted
• Data-at-rest: Data stored locally or in the cloud

Data sov­er­eign­ty used to be discussed primarily in con­nec­tion with data-at-rest, i.e., stored data. Today, different standards apply: data security, revision security, and data sov­er­eign­ty apply re­gard­less of storage location, es­pe­cial­ly when external providers process company data. Companies must retain data sov­er­eign­ty for all three stages. This high standard of data pro­tec­tion can be im­ple­ment­ed using en­cryp­tion software that ensures only select companies can decode sensitive, encrypted data.

In times of dig­i­tal­iza­tion, public sector companies and those operating as part of the free economy must observe two basic rules to guarantee data security:

1. IT in­fra­struc­ture must be secure, flexible, and up to date at all times
2. Data sov­er­eign­ty over customer, user, and business data must be guar­an­teed.

Once ap­pro­pri­ate safe­guards and con­trac­tu­al arrange­ments are in place, companies can protect trade secrets and process personal data in ac­cor­dance with EU data pro­tec­tion di­rec­tives. Companies should always know how third-party service providers handle data and what rights of use they have. Since there are also legal un­cer­tain­ties and gray areas when it comes to data sov­er­eign­ty, it should be con­trac­tu­al­ly regulated what happens to data and how it is stored, processed, and trans­ferred.

An example:

If a pro­duc­tion company wants to increase its per­for­mance, it can use the cloud and web services of a managed service provider. Via data analysis, this provider could, for example, make forecasts on main­te­nance tasks and determine the company's op­ti­miza­tion potential.

Although the com­mis­sion­ing company should have data sov­er­eign­ty in this case, this does not mean it nec­es­sar­i­ly has access to all data analyses of the com­mis­sioned company. Unless otherwise con­trac­tu­al­ly agreed, parts of the data could also be reused or sold to third parties. Here, a lack of data sov­er­eign­ty creates a security risk and a com­pet­i­tive dis­ad­van­tage for companies.

Small online retailers or large-scale producers – the eval­u­a­tion of customer and business data is important to allow busi­ness­es to quickly adapt pro­duc­tion and services to meet customer ex­pec­ta­tions and behavior. Since it has become near im­pos­si­ble to her­met­i­cal­ly seal off data from third-party access, legal frame­works are required. In addition to in­di­vid­ual con­trac­tu­al arrange­ments between clients and service providers, national and in­ter­na­tion­al data pro­tec­tion reg­u­la­tions such as the EU General Data Pro­tec­tion Reg­u­la­tion (GDPR) are guide­lines for data sov­er­eign­ty.

A general data pro­tec­tion law that sets out basic guide­lines for the pro­tec­tion of personal data does not exist in the USA. While there are specific data pro­tec­tion reg­u­la­tions for in­dus­tries in the EU, data pro­tec­tion here is based on the voluntary com­mit­ment of US companies. In addition, US au­thor­i­ties have extensive powers of disposal over data. If European companies use the services of American cloud providers or web service providers, data pro­tec­tion gaps can arise.

According to the GDPR, companies that process personal data must take “ap­pro­pri­ate technical and or­ga­ni­za­tion­al measures to ensure a level of pro­tec­tion ap­pro­pri­ate to the risk”. Data pro­tec­tion and data sov­er­eign­ty present as complex tasks for companies. In par­tic­u­lar, balancing the pro­tec­tion of corporate data, personal data, and a strong market position can be difficult. Since the GDPR focuses primarily on personal data, companies must ensure that users are informed about and con­scious­ly consent to the pro­cess­ing of their personal data. At the same time, the analysis of user data is a crucial success factor for digital companies.

In order to harmonize data sov­er­eign­ty, data pro­tec­tion, and corporate success, it is advisable to hire data pro­tec­tion officers to oversee your company's data sov­er­eign­ty. In addition, it should be clarified which data pro­tec­tion and data use guide­lines third-party companies and partner companies have. A privacy policy is oblig­a­tory and should trans­par­ent­ly com­mu­ni­cate your measures to securely process data. Essential technical and or­ga­ni­za­tion­al measures include:

• Pseu­do­nymiza­tion and en­cryp­tion of data
• Con­fi­den­tial­i­ty and integrity of systems
• Technical re­silience of systems
• Recovery and avail­abil­i­ty of data after technical emer­gen­cies
• Regular review, as­sess­ment, and eval­u­a­tion of pro­tec­tive measures
• Com­pli­ance with and in­cor­po­ra­tion of data pro­tec­tion measures by employees

US data security measures are still far behind those of European coun­ter­parts despite ini­tia­tives such as the US CLOUD Act. US au­thor­i­ties can legally access data without a judge's order if it is stored on servers that are subject to the US CLOUD Act. This also applies when it comes to American providers with European computer centers.

The European ini­tia­tive for high-security, privacy-compliant, and market-ready data in­fra­struc­tures is called Gaia-X. Gaia-X is part­ner­ing with IONOS Cloud and others to work on a data in­fra­struc­ture that will become Europe's al­ter­na­tive to cloud computing services provided by the likes of Amazon, IBM, Google, Alibaba, or Microsoft. This would allow companies to securely process data via intra-European computer centers, ensure data sov­er­eign­ty, and prevent the outflow of in­dus­tri­al and personal data to non-European actors. The in­fra­struc­ture aims to be based on trans­par­ent, freely se­lec­table network nodes and data centers whose at­trib­ut­es, ca­pa­bil­i­ties and re­quire­ments are clearly com­mu­ni­cat­ed. Customers should be able to switch providers ef­fort­less­ly without becoming dependent on web service providers and managed service providers or through cloud and vendor lock-in.