52
expressly prescribed by Article 8(3) of the EU Charter of Fundamental of
Rights (Digital Rights Ireland 2014, para. 68; cf. Tele2 Sverige 2016,
para. 122).
More recently, in the summer 2019, the data protection authority of
the German Land of Hessen temporarily ordered Hessian schools not to
use Microsoft Office 365 (Der Hessische Beauftragte für Datenschutz und
Informationsfreiheit 2019a; cf. Walden 2011). The decision followed
Microsoft’s announcement that the company would not ensure data storage on the German cloud only. The supervisory authority found that the
risk of allowing US authorities to access European children’s data without
appropriate guarantees made the use of Microsoft’s software unacceptable
from a fundamental rights perspective (Der Hessische Beauftragte für
Datenschutz und Informationsfreiheit 2019a, para. 2). The Hessian ban,
which was originally extended to Google and Apple cloud applications
(Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
2019a, para. 5), was subsequently lifted a month later following an intense
phase of dialogue with Microsoft. The supervisory authority, however,
stated that the investigation would have continued in light of several legal
and technical issues still to be solved (Der Hessische Beauftragte für
Datenschutz und Informationsfreiheit 2019b).
The first decision of the Hessian data protection authority justified the
ban of Microsoft Office 365 to preserve the state’s “digital sovereignty”
(Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
2019a, para. 2). Digital sovereignty is a concept that permeates the recent
debate on data localisation in Europe widely and particularly in Germany.
For example, it is the primary goal of the Gaia-X Project launched in 2019
by the German Ministry for Economic Affairs and Energy (Federal
Ministry for Economic Affairs and Energy (BMWi) 2019, p. 6). In the
Ministry’s document, digital sovereignty is defined both as “independence” and as “self-determination” (Federal Ministry for Economic Affairs
and Energy (BMWi) 2019, p. 7). Remarkably, this concept is not uniquely
linked to the state dimension, encompassing also the power of companies
to freely determine the use and structure of their digital systems, data and
processes (Federal Ministry for Economic Affairs and Energy (BMWi)
2019, p. 7). In this way, digital sovereignty is presented as a solution to the
European dependence from foreign companies and infrastructures, as well
as to offer an opportunity to abide by and affirm European values.
Yet, the project of achieving European digital sovereignty is not immune
from the typical criticism characterising data localisation legislation
E. CELESTE AND F. FABBRINI
expressly prescribed by Article 8(3) of the EU Charter of Fundamental of
Rights (Digital Rights Ireland 2014, para. 68; cf. Tele2 Sverige 2016,
para. 122).
More recently, in the summer 2019, the data protection authority of
the German Land of Hessen temporarily ordered Hessian schools not to
use Microsoft Office 365 (Der Hessische Beauftragte für Datenschutz und
Informationsfreiheit 2019a; cf. Walden 2011). The decision followed
Microsoft’s announcement that the company would not ensure data storage on the German cloud only. The supervisory authority found that the
risk of allowing US authorities to access European children’s data without
appropriate guarantees made the use of Microsoft’s software unacceptable
from a fundamental rights perspective (Der Hessische Beauftragte für
Datenschutz und Informationsfreiheit 2019a, para. 2). The Hessian ban,
which was originally extended to Google and Apple cloud applications
(Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
2019a, para. 5), was subsequently lifted a month later following an intense
phase of dialogue with Microsoft. The supervisory authority, however,
stated that the investigation would have continued in light of several legal
and technical issues still to be solved (Der Hessische Beauftragte für
Datenschutz und Informationsfreiheit 2019b).
The first decision of the Hessian data protection authority justified the
ban of Microsoft Office 365 to preserve the state’s “digital sovereignty”
(Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
2019a, para. 2). Digital sovereignty is a concept that permeates the recent
debate on data localisation in Europe widely and particularly in Germany.
For example, it is the primary goal of the Gaia-X Project launched in 2019
by the German Ministry for Economic Affairs and Energy (Federal
Ministry for Economic Affairs and Energy (BMWi) 2019, p. 6). In the
Ministry’s document, digital sovereignty is defined both as “independence” and as “self-determination” (Federal Ministry for Economic Affairs
and Energy (BMWi) 2019, p. 7). Remarkably, this concept is not uniquely
linked to the state dimension, encompassing also the power of companies
to freely determine the use and structure of their digital systems, data and
processes (Federal Ministry for Economic Affairs and Energy (BMWi)
2019, p. 7). In this way, digital sovereignty is presented as a solution to the
European dependence from foreign companies and infrastructures, as well
as to offer an opportunity to abide by and affirm European values.
Yet, the project of achieving European digital sovereignty is not immune
from the typical criticism characterising data localisation legislation
E. CELESTE AND F. FABBRINI