From data residency to tech sovereignty: Europe rethinks control

A government can require its sensitive data to stay within national borders. It can require that data to be encrypted. It can even insist that the servers processing it remain inside the country.

And yet, European governments are increasingly asking whether any of that is enough.

Switzerland recently stepped back from plans to use Amazon Web Services for infrastructure supporting its new national E-ID. The Netherlands blocked U.S.-based Kyndryl’s proposed acquisition of Solvinity, a Dutch cloud provider supporting DigiD, the country’s national authentication system. And the European Commission has introduced a framework that measures cloud sovereignty on far more than where data is physically stored.

These developments are different, but they point to the same concern: a server can sit in Europe while the company controlling it remains subject to another country’s laws.

To understand why that distinction matters, it helps to go back to a dispute involving Microsoft, the U.S. government and emails stored in Ireland.

When data crossed borders without moving

In 2013, U.S. authorities sought emails from Microsoft as part of a criminal investigation. Microsoft resisted because the data was stored in Ireland, arguing that a U.S. warrant should not automatically reach information stored overseas.

The dispute reached the Supreme Court, but the Court never resolved the underlying question. While the case was pending, Congress passed the CLOUD Act in 2018.

The law made explicit that providers subject to U.S. jurisdiction can be required through lawful process to produce data within their possession, custody or control regardless of where it is stored.

At the time, it looked primarily like a law-enforcement dispute.

Its implications now look much broader.

In Switzerland, Justice Minister Beat Jans recently stopped plans to use AWS infrastructure for the country’s government-backed E-ID.

The Netherlands went further. Its government blocked Kyndryl’s proposed acquisition of Solvinity. The concern was not that Kyndryl had improperly accessed Dutch government data. It was structural: bringing infrastructure supporting DigiD under an American parent could create national-security and sovereignty risks.

Similar questions surfaced earlier in the UK. In 2023, Scotland’s Biometrics Commissioner sought clarification over a Police Scotland digital evidence platform hosted on Microsoft Azure, including questions about data location, international transfers and compliance with law-enforcement data protection requirements.

Different countries, different systems, but the same underlying question:

When sensitive national data sits on infrastructure operated by a foreign technology company, what actually makes that data sovereign?

Imagine a database in Frankfurt

Consider a European government storing sensitive information in a cloud data center in Frankfurt.

The servers are in Germany. European privacy requirements govern how the data is processed. Access is tightly controlled.

But the cloud provider is an American company subject to U.S. law.

Is the data truly sovereign?

Europe’s GDPR provides extensive protections for personal data. Article 48 addresses demands from foreign courts and authorities. The EU Data Act extends the issue beyond personal information, requiring measures against certain third-country governmental access to non-personal data held in the EU when that access conflicts with European law.

The CLOUD Act approaches the issue from the other direction. It allows U.S. authorities, using appropriate legal process, to compel providers subject to U.S. jurisdiction to produce data within their possession, custody or control regardless of where it is stored.

That does not give U.S. authorities unrestricted access to European cloud servers, nor does the CLOUD Act simply override European law. Legal process is required, and providers can face competing obligations under different jurisdictions.

But what if the Frankfurt data is encrypted?

That can materially change the risk. If the European customer controls the encryption and the U.S. provider cannot access the key or plaintext, the provider may have little useful customer content to disclose even if legally compelled.

But encryption answers only part of the sovereignty question.

It can restrict access to the data. It does not necessarily remove dependence on the company operating the infrastructure and services on which the customer relies.

Encryption can reduce a foreign provider’s access to the data. It does not necessarily eliminate dependence on the foreign provider.

The Frankfurt example therefore shows why sovereignty is becoming bigger than a choice between localization and encryption.

When technology dependence becomes geopolitical

European concern about digital sovereignty is not new. GDPR, transatlantic data-transfer disputes and European cloud initiatives have been developing for years.

But recent geopolitical tensions have increased the urgency.

Trade disputes with the President Trump administration, uncertainty over the transatlantic security relationship and broader debates over European strategic autonomy have pushed Europe to reconsider dependencies once viewed largely through an economic or competition lens.

Technology is increasingly part of that discussion. The question is shifting from where data resides to who ultimately controls the infrastructure, software and legal jurisdiction behind it.

The issue is therefore becoming larger than privacy. It is about strategic dependence.

Europe can control where its data is stored. It can regulate how that data is processed. It can require encryption. But if the infrastructure remains under the legal or operational control of a foreign company, can Europe truly claim sovereignty over the data?

Europe is beginning to answer that question in several ways.

Control the cloud

The European Commission’s Cloud Sovereignty Framework demonstrates how much the definition has expanded.

Rather than evaluating sovereignty simply by data location, its 48 criteria cover eight areas including strategic, legal and jurisdictional, data and AI, operational, supply-chain and technological sovereignty.

The framework has already moved into procurement. In April, the Commission awarded contracts worth up to €180 million for sovereign cloud services. Providers had to meet a minimum data-sovereignty level, while the highest level required a full EU supply chain from chips to software.

The message is clear:

Data residency alone does not equal sovereignty.

Control the technology ecosystem

Europe is also looking beyond cloud infrastructure.

EuroStack captures one version of that thinking: instead of asking only how foreign technology can be made sufficiently sovereign, it asks why Europe is so dependent on foreign-controlled technology in the first place.

Open source has become part of the same discussion. The European Commission’s technological sovereignty agenda now spans semiconductors, AI, cloud and open-source technologies, with the broader objective of strengthening Europe’s digital autonomy.

Biometrics provides another example.

Earlier this year, the EU Innovation Hub for Internal Security proposed creating an independent European biometric evaluation capability. Europe currently lacks an equivalent to the U.S. National Institute of Standards and Technology’s independent biometric testing programs.

The concern is not that NIST testing is inadequate. It is the dependency itself. The policy brief argues that reliance on non-EU evaluation could weaken Europe’s influence over standards and leave it a “rule-taker rather than a rule-maker” in biometrics.

Technological sovereignty is therefore expanding beyond where data is stored. It increasingly encompasses the infrastructure, software and institutions on which Europe’s digital ecosystem depends.

Reduce the dependency

There is another approach: reconsider how much sensitive information needs to be centralized at all.

Europe’s digital identity architecture provides an example. The European Digital Identity Wallet emphasizes user control, data minimization and selective disclosure, reducing the need to expose complete identity records for every transaction.

Decentralization does not eliminate cloud infrastructure. Issuers, trust services and other parts of the ecosystem still require it.

But it can reduce the amount of sensitive information that needs to reside in centralized systems in the first place.

Europe’s emerging response can therefore be viewed at three levels:

Sovereign cloud — control the cloud.

Technological sovereignty — control more of the technology ecosystem.

Decentralization — reduce the dependency on centralized infrastructure.

Sovereignty is becoming a question of control

That brings the story back to Microsoft’s servers in Ireland.

The original dispute asked whether storing information overseas placed it beyond the reach of the country governing the company holding it.

The CLOUD Act provided America’s answer.

Europe is now confronting the implications.

The Swiss E-ID debate, the Dutch Kyndryl decision, Europe’s Cloud Sovereignty Framework, its open-source push and the proposed European biometric evaluation capability all point toward a broader definition of sovereignty.

Data localization matters. Encryption matters. Privacy regulation matters.

But none alone answers the larger question.

Europe’s emerging definition of digital sovereignty is moving beyond where data sits or how securely it is locked. Increasingly, it is about who controls the infrastructure, who controls the technology ecosystem, and which jurisdiction ultimately has authority over them.

Article Topics

biometrics  |  CLOUD Act  |  data protection  |  digital identity  |  digital sovereignty  |  Europe  |  tech sovereignty  |  U.S. Government