EUROPEAN DIGITAL INFRASTRUCTURE AND DATA SOVEREIGNTY A POLICY PERSPECTIVE FULL REPORT EUROPEAN DIGITAL INFRASTRUCTURE AND DATA SOVEREIGNTY - A POLICY PERSPECTIVE CONTENTS ACKNOWLEDGEMENTS 3 4 TECHNICAL ANNEXES 36 INTRODUCTION 4 4.1 USERS: STATISTICS, ATTITUDES, BEHAVIOURS… 36 4.2 DATA PROTECTION AND CYBERSECURITY… 40 4.2.1 Europe 40 1 OBJECTIVE, SCOPE AND KEY CONCEPTS 8 4.2.2 USA 42 4.2.3 Asia 44 1.1 OBJECTIVE AND SCOPE 8 4.2.4 Identity Management 46 1.2 MAKERS, SHAPERS, AND USERS 9 4.3 PLATFORMS AND DATA FLOW IMBALANCES 46 1.3 THREE IDEAL-TYPICAL MODELS OF REGULATION 12 4.4 CYBER SECURITY 49 2 PERSPECTIVES AND TRENDS 13 NOTES AND REFERENCES 57 2.1 DIGITAL INFRASTRUCTURES 13 2.1.1 5G 13 2.1.2 IoT 14 2.1.3 Clouds 14 LIST OF FIGURES 2.1.4 Platforms 15 FIGURE 1: THE REGULATORS/INNOVATORS DILEMMA 9 2.1.5 Artificial Intelligence 16 FIGURE 2: DIGITIZATION AS KEY CONNECTING INFRASTRUCTURE 10 2.1.6 Cybersecurity 18 FIGURE 3: DIGITAL ECOSYSTEM MAIN STAKEHOLDERS 10 FIGURE 4: 5G USAGE SCENARIOS 13 2.2 DATA PROTECTION 20 FIGURE 5: AI SURVEILLANCE - COUNTRY ADOPTION AND LEADING SUPPLIERS 16 2.2.1 Introductory overview and key concepts… 20 FIGURE 6: AI SURVEILLANCE TECHNOLOGY ORIGIN 17 2.2.2 Data governance and decentralisation 20 FIGURE 7: DATA PROTECTION AND PRIVACY LEGISLATION WORLDWIDE 21 2.2.3 Data ownership and access control 20 FIGURE 8: THE REGULATION EQUALISER 30 2.2.4 Identity management 21 FIGURE 9: PROPOSED SCENARIOS 30 2.2.5 Data processing 22 FIGURE 10: RADAR ASSESSMENT OF SCENARIOS IMPACTS 33 2.2.6 Final consideration on GDPR and beyond 22 FIGURE 11: THE REGULATORS/INNOVATORS SOLUTION 35 2.3 CRITICAL ISSUES 22 FIGURE 12: THE SITUATION IN THE EU REGARDING THE 5 DESI INDICATORS 38 FIGURE 13: CYBERSECURITY PROBLEMS AND DEVELOPMENT OF DIGITAL… 39 FIGURE 14: CYBERSECURITY PROBLEMS AND EFFECTS ON ONLINE… 39 FIGURE 15: FIRMS ADDRESSING CERTAIN CYBER RISK BY COUNTRY… 40 3 FROM SCENARIOS TO SMART POLICY 25 FIGURE 16: FIRMS HAVING A FORMALLY DEFINED CYBERSECURITY POLICY… 40 FIGURE 17: FIRMS WITH A FORMALLY DEFINED CYBERSECURITY POLICY… 40 3.1 POSSIBLE POLICY RESPONSES 25 FIGURE 18: REGULATORY LANDSCAPE IN ASIA-PACIFIC 46 3.1.1 General approaches 25 FIGURE 19: USERS WHO ARE AWARE THAT COOKIES CAN TRACK… 48 3.1.2 Digital infrastructures 27 FIGURE 20: PROPORTION OF NATIONAL CORPORATIONS AT EACH… 48 3.1.3 Data governance 28 FIGURE 21: PROPORTION OF NATIONAL CORPORATIONS… 48 3.1.4 Cybersecurity 28 FIGURE 22: TOP 25 PLATFORMS HEADQUARTERED IN THE US, NATIONALLY… 48 3.2 PROPOSED SCENARIOS 29 3.3 TOWARD SOLUTIONS FOR THE REGULATORS 33 2 EUROPEAN DIGITAL INFRASTRUCTURE AND DATA SOVEREIGNTY - A POLICY PERSPECTIVE ACKNOWLEDGEMENTS In the context of its activities in its strategic innovation area: Digital Industry, EIT Digital decided to launch a study focusing on the main policy challenges concerning the future of digital infrastructures also in relation to data governance and the consequences for Europe’s sovereignty and economic strength. The study followed a scenario-based approach to structure and assess the potential impacts of policy measures with the main focus on various potential methods of regulation of modern digital infrastruc- tures and the relation to personal data governance. Digital Enlightenment Forum was contracted to execute the study under the guidance of EIT Digital senior staff. The very nature of the study strongly leads to strong attention to important European values, potential for global sovereignty and Europe’s economic well-being. The study context is multi-dimensional and multi-disciplinary, and therefore demanded strong involvement by high-level experts from various disciplines for a profound assessment of the different dimensions and their inter- relations. We were fortunate to have had such support throughout the study and in particular during through two Round Tables and electronic communication. We would like to acknowledge with gratitude the contributions of: Michal Boni (former Member of European Parliament), Patrice Chazerand (Director Public Affairs, Digital Europe), Peter Dröll (EC/ RESEARCH), Oliver Gray (Graywise, Consulting), Nina Hyvärinen (F-Secure), Volkmar Lotz (SAP), Evangelos Ouzounis (ENISA), Reinhard Posch (CIO Austrian Gov), Bart Preneel (Univ. Louvain BE), Luigi Rebuffi (EOS, ECSO). Particular thanks go to Cristiano Codagnone (Univ. degli Studi di Milano), Thanassis Tiropanis (Univ. Southampton) and Yannis Stamatiou for their strong support providing a sound knowledge base and understanding of the complexity of the issues involved. And to Isaac Oluoch (Univ. of Twente, NL) for his help with analysing the literature. 3 EUROPEAN DIGITAL INFRASTRUCTURE AND DATA SOVEREIGNTY - A POLICY PERSPECTIVE INTRODUCTION The objective of this study report is to provi- innovation and according to recent experimental evidence de an analysis and set of scenarios as a tool has produced wide benefits for consumers that escape GDP measurement (Brynjolfsson et al., 2019). for policy shapers on the future of digital in- frastructures and personal data governance. • Modern Artificial Intelligence (AI) extracts value from data. Can we combine European value-based regu- More data means more accurate AI models, which in turn lation with vibrant innovation for a sovereign, means potentially more benefits to society and business. We may expect a transition in production processes thanks secure and trusted European society? In this to the adoption of AI, leading to significant economic growth introduction some of the main themes of the and increase of economic output. The UK Government Of- report are anticipated. fice for Science expected 100 billion connected IoT devices already by 2020. ETNO, a major European telecoms asso- THE WORLD’S MOST VALUABLE RESOURCE ciation, expects 5G will underpin the rapid growth of the IoT (Palovirta & Grassia, 2019). IS NO LONGER OIL, BUT DATA… • The IoT will have a huge impact on automotive, industry, The parallelism between oil and (personal) data was intro- retail and smart building equipment. duced in 2006 with the additional observation that, as with crude oil, data are valuable but if not refined cannot be used • A document of the German Ministry of Economy official- (Palmer, 2006). Data, and especially personal data, is the new ly presenting the project Gaia-X – a European cloud aiming crude asset for which a complex ecosystem of entities has to provide “the next generation of data infrastructure for emerged to collect, analyse and trade the value that may be Europe: a secure, federated system that meets the highest extracted from it (often via behavioural insights). The impor- standards of digital sovereignty while promoting innovation” tance of this view on data has been repeated by many af- – underscores how cloud infrastructure can multiply the terwards. power and benefits as it encompasses the full spectrum of information technology and provides to firms in an efficient The power of data is at the heart of what has been termed way (BMWi, 2019, p. 5). digital transformation and forms the pivotal element of the Fourth Industrial Revolution. Several trends have brought • World-class connectivity in 5G is expected to be a key ena- data to the core of innovation, including cheaper and more bler of Europe’s digital economy and of the increasing digiti- readily available storage and processing power, increasing zation of services and industrial processes, cutting costs and availability of data through online social networks and Inter- increasing efficiencies (See Palovirta & Grassia, 2019). net of Things (IoT), and data analytics improvements through the deep learning revolution. All of these are expected to be further powered by the deployment of 5G networks. These …YET DESPITE PROMISED BENEFITS, current and future trends have produced and are poised to ANXIETY AND TENSIONS ARE RISING further fuel network effects: data processing software be- comes smarter as the volume of data contributed by people The data economy is generating several major concerns and their devices increases, which in turn makes the online and international tensions. First, much of the data powe- services that employ such smart software more appealing ring those innovative services are personal or of a sensitive and, consequently, attracts even more data. nature. The ongoing transformation affects all aspects of human reality (see Floridi, 2014 and Schwab, 2016, 2018), DATA AND EMERGING DIGITAL blurring the distinction between physical, digital and biologi- cal spheres. In this context, it comes as no surprise that the INFRASTRUCTURES HOLD GREAT EU Ethics Advisory Group has expressed concern on the rela- POTENTIAL FOR ECONOMY AND SOCIETY… tionship between personhood and personal data, the risks of discrimination as a result of data processing, and the risks of The data-driven digital transformation is a main source of undermining the foundations of democracy (Ethics Advisory 4 EUROPEAN DIGITAL INFRASTRUCTURE AND DATA SOVEREIGNTY - A POLICY PERSPECTIVE Group, 2018). In Europe, GDPR was a regulatory intervention 1 November, 2019 that a ‘sovereign internet’ law took effect to address some of those concerns. There has been support in Russia: Moscow effectively gave itself the power to erect a for the principles of GDPR to be adopted in the US, with Mi- sort of digital Iron Curtain around its networks, with the law crosoft being one of the proponents of a US GDPR that lets allowing Roskomnadzor, Russia’s telecoms agency, to shut people take control of their data. This follows the introduc- the country off from external