Why digital sovereignty is the responsibility of the state

Christian Laux is a lawyer at Laux Lawyers and Vice President of the Swiss Data Alliance. In the interview he explains why digital sovereignty is the task of the state and why the “Swiss Cloud” still has a chance.

What do you mean by digital sovereignty?

Christian Laux: Sovereignty is a term that emerged to describe the competences and ability of states to act. The Swiss Data Alliance’s understanding of the term places the concept of digital sovereignty at the state level. This is also shown in particular by the conceptual paper on digital sovereignty that the Swiss Data Alliance published in summer 2022. It is therefore about describing the ability of states to act: Can the state protect itself and its population from unpleasant external influences that affect digitalized and networked everyday life (economy, private life)? If he succeeds in doing this, as he has planned, or as he has promised his population, the state will be digitally sovereign.

And what does sovereignty of private individuals and companies mean?

The Swiss Data Alliance uses the term “digital self-determination” for the private perspective. We find this term more appropriate for the individual person’s perspective. We are also guided by the work at the federal level, in the “Digital Self-Determination Network”. In short: Anyone who wants to act should be able to do so, within the framework of the legal system. In a liberal state, this self-initiative is the goal. Sovereignty is not a good term here; you need it for “confident appearance” or something similar, but that’s colloquialism. Sovereignty for private individuals is too abstract and incomprehensible. In a private context, self-determination means that every person with free will can decide for themselves how they want to live. Digital self-determination means that this self-determination also exists in the digital space.

When are you digitally self-determined?

Digital self-determination exists when individuals can exercise control over “their” data and information. This also includes control over who is allowed to access such data. But it’s not just about data, but also about processes. More and more often there are processes in everyday life that are data-driven or dependent on information. The ability to help shape these processes is also part of digital self-determination.

What do you mean by “your” data?

I use the quotation marks because there can be no ownership in the realm of data and information. It is about data and information that concerns me personally or my sphere of interests. For example, descriptive references to me can have a discriminatory effect even if another company has made them. Example: If a detective secretly collects data about me, everyone immediately notices: My self-determination is not far off, but the “data” was not created in my area. So it’s not about where the data is stored or who created it. In general: Local references are emphasized far too strongly in the discussion. You have to keep your perspective more open. It’s about freedom of action and whether it is impaired.

The local reference is emphasized too strongly: Does this also apply to state borders?

Yes. State borders are certainly important in order to delimit the areas of responsibility of a state from other nation states. But even at the state level, it is more about the effects and not about the location of data storage. It’s about whether Switzerland can shape its digital everyday life (positive design goal). And of course it is also about defensive ability and resilience against the outside (negative design goal).

Can you give examples of what digital sovereignty is about?

Digital sovereignty is not just about data in the sense of storage objects. It is also about questions such as whether a referendum can be held in the digital world without external interference, or – also not just at the data level – to what extent bias results from artificial intelligence, for example, or whether trust in others disappear (example: war reporting with pictures in newspapers – which pictures can you still trust?) and so the glue in society crumbles.

Why should companies in Switzerland deal with this?

Colloquially you can say: “Entrepreneurs have to have their business under control.” So it’s about control. But this is now the perspective of digital self-determination as I defined it above: How do I control data? How do I control who accesses it and who uses it and how?

To what extent can digital sovereignty be compatible with cloud solutions?

Good. But you have to take a closer look to see where “we” no longer have a central issue under control. Then there would be no control. However, in the public discussion today there are no clear statements about where there actually is a concrete problem. To investigate this, the Swiss Data Alliance is conducting a Switzerland-wide survey in 2024 to specifically ask about such pressure points. One of the questions: Where is digital sovereignty specifically in danger?

How sovereign can the clouds of US providers be against the background of the US Cloud Act?

A cloud solution does not have to be sovereign. The state should be sovereign. As a result, the US Cloud Act stipulates that established legal assistance procedures do not have to be followed in a criminal investigation against an individual. The right to be heard is only established in US courts. Because everything no longer takes place in Swiss courts, many see unsolvable problems. However, this perspective is not accurate when you reflect on what matters: We have to protect data. And this also works in the cloud. The US Cloud Act and Switzerland’s digital sovereignty are not a contradiction. However, there are issues on which the Confederation should make certain clarifications; because the question continues to be discussed prominently and that unsettles the population. In this way, educational work could be carried out here.

Microsoft and AWS want to offer “sovereign cloud solutions” in Europe or in some European countries. What should we make of such offers?

Can the hyperscalers solve data protection problems with such services or is it just window dressing?
Only those who understand can control. If the providers provide transparent information about the offer and the customers ask the right questions, then there is no window dressing – only excessive expectations at best. However, you should not point the finger at the providers (as long as they provide transparent information), but place the responsibility for clarifying the basics on yourself.

What characterizes a sovereign cloud solution?

First of all: States want to be sovereign within the limits of their own claims. And individuals and organizations want to be digitally self-determined. But a cloud solution doesn’t have to be sovereign. It is of course obvious that technology plays an important role – at the level of customers’ digital self-determination. And the following is also true: Anyone who wants to use a cloud solution (or any other solution) must understand the risk situation they are entering into. However, this is not a specific sovereignty problem, but has always been a “to-do” in the task list of the organization or authority wanting to outsource. So you have to say: The concept of sovereignty should be reserved for what it has proven to be useful for over the centuries: to describe the relationship between states.

Politicians must once again address the issue of the “Swiss Cloud”. A motion calls on the Federal Council to create the legal basis to ensure greater security for the most important data of the federal government, the cantons and municipalities as well as the operators of critical infrastructure. What are the chances for this political project?

If a country has the will to consistently implement big ideas, such projects have a good chance of success.

Finally, something fundamental: Is digital sovereignty pure wishful thinking? And if not: What does it take for a digitally sovereign Switzerland?

Digital sovereignty is not wishful thinking. One must return to the concept of active sovereignty and recognize that sovereignty is not a status. Sovereignty only arises when you use your freedom of action. This is where opportunities arise. Sovereignty is the result of one’s own initiative, one’s own thoughts and actions. Only those who define themselves are sovereign. This is what I mean by active sovereignty. But it is very important that the sovereignty discussion is not about independence. Complete independence from the outside world would be illusory (and, by the way, hardly anyone in Switzerland would actually want it). Self-sufficiency would also be undesirable. It takes an active definition of one’s own values ​​and a focus on what is really important to us and what defines us. In this respect, the discussion is a great opportunity. We have the potential to be able to independently shape our path into the future. We should seize this opportunity now.