The European Union is committed to ensuring that control over its citizens’ data remains in European hands and is not transferred to countries outside the EU. These efforts have resulted in a requirement that European citizens’ data must be stored within the EU and may not be transferred to non-EU countries.
Does data sovereignty serve its purpose, or does it hinder efforts to make data useful for its own citizens? If regulations and laws governing data and its use fail to take into account its inherent complexity, then not only can the potential of this data to benefit EU citizens not be fully realized, but it can actually cause harm. Instead of following a principle of opportunity, Europe often follows a principle of risk avoidance. The latter can thus result in precisely these and other risks that one was trying to avoid.
Example: Medical Data
A machine learning model trained using medical data from all citizens can identify new patterns related to diseases, risk factors, and treatment outcomes, which can lead to advances in treatment and drug development. If, on the other hand, data cannot be aggregated, compared, and analyzed because doing so could reveal personally identifiable information, then these advances may not occur at all or may be delayed.
I would like to break this down into five aspects: the legal, economic, technological, political, and military aspects.
1. Legal
The EU prides itself on its strict laws and regulations, which prioritize data protection. This historically rooted perspective—which stems from the negative lessons learned from two ideologies that emerged from the German-speaking world, National Socialism and Communism, where the violation of citizens’ personal data led to the persecution, imprisonment, torture, disenfranchisement, and murder of citizens in many European countries—is understandable. Data must never again be used for these purposes. So beautiful, so understandable, so worthy of support, so good.
But the implications extend far beyond personal data. This is because even data generated by machines—for example, in manufacturing facilities—is always personal in nature. A machine is operated, maintained, and monitored by people. This means it is always possible to determine who was responsible for the machine in the event of damage. And this is where employees, works councils, and unions come into play, as they examine data collection in companies from the perspectives of necessity, minimalism, and traceability. Is the collection of specific data necessary for business operations? Can the company achieve its goals with less data? And can the data be traced back to individual employees, and can decisions regarding career advancement, salary, and potential layoffs be based on it?
This interpretation results in data collection within the EU being severely restricted. Not necessarily because the law or regulation explicitly requires it, but because corporate legal departments and the courts in each country interpret it more strictly than intended, as a precautionary measure.
Example: ViennaBeispiel Wien
An example of this comes from my hometown of Vienna, where the city-owned housing authority Wiener Wohnen manages 220,000 municipal apartments. Tenants had filed a complaint, claiming that their privacy had been violated because their names were listed on the doorbell nameplates. After consulting with the city’s data protection officers, the municipal housing authority began replacing 220,000 doorbell signs and labeling the doorbells “Top 1,” “Top 2,” “Top 3,” and so on, rather than using the tenants’ names. This interpretation of the GDPR attracted international attention, and the European Commission felt compelled to point out that this interpretation was incorrect.
This controversy illustrates how the GDPR has created legal uncertainty. And it continues to do so, because often even before data is collected, the GDPR is already at the center of the discussion—with the deterrent effect that the technology is not developed, or that developers’ “mental barriers” lead them to collect little or no data.
As a result, the data available in Europe is not only limited in scope, but it has also been drastically reduced. Furthermore, EU regulations require data collectors to let data become obsolete—that is, it may only be retained for a certain period of time and must then be deleted.
Example: Ottawa
The Canadian city of Ottawa used Google Street View imagery over a period of several years to analyze urban development and, in particular, the gentrification of neighborhoods. A similar analysis is not possible in Europe, as data collectors are required to delete the data after a certain period of time.
The EU’s efforts to achieve data sovereignty face similar challenges, as it focuses primarily on itself without seeing the bigger picture, which I would like to highlight in the following points.
2. Economical
European companies seem to view data center operations primarily as a cost center rather than a profit center. How else can one explain the reluctance among providers and the dominance of U.S. data centers and cloud operators in Europe?
According to Mordor Intelligence, the ranking of the leading data center providers by number of customers does not include any European providers, but—unsurprisingly—features three U.S. providers: AWS, Microsoft Azure, and Google Cloud. Next is OVHcloud, a French provider, followed by two other U.S. providers: Oracle and IBM.
And this is despite the fact that the EU is promoting data sovereignty and requiring that European data be hosted in Europe. Yet it is not SAP or Siemens that are taking the lead here, but rather those whom the EU actually wanted to keep out.
Here, too, the reality is that opportunities cannot be seized. Operating data centers not only provides learning opportunities and experience, but also creates demand for additional products and services—ranging from CPUs and GPUs to tools that enable reliability and the development of cloud-based solutions. This brings with it increased demands on broadband and mobile networks, resilience against cyberattacks, and a need for European production of processors, while also laying the groundwork for European AI models that embody European values, moral principles, history, culture, and local knowledge. All of these requirements create opportunities for new business sectors and companies.
From the perspective of data sovereignty, however, the issue—along with the General Data Protection Regulation—is limited to a purely hosting-related matter. No framework is being created to use this data for the benefit of Europe. This perspective resembles a conflicting decision between the U.S. and Europe. That case involved the copyright of databases, and the differing legal rulings on the matter led to conflicting economic dynamics.
Example: Database
In 1991, the U.S. Supreme Court faced the decision of whether databases should be considered original works and thus eligible for copyright protection. A local telephone service provider had refused to license information from its telephone directory to a publisher. The publisher then included the phone book entries in its own phone book without a license and was promptly sued for copyright infringement. The Supreme Court ultimately ruled that a mere collection of facts is not protected by copyright. Only an original method of collecting or categorizing the data is worthy of protection. However, a purely alphabetical arrangement of the data does not constitute originality.
At first glance, this decision seemed to prevent the creation of databases, since it was not possible to protect the work involved in creating them. For this reason, the EU decided in 1992 that databases would be protected by copyright for a period of 15 years. However, the exact opposite happened. In a Analysis of the European Union A 2005 study examined the effects of court rulings from 1991 and 1992. The study concluded, on the one hand, that the economic impact of the legal protection could not be verified and, on the other hand, that the predicted boost to the creation of databases in Europe did not materialize. One hundred American database creators experienced growth, while the database volume of their European competitors either remained flat or even declined.
All signs seem to indicate that the pursuit of data sovereignty is also hindering the economic momentum of the EU.
3. Technological
A representative of ASML, the world’s leading Dutch manufacturer of chip lithography equipment, revealed in the fall of 2026 that not a single order for these machines had come from Europe that year. At a time when the leading powers are engaged in a race for AI and data centers, the EU is fast asleep. No capacity is being built for the development and production of GPUs.
What good does it do Europeans to constantly boast about their technological capabilities if they never put them into practice for the benefit of humanity? It’s as if boasting about those capabilities were a substitute for actual action.
Data centers that are primarily operated by U.S. companies using CPUs and GPUs designed in the United States, and on which U.S. software runs and AI models are trained, do not demonstrate Europeans’ technological capabilities, but rather their dependence on American capital, expertise, and implementation capabilities.
And let’s not forget the additional services that data centers require: they consume a great deal of electricity and water for cooling. As described in The AI Data Centers Backlash, data centers with a total capacity of 31.7 GW are already under construction in the U.S., and another 191 GW are in the planning stages.
Due to the extreme demands on energy and cooling, companies are already looking for alternatives. One solution being seriously considered by companies such as Google, Amazon, and SpaceX is data centers in orbit, where there is sufficient solar energy and—though the technical details have yet to be worked out—sufficient cooling. SpaceX CEO Elon Musk has announced plans for one million satellite-based data centers in space, which he intends to deploy every 30 to 40 kilometers.
Can Europe keep up? Not yet, at least not technologically, because it lacks the launch vehicle capable of placing data centers of this size and in such large numbers into orbit.
4. Political
The European paradox that baffles me is that, on the one hand, the EU insists on building data centers in Europe so that the data of European users and companies can be stored and used there. On the other hand, residents are resisting the construction of data centers on their land. For example, the citizens of Groß-Gerau in Hesse stopped the construction of a €2.5 billion data center, and in Linz, Upper Austria, opposition is also beginning to mount against a data center that has been planned for years and is now under construction.
Dieser Hass auf Datenzentren kommt nicht von ungefähr: er scheint für die Bürger die einzig greifbare Möglichkeit, ihren Unmut gegen die einschneidenden Änderungen, die KI mit sich bringt, vorgehen zu können. Zum Schaden der eigenen Wirtschaft und der eigenen Datensouveränität. Man will digitale Services einer modernen digitalen Wirtschaft, man will saubere Energiequellen, aber bitte das Datenzentrum und das Windrad nicht bei mir.
The erratic stance of the current U.S. administration makes it clear just how problematic it is for U.S. providers to operate data centers in Europe. Even though the European branches of Microsoft and Google are legally separate from their U.S. parent companies, we have had to acknowledge that these companies can easily access European data when the U.S. government tightens the screws.
While the EU preaches and mandates data sovereignty, member states lack the political will to actually build the necessary infrastructure. Support for data centers in one’s own constituency is too significant—and thus too risky for re-election.
5. Military
For the past few days, the Ukrainian Army’s latest tactic has been to launch attacks on data centers belonging to the Russian internet giant Yandex. As early as the spring of 2026, Iran carried out attacks on AWS and Oracle data centers in Bahrain and the United Arab Emirates. Data was irretrievably lost in those attacks. Yandex’s situation in Russia is even more dire. Its data centers are much more concentrated, and the company—on which tens of thousands of Russian businesses rely for their business applications, as do taxi drivers and delivery services for orders, the entire logistics infrastructure of the Russian Federation, as well as telecommunications and internet services, AI services, and internet search—operates five large, concentrated data centers. As of today, three of them have been destroyed. And they were already operating at 95% capacity, meaning the remaining ones cannot easily compensate for the outages. Furthermore, rebuilding them within a short period of time is impossible, especially given the Western sanctions, which make the necessary processors difficult to obtain—and when they are available, only at exorbitant prices. Since the Russian Federation does not have its own chip production, it is dependent on foreign suppliers.
Added to this is the fact that, on the one hand, Russian laws prohibit the mirroring of data in friendly countries, while, on the other hand, Western sanctions also make it impossible to mirror the data from that side. One of the immediate consequences—which, for once, does not affect only Russian citizens—is that disinformation and misinformation campaigns on Western social media, controlled by Russian bots, dropped by up to 100% following the destruction of the Yandex data centers.
The example of Russia illustrates how the pursuit of data sovereignty and the lack of decentralization in data centers can pose an immense military risk. Data sovereignty that insists on operating data centers in Europe but fails to consider such a scenario creates risks. Data mirroring and the establishment of European data centers outside the EU—such as in Africa, the U.S., Asia, or even in orbit—should not be off-limits and should be a strategic element of data sovereignty and data security.
Conclusion
Viewing data sovereignty in isolation as a legal challenge, without considering the economic, technological, political, and military aspects in a tense geopolitical situation, does Europe more harm than good. The legal aspect pales in comparison to the others, yet this reality has not yet sunk in among European governments and companies.
The focus should be on how Europe can break free from its dependence on U.S. providers in the areas of data centers, AI models, chip production, and software, and how it can create a financial, technical, regulatory, and business framework that can eliminate this dependence.