Data sovereignty: The next frontier for internet policy?

Our contemporary digital lives produce an overwhelmingly high level of data as part of the digital traces we leave behind from our everyday activities. These data traces are often under the operational jurisdiction of a blend of commercial, private and government operators whereby our control over the data generated through digital traces becomes an incredibly complex scenario. One area attracting significant attention among scholars, activists and tech journalists is data sovereignty. 'Data are a timely subject matter, given that they mediate and steer extensive parts of our lifeworld. And sovereignty, understood, for example, as the ability to issue authoritative claims, latching onto domestic institutional arrangements, international regimes and the practices of other states (Krasner, 1988), appears as a fruitful category to apply to data' (Hummel et al., 2021). Data sovereignty, then, becomes a policy lever that attempts to embody the local cultures and nuances of users. Ideally, it provides a legal framework that enables users to effectively control their digital traces. Data sovereignty asserts the rights of nations or regions to govern the flow and management of data within their borders, thereby asserting their sovereignty in the digital realm. The implications of data sovereignty are far-reaching and cut across diverse sectors such as economics, law, security, privacy and technology. Baezner and Robin (2018) note that data sovereignty inserts itself within data flows in a national jurisdiction. Economically, data sovereignty can impact cross-border data flows, trade agreements and the competitiveness of businesses operating in global markets (Hummel et al., 2018). Legal considerations concerning compliance with data protection regulations, intellectual property rights, and jurisdictional conflicts in cases of data breaches or disputes are core to data sovereignty. Irion asserts (2012, p. 41), '[M]any governments have raised concerns about national data sovereignty when government information is moved to the cloud. How can confidentiality of public information assets residing in the cloud be ensured? What if public information and IT systems are hosted abroad? Will government data of one country be caught under the authority of another jurisdiction?'. From a security and privacy standpoint, data sovereignty plays a crucial role in safeguarding sensitive information and ensuring that it is subject to adequate legal protections and safeguards. For example, governments and organisations may seek to enforce data localisation requirements to mitigate risks related to data breaches, surveillance and unauthorised access by foreign entities. Data centres in different jurisdictions may also need to comply with local data residency requirements because of sovereignty. Similarly, AI algorithms trained on sensitive data may raise concerns about data sovereignty if deployed across borders without adequate safeguards for privacy and security. Couture and Toupin (2019) acknowledge the complexities, particularly within the sorts of technological systems they embody. They note cloud computing, sensor systems, metadata, artificial intelligence, surveillance capturing devices, Internet of Things, and a host of other data capturing are difficult to navigate. Simultaneously, and while within this complex cultural, economic and government argument actuel, data sovereignty several number of societal benefits for the localised users of technology that nests within the policy debates. Data control and autonomy allow countries, organisations and individuals to exert greater control over how and where their data are used. By asserting jurisdictional authority over data collected, stored and processed within their borders, entities can enforce regulations, policies and standards that align with their interests and priorities. Implementing data sovereignty measures, such as data localisation requirements, can enhance security and mitigate risks associated with breaches, unauthorised access and cyber threats. By keeping data within national or regional boundaries, organisations can reduce exposure to external vulnerabilities and better protect sensitive information. Data sovereignty also supports the protection of individuals' privacy rights by ensuring that personal data are subject to adequate legal safeguards and regulations. Local data residency requirements can prevent the transfer of personal information to jurisdictions with weaker privacy laws or inadequate data protection measures, thereby preserving individuals' privacy and dignity. Compliance with local, regional and international regulations governing data protection, privacy and security can enable organisations to avoid legal penalties, regulatory fines and reputational damage resulting from noncompliance with applicable laws and regulations. Beyond the tech policy debates for data sovereignty currently underway, there are broader cultural, economic and social implications to enabling and enhancing its practice. Cultural and ethical considerations within data acknowledge the importance of societal values in shaping data governance practices. By respecting cultural norms and community interests, data sovereignty initiatives can promote inclusivity, diversity and ethical stewardship of data resources. Data sovereignty can also foster economic growth and development by encouraging local innovation, entrepreneurship and job creation through the nurturing of domestic data infrastructure, capabilities and talent, whereby countries can leverage data as a strategic asset for driving innovation, economic competitiveness and sustainable development. One of the most important aspects of data sovereignty within our current digital media environment is an increase in the enhanced trust and transparency of our data systems. Data sovereignty initiatives can build trust and transparency in data governance practices by fostering greater accountability, visibility and traceability of data flows. By ensuring that data processing activities are conducted in compliance with established rules and regulations, organisations can instil confidence among stakeholders and users regarding the responsible handling of data. Finally, data sovereignty can enhance the resilience and sovereignty of critical infrastructure sectors, such as healthcare, energy and telecommunications, by safeguarding essential data assets against external threats, disruptions, or dependencies on foreign technologies or services. Despite its potential benefits, the implementation of data sovereignty poses several challenges and complexities. One major challenge is the tension between national sovereignty and the global nature of the internet and digital economy. Balancing the legitimate interests of states in regulating data flows with the need for interoperability, innovation and collaboration on a global scale requires careful coordination and cooperation among stakeholders. The fragmentation of data sovereignty regulations across different jurisdictions can create legal and compliance burdens for multinational companies and inhibit the free flow of information and innovation. Harmonising data protection laws, establishing mutual recognition frameworks and enhancing international cooperation are essential steps toward addressing these challenges and promoting a more cohesive and equitable approach to data governance. Amidst these benefits and challenges of data sovereignty, there remains strong advocation for localised data management, progressing the debate and highlighting why data sovereignty is critical. By highlighting the needs of individuals and communities over these complex systems discussed so far, it becomes possible to understand and align with and progress the conversations surrounding tech policy and data management. The following section provides an overview of a specific case study in the Aotearoa New Zealand context where data sovereignty is of key concern to media scholars, activists and importantly, Indigenous users. In examining the Te Mana Raraunga (Māori Data Sovereignty Network), the sorts of tensions highlighted above clearly demonstrate how a particular set of users are grappling with and developing the concept of data sovereignty. To effectively understand the multiple facets of data sovereignty, it is important to highlight the sorts of information that is platformed. The multiple perspectives of that information are local, nuanced and at times difficult to understand from other external perspectives, often requiring translation to those not familiar with the local settings. Data sovereignty in Ukraine, for example, is different from that of data sovereignty in Papua New Guinea: 'It is well understood that the existence of relevant information is a vital precondition for devising adequate policy responses to address inequalities and to monitor the effectiveness of measures to overcome discrimination' (Davis, 2016, p. 25). It is therefore crucial we have representation for data sovereignty when designing and implementing policy that surrounds data sovereignty. While Indigenous people have long recognised the sovereignty of their lands, their data fall into the management by national governments and commercial enterprises. Often, the voice of those whom the policy represents is missing: 'missing from those conversations have been the inherent and inalienable rights and interests of indigenous peoples relating to the collection, ownership and application of data about their people, lifeways and territories' (Kukutai & Taylor, 2016, p. 2). Our data, our sovereignty, our future. This vision drove the establishment of Te Mana Raraunga as the Māori Data Sovereignty Network. We advocate for Māori rights and interests in data to be protected as the world moves into an increasingly open data environment. Asserting Māori rights and interests in relation to data. Ensuring data for and about Māori can be safeguarded and protected. Requiring the quality and integrity of Māori data and its collection. Advocating for Māori involvement in the governance of data repositories. Supporting the development of Māori data infrastructure and security systems. Supporting the development of sustainable Māori digital businesses and innovations (https://www.temanararaunga.maori.nz/nga-mahi, 2024). With these six areas as a backdrop for better data management practices, data sovereignty becomes critical to not only the issues highlighted in the previous section, but for the integrity and security of individuals and communities within First Nations peoples. As a natural resource, and not just a commodity, data embodies history, governance, economics, health culture and well-being for First Nations people, as described here within Māori culture. This was the driving force behind several projects including Sharing Information for Wellbeing, a series of hui (gatherings or seminars) to produce guidelines for how organisations can best manage data for the wellbeing of Māori, and the International Indigenous Data Sovereignty Interest Group, which is a network of Global and Working Interest Groups to help 'develop and adopt infrastructure that promotes data-sharing and data-driven research, and accelerates the growth of a cohesive data community'. The Te Mana Raraunga becomes a space to raise concerns about surrounding data sovereignty but is also an advocacy space that works towards infrastructures and solutions to solve the issues as part of the debates of data management. In this issue of Policy and Internet, there is a broad theme surrounding the implications of infrastructures within our media and communication spaces. Starting with Blancato (2023) and their article, The cloud sovereignty nexus: How the European Union seeks to reverse strategic dependencies in its digital ecosystem, we spotlight the cloud as an infrastructure that needs data sovereignty within an ecosystem of foreign cloud providers. Here, they describe the measures the EU is undertaking to protect the confidentiality of European data while also pushing back on the dominance of US-based providers. Keeping with the infrastructure theme, Kassen (2023) turns our attention to blockchain technologies in their article, Prospects of blockchain governance: Understanding key public values, principles, challenges and opportunities. This paper addresses the central questions: How could blockchain governance conceptually work? How could one illustrate schematically key principles of its implementation? What are the key features of blockchain governance? With a rich and diverse set of empirical data, they offer a set of recommendations for developers and policymakers. We then turn our attention to policy and the article The success of e-participation. Learning lessons from Decide Madrid and We asked, You said, We did in Scotland, Royo et al. (2023) demonstrate how successful implementation of e-participation was achieved, through a comparative study in Madrid and Scotland, offering recommendations of enabling activities including 'political leadership and senior management support, top-down approach, high levels of internal and external collaboration, embeddedness in the formal policy-making processes, and careful consideration of design features. Most of these factors are related to processes, organisational, or managerial dimensions, rather than being linked to the institutional context or information and communication technologies' (p. 1). Geng (2023) then questions what good platform transparency should look like beyond simply calling for increased transparency when it comes to platforms, in their article Transparency for What Purpose?: Designing Outcomes-Focused Transparency Tactics For Digital Platforms. They argue that three specific desirable behavioural outcomes are useful to which potential transparency tactics are then mapped for better understanding of transparency for algorithms, platforms and society more broadly. Zhou and Liu (2023) provide a fascinating policy exploration of tuwei, an emerging rural trend associated with Kuashou, a short video sharing platform in Regulating tuwei culture and migrant youth through Kuaishou's platform governance. 'This article focuses on the evolving forms of platform governance, exploring how the state and the platform collaborate to devise new strategies for regulating users' cultural practices and how migrant youth creatively respond to increasing censorship measures' (p. 1). Throughout the article, the authors provide a unique insight into an emerging culture from China, while also highlighting the policy issues that emerge from the practice for the platform providers and the local Chinese governments. Returning to infrastructure, Ververis et al. (2023), examine website blocking in the European context, providing a field-defining approach towards web blocking from a European Union perspective in their paper, Website Blocking in the European Union. Examining tens of millions of data points from the Open Observatory of Network Interference, the authors demonstrate the high level of block requests for ISPs where the reasons are not always obvious. Wade et al. (2023) provide an examination of crowdfunding platforms, and how to regulate to ensure they are not used for negative ideological purposes in, Crowdfunding platforms as conduits for ideological struggle and extremism: On the need for greater regulation and digital constitutionalism. Balancing the openness of free platforms and illegitimate purposes, this paper explores the so-called 'alt-tech' spaces and the need for better regulatory experiences 'to better mitigate fundraising platforms becoming complicit in catastrophic harms' (p. 1). Finally, Escher and Rottinghaus (2023) provide empirical data concerning German online participation platforms for municipalities in Effects of online citizen participation on legitimacy beliefs in local government. Evidence from a comparative study of online participation platforms in three German municipalities. As Governments increasingly involve citizens in the decision-making processes, this research explores the legitimacy beliefs of participants as a positive process for engaging local participants. In political politics context, this research demonstrates the participation process is generally a positive experience and important to include, aligning with the general theme of this issue, the local attitudes, voices and perspectives of the participants.