Interpretations of Information Privacy and Data Protection Law: Is there Data Sovereignty for Individuals under EU Law?

Data sovereignty has no one unanimous definition or content. Sovereignty is a fundamental concept in law and in many other sciences. While traditionally in legal science, sovereignty has been associated to states and territory, expressions related to digital sovereignty or data sovereignty have emerged rapidly in recent EU policy discourses. In these, also articulations about the role of the individual have emerged. To that, normatively, an important starting point is a premise of the EU’s general data protection regulation (GDPR), according to which “[n]atural persons should have control of their own personal data.” Several EU policy documents further underscore a human centric digitalization. However, to claim that an individual is or would be sovereign from a data standpoint, is not straightforward. This research examines how the concepts of data sovereignty, digital sovereignty, (information) privacy and data protection interact, and how they manifest in regulation, case law, literature and policy stances in Europe. The main research questions this work attempts to answer are what is meant by individual data sovereignty, and on what normative rules and principles is it premised in the EU. With these, the work aims to approach contemporary data sovereignty, its content, and interconnections with EU law, with state sovereignty, as well as data protection and privacy law. Ultimately, the work aims to establish whether it can be claimed that individuals have data sovereignty and what that might mean. As there is no one single EU law to govern this topic, many interpretations about the more exact content, the rights involved and the scope of data sovereignty and its implications to individuals are possible. This is also about power, governance, and decision-making at many levels. Data sovereignty and privacy are also value-laden and somewhat subjective too, providing possibilities for multiple interpretations. Interconnections to sovereignty issues at EU- or state level include issues about the internal market, legitimacy and trust. Data sovereignty – as well as digital sovereignty – can be seen to represent more recent facets or interpretations of these discourses and societal developments. Despite the nascent growth of the subject in the policy discourses, this is also still very much a policy challenge, and calls for further policy discussions on the topic.