Data sovereignty in the EU: commitments and contradictions

Data in the EU is growing rapidly in volume and production, underscoring the need for more cohesive legislation on data privacy and sovereignty across Member States. The EU’s current data strategy commits to transparency, accountability, and consumer consent during data processing, but are these commitments still being upheld?

The European Union has made digital sovereignty a key goal in its policies and has passed several laws in the last ten years to protect personal data and oversee how data is collected, used, and shared across the EU. These laws aim to manage data within a single European market while still allowing for innovation.

For example, the Data Governance Act (2022) and the Data Act (2025) are aimed at highlighting the potential for data-driven innovation and economic growth in the EU, with the legislation seeking to encourage trustworthy systems for storing and sharing data, ensure efficient access to and use of data, and promote competition in the European market.

The General Data Protection Regulation (GDPR, 2018) is a landmark framework in the European Union’s history of digital transformation. Essentially, it provided the legal architecture for the entire wave of modern digital decade laws. It establishes data privacy as a fundamental right for all EU residents and encourages safe, free movement of data across the EU. Article 5 of the GDPR sets out principles including lawfulness, fairness and transparency, data minimization and accountability. Individuals should have clear information about how their personal data is being used, while organizations handling that data remain responsible for protecting it.

GDPR in action

The General Data Protection Regulation consists not only of technical regulations but also of an effective framework which has real-world effects. For example, Google breached the law between May 2018 and February 2020. In September 2026, the Irish Data Protection Commission (DPC) fined Google €403 million for not informing users that it was tracking their online and app activity as well as their location history and accuracy. This significant penalty represents one of the largest enforcement actions taken by the Data Protection Commission (DPC) since the GDPR came into force in 2018 and shows that the EU is still committed to protecting personal data when it is compromised.

The fact that enforcement has taken place shows that the EU has established a comprehensive data protection framework, but it also leads us to raise some important questions: Does data protection mean the same as data sovereignty? Is it sufficient simply to protect individuals’ data? Who actually has final control over the data – people, organizations, or governments?

A shift in priorities

As the global artificial intelligence race accelerates, data has become the ultimate strategic asset – one that major economies are racing to amass at any cost. So the critical question here is: What happens if the term ‘personal data’ is redefined?

The EU’s data strategy stresses the importance of accounting for economic growth in data policymaking, as indicated by the Data Governance Act and subsequent Data Act. But what lengths is the EU willing to go to support its economy? According to an article published by NOYB, newly leaked documents from the Irish Presidency expose an intent to liberate the use of personal data for AI purposes. This means personal data in the EU would be sold to AI companies based in the US and China, home to leading artificial intelligence corporations.

Under the GDPR, redistributing EU citizens’ personal data without a lawful basis is grounds for a violation. To avoid fines, the Irish Presidency, along with the European Commission, has sought to operationalize this shift through the Digital Omnibus proposal. Framed as administrative “simplification” and red-tape reduction, the proposal quietly redefines what counts as personal data. It narrows down identifiability and carves out broad exemptions for AI model training.

This legal engineering paves the way for frictionless data sharing between foreign and domestic AI databases. Despite strong warnings from data watchdogs like the European Data Protection Board (EDPB) that this would uproot the essential privacy guardrails, it was intended to promote competition with existing AI businesses by creating more opportunities to strengthen the EU’s position as a new contender in AI innovation.

European data sovereignty shouldn’t mean replacing foreign monopolies with domestic ones, nor should protecting European data from foreign governments become a justification for disproportionate surveillance or overreach by European authorities. EU policymakers are now deciding if the profit of investing in AI is greater than protecting citizens’ fundamental right to privacy and the protection of their personal data.

Pirates for privacy

Data sovereignty is more than simply keeping data within EU borders. The European Pirates believe that EU data legislation should protect European organizations and citizens from external interference as well as ensure they have substantial control over the data they share and depend on.

The European Pirates have determined that there are three main areas in the EU’s digital decision-making process: technological sovereignty and open infrastructure, privacy and user control, and an open and competitive digital ecosystem. The issue now is whether these priorities correspond with those of the EU legislators. This involves actively working with various stakeholders by providing accessible and transparent disclosure channels and by increasing participation from civil society and technical experts, as well as supporting international cooperation on the basis of common safeguards relating to privacy, security, and fundamental rights, together with a firm and proportionate reaction to discriminatory restrictions imposed by other countries without resorting to general localization and protectionism.

The European Pirates recognizes the importance of promoting European competition. However, this economic approach should not contradict or weaken EU citizens’ fundamental rights.Protecting European data from exploitation by foreign governments or businesses is vital. This includes using personal data to develop AI products for the global market. EU data sovereignty should not sacrifice privacy, individual control, or data compatibility in the name of innovation or economic growth.

The Future of European Data Sovereignty

The DPC’s case against Google for breaking the GDPR from 2018 to 2020 shows that the EU is following its own data rules. At the same time, there is a debate about changing these rules to help the economy. This conflict over data privacy creates unclear standards for how data will be handled in the future. If the EU starts to relax its strict data privacy laws to support economic growth, it prompts questions about what the EU is willing to give up when it comes to data sovereignty.