Digitale Souveränität Teil 1

When Ursula von der Leyen took over as President of the European Commission in 2019, she called on Europe to achieve digital sovereignty.

The demand in Europe arose against the backdrop of controversies such as the Snowden revelations, particularly in response to the strong presence of foreign, mainly US and Chinese technology companies, as well as growing concerns about increasing dependence on non-European providers of digital solutions.

Technological dependencies on individual providers lead to considerable switching costs and additional barriers at company level, known as the lock-in effect. If a company or organization no longer has the option of switching between different technical solutions, its freedom of decision and action is severely restricted, which in turn has a negative impact on digital sovereignty.

In 2010, the French government warned against the loss of sovereignty in the face of foreign technology companies. The then Prime Minister François Fillon emphasized the dominance of North American providers in the field of cloud computing and that this market played a decisive role in the competitiveness of the economy, sustainable development and national sovereignty. To counteract this development, the government focused on promoting a "sovereign cloud" ("le cloud souverain") and decided to promote cooperation with cloud computing companies to strengthen the domestic economy.

The following years have seen significant legislative and legal developments in the field of data protection on both sides of the Atlantic. In 2016, the EU passed a new pan-European data protection law - the General Data Protection Regulation (GDPR) - while in the US, the CLOUD Act at the federal level gave law enforcement agencies the ability to request data stored in data centers in third countries.

The enforcement of the GDPR has led to significant fines for companies that violate data protection regulations. Cross-border data transfers are permitted under the GDPR as long as the data is transferred to a country with an adequate level of data protection. Compliance with the GDPR poses challenges for companies. It is not only associated with costs for implementing the requirements but also requires administrative and technical measures. Small and medium-sized companies often find it difficult to implement the compliance requirements efficiently and cost-effectively.

In addition to the legal framework, the aim was to expand Europe's digital infrastructure. In the same year that the GDPR was adopted, the European Commission launched the "European Cloud Initiative" as a key factor in the Digital Single Market Strategy. The establishment of a "cloud made in the EU" was seen as an essential step towards securing digital sovereignty and reducing dependence on non-European providers. This was intended to maintain control over European data and at the same time strengthen the competitiveness of the European cloud market.  

There is no uniform definition of digital sovereignty in the existing literature. This is partly due to the fact that the concept of sovereignty itself has undergone a dynamic development historically and has never been clearly defined. While sovereignty used to refer primarily to states, digital sovereignty is now increasingly discussed in the context of relationships with foreign companies, possibly even more so than with states.

In the Digital Sovereignty focus study conducted by the Federal Ministry for Economic Affairs and Energy in 2021, the simplified definition was used to clarify the term in a survey of 1,219 companies in the information economy and manufacturing sector:

"Digital sovereignty describes the ability to shape the digital transformation in a self-determined way with regard to hardware, software, services and skills. With regard to digital technologies and applications, this means being able to decide for yourself to what extent you want to become dependent on providers and 'partners' or avoid doing so".

A strong dependence on non-EU providers was increasingly perceived here: More than 80 percent of companies stated that they were somewhat or heavily dependent on non-European providers in at least one technology area. The areas of hardware/infrastructure and software/applications are particularly affected.

16% of companies in the information economy and 19% in the manufacturing industry even reported being dependent on non-EU providers in all relevant technology areas. The main reasons cited were the limited range of alternatives from the EU and the technological superiority of current providers.

A European alternative involving the storage of data on the territory of the Union presupposes that the digital infrastructures in the EU are capable of meeting internal demand. Initiatives at national and EU level that support the expansion of this infrastructure emphasized the current inadequacy of this very infrastructure.

In October 2019, the German Federal Minister for Economic Affairs, Peter Altmaier, and the French Finance Minister, Bruno Le Maire, officially announced the launch of Gaia-X - the European data infrastructure project - at the annual digital summit in Dortmund. In a field dominated by American and Chinese technology giants, Germany and France are focusing on building a federated European cloud.

Gaia-X aims to create a secure and networked cloud and data infrastructure that strengthens digital sovereignty and promotes innovation, particularly in the field of AI. The aim is to reduce dependency on individual providers and the lock-in effect and to overcome the monopoly-like position of large digital companies from the USA.

"Gaia-X is dead," said Frank Karlitschek, Managing Director of Nextcloud, to Wirtschaft Woche on February 7, 2025. In February 2025, Nextcloud announced its withdrawal from the Gaia-X consortium. The project's original goal of creating a European cloud alternative to the large American providers was no longer being pursued. Karlitschek criticized the fact that Gaia-X had moved away from its original vision over time and ultimately lacked the political will to establish a European infrastructure.

Concerns had previously been raised as numerous companies and even German authorities continued to rely on familiar cloud solutions. In November 2021, the French multicloud provider Scaleway, a founding member of the consortium, left the project during the Gaia-X summit in Milan, which was organized with great PR effort. "Gaia-X will not create a European cloud. It will give a little more sovereignty. But that's not enough for me," said Yann Lechelle, Managing Director at the time.

Like many other European members, he criticized the fact that non-Europeans can be part of the initiative. When the Chinese companies Huawei and Alibaba as well as AWS were among the main sponsors of the summit, an event that was supposed to promote a "trustworthy and sovereign digital infrastructure for Europe", the Frenchman was fed up. "In Europe, people are afraid to protect European players for fear of accusations of discrimination. That's naive and opens the door," criticized Quentin Adam, Managing Director of Clever Cloud and member of Gaia-X.

Interestingly, it was precisely against this backdrop that calls for digital sovereignty gained in importance with the aim of making digital infrastructure more independent and securing control over strategically important data.

The broad scope of the GDPR and the high fines in the event of violations have meant that US technology companies have had to adapt to European data protection standards. However, while European regulations set global standards, Europe remains dependent on non-European providers when it comes to digital infrastructures and cloud technologies.

The so-called Brussels Effect has contributed to international companies increasingly investing in GDPR-compliant data centers - such as AWS' €7.8 billion investment in a European cloud region in Germany - but this has not achieved true digital independence.

Gaia-X should have been a key project for Europe's digital sovereignty. Peter Altmaier had promised "the moon landing of digitalization". However, the initiative was increasingly dominated by multinational corporations and key European players withdrew in disappointment. Without consistent promotion of European alternatives and the political will to establish independent digital infrastructures, the lock-in effect will remain: Companies will continue to be forced to rely on established solutions, mostly from the US, because European alternatives are either lacking or not competitive.

While digital sovereignty is repeatedly propagated as a strategic goal in Europe, developments to date show that the reality is different: despite ambitious plans and regulatory measures, many roads still lead to America - and Europe remains in the digital fast lane.

Part two of the series will take a closer look at concrete solutions: How open source software and initiatives can serve as alternatives to large software products, where Europe's digital dependency is particularly strong.

Author: Cüneyt Baluch