Digital Sovereignty and Europe’s “Data Spaces”

Thoughts about technology that is inclusive, trusted, and creates a more sustainable world

These posts represent my personal views on the future of the digital economy powered by the cloud and artificial intelligence. Unless otherwise indicated, they do not represent the official views of Microsoft.

A recurring theme of the Trusted Technology blog has been Europe’s role as a de facto global rule-maker for digital markets. The best example is the global reach and influence of the European Union’s privacy law, the General Data Protection Regulation. The GDPR has given the EU undeniable clout in a world where many of the largest tech firms are American or Chinese. But more and more, Europeans are coming to the conclusion that making the rules is not enough if it means losing the game. The European Council on Foreign Relations puts it like this:

“The EU cannot continue to rely on its regulatory power but must become a tech superpower in its own right. Referees do not win the game.”

In her State of the Union speech last week in Brussels European Commission President Ursula von der Leyen declared that:

“Europe must now lead the way on digital—or it will have to follow the way of others, who are setting these standards for us.”

Such sentiments are not new—they have been building for several years. But the last 12 months have seen a flurry of new thinking and proposals from European policymakers designed to enhance the continent’s digital sovereignty. One of the most important of these new ideas was presented last February in the European Commission’s landmark proposal for a European “strategy for data.” The full 35-page report is well worth reading, but readers who want a succinct summary can consult my Trusted Technology post on Europe’s New Strategy for Data as a Public Good.

The scale of the data opportunity is immense. According to Microsoft President Brad Smith, in 2020 humanity creates more data every day than we did in all of past history up to the year 2000. And things are not slowing down. President von der Leyen tells us that in 2025 Europe alone will create as much data as the entire world does in 2020.

Much of the online data generated today involves individual consumers interacting with social media or online content of some kind. But in coming years the amount of data flowing from more impersonal sources will increase by orders of magnitude. These new sources will include business and government transactions, data sets generated by critical infrastructures in cities and industry, continuous monitoring of the environment and agriculture, and the Internet of Things.

The core idea of the EC’s report is that capturing the economic and social value of non-personal data will require the creation of an orderly marketplace for the exchange of data among governments, businesses, non-profit organizations, and citizens. The report uses the terms “data space” or sometimes “ecosystem” to describe this marketplace. The key is that this space will not be a lawless free-for-all, but a place where clear and fair rules are applied to protect the interests of all:

“The aim is to create a single European data space—a genuine single market for data, open to data from across the world—where personal as well as non-personal data, including sensitive business data, are secure and businesses also have easy access to an almost infinite amount of high-quality industrial data, boosting growth and creating value... It should be a space where EU law can be enforced effectively, and where all data-driven products and services comply with the relevant norms of the EU’s single market.”

In her speech last week President von der Leyen made the case that the European data space will be “a powerful engine for innovation and new jobs.” But an economy as vast and complex as Europe’s has many moving parts, and a single overarching data space can only work in practice if it is divided into smaller constituents specialized by domain. The EC report envisages an initial division into nine common European data spaces: manufacturing, green deal, mobility, health, financial, energy, agricultural, public administration, and skills. Each one of these spaces promises to be an interesting and consequential undertaking in its own right, and I will revisit this topic in a future post. But for now, just consider the overall plan:

“These data spaces should foster an ecosystem (of companies, civil society and individuals) creating new products and services based on more accessible data… Such spaces aim at overcoming legal and technical barriers to data sharing across organisations, by combining the necessary tools and infrastructures and addressing issues of trust by way of common rules…These sectors or domains are those where the use of data will have systemic impact on the entire ecosystem, but also on citizens.”

As in any marketplace, trust that transactions are fair and that rules will be respected is essential. Legal and technical teams at Microsoft have been hard at work for several years developing new kinds of contracts specifically designed to address the kinds of data marketplaces that the EC envisages. These open use data agreements contain both legal and computational elements and will ultimately permit many data transactions to be partially or wholly automated. The Open Data Campaign we launched in April takes this work to the next level. Among other things, we’ve committed to developing 20 new data collaborations between businesses, governments, and NGOs in areas such as healthcare, environmental sustainability, and broadband connectivity.

But the question remains: how will Europe’s proposed data spaces be implemented concretely? It’s obvious to everyone that they must live in the cloud. No other platform could permit the scale, speed, and flexibility of data trading and brokering that the European proposal calls for. Nor could any other platform be made properly secure. But which clouds? Today the largest cloud providers in Europe are American. This raises sensitive issues of digital sovereignty that policymakers on both sides of the Atlantic have been wrestling with for a number of years. The EC data strategy report reminds us that:

“In order to protect the rights and interests of EU companies and citizens, the Commission, with the support of the relevant authorities of the Member States, will pay particular attention to the adherence of cloud service providers operating on the EU market to EU rules…”

Despite media speculation that Europe intends to build its own hyperscale cloud to rival the American providers, who have already invested billions of euros in building their own data centers in Europe, it has become clear over the past year that the continent’s political and tech leaders have something different in mind. Roughly speaking, their idea is to build a “cloud of clouds,” that is, a common set of rules and protocols that will allow the interconnection of many clouds of different sizes, specializations, and nationalities into a single federated ecosystem. These common rules and protocols will be defined and enforced by the European Union, but the resulting ecosystem will be open to all providers, European or foreign, who agree to play by the rules. One effort to build such a federated cloud has already been launched, the Franco-German Gaia-X project, but the Commission may support other efforts as well.

Europe’s proposal for a cloud of clouds is an innovative and important idea. Some Americans may believe that these ideas of digital sovereignty come close to protectionism. If so, it is an exceptionally gentle and friendly form of protectionism, one that by virtue of its power to spur valuable new innovations promises to be win-win rather than zero-sum. Speaking as an American, I firmly believe that we should not adopt a defensive posture toward the very natural desire of other nations to affirm their sovereignty in the digital realm. On the contrary, we all have much to gain from Europe’s innovative thinking on how to get the most economic and social value out of the vast quantities of data the world is creating. There will be more than enough opportunities to create new value to go around.