Digital sovereignty: why and when is it relevant and mistakes to avoid for companies

Digital sovereignty has become more timely for several reasons, one of which is the shift in the US administration's operations. Many countries, organizations, and companies have begun to scrutinize their reliance on foreign products and services, and the implications of that dependence.

To help companies better understand digital sovereignty, we have gathered a guidebook to help. The guidebook is available in Finnish and can be downloaded here.

Janne Kalliola: chair of the Code from Finland association & digital sovereignty expert

Janne Kalliola, Chair of the Code from Finland association, is an expert on digital and data sovereignty. The association is also building a coalition with the aim of creating an ecosystem of digital services that replaces monolithic platforms from single vendors.

We asked Janne some questions about digital sovereignty. You can find our interview below.

Relevancy, importance, cybersecurity and the situation in Finland

Why is digital sovereignty a relevant issue?

“Several factors have made digital sovereignty more relevant. One is the shift in the US administration's approach. Europe has realized just how deeply intertwined it is with US companies, for better or worse. Additionally, the importance of data has grown. The significance of the data economy and data processing has increased. The significance of artificial intelligence has increased tremendously. 

It is evident that European companies no longer hold the same market share. Consequently, the EU has begun to curb the activities of US firms, as business operations in many sectors are concentrated in the hands of very few players (resulting in duopolies or even monopolies). In practice, by using services from companies based outside the EU, we are funding their product development. This accelerates their development processes, and the money spent flows elsewhere, instead of being reinvested into development within our own country or the EU.”

In what situations does digital sovereignty become particularly important for companies?

“There are various perspectives and situations regarding when digital sovereignty gains importance. One angle involves the legislative framework and associated risks, for example the US Cloud Act, which conflicts with the EU’s GDPR. There is a risk that if a US company is compelled to disclose data under the Cloud Act, it might simultaneously violate the GDPR obligations of its European customer. Such extraterritorial laws are becoming increasingly common, and operating under multiple legal jurisdictions simultaneously presents greater legal complexity. Legal risks are rising, although the actual materialization of those risks is, of course, a separate matter.

Another perspective concerns the flow of capital to a different economic region, where it remains. Instead of circulating within Finland or the EU, where it could flow back and support domestic development, the money stays abroad.”

What are Finnish companies or organizations doing well regarding digital sovereignty, and what areas need improvement?

“Many parties are keen to advance and develop digital sovereignty. Finland is well-positioned to do this, given our status as a high-tech nation and the fact that we already possess many excellent solutions. However, much like in the fight against climate change, achieving significant impact requires broad-based action.

Digital sovereignty can seem like a distant or abstract concept, with effects that are not immediately visible in everyday life. Ease and convenience may take precedence over development efforts. In practice, everyone needs to take action.”

“Finland is 92% dependent on digital services provided by the United States.”

How does Finland’s situation compare to the rest of Europe?

“According to Proton’s data (Europe’s tech sovereignty watch), Finland is 92% dependent on digital services provided by the United States. This means, that if connections to the US were severed, these services would cease to function. Finland ranks fourth highest in Europe in this regard, near the top of the list. This figure also reflects the extent of our spending on services from abroad, although a country’s level of digital advancement plays a role; the more digitally advanced a country is, the more heavily it tends to rely on the United States.”

How does the Code from Finland association take digital sovereignty into account?

“Code from Finland (fin: Koodia Suomesta) is building a coalition based on the core idea of ​​fostering cooperation within Finland; Finns supporting fellow Finns. After which the priority would be to support European services, and only then choosing services from outside Europe. The goal is to collaboratively build a multifaceted cloud service solution, or interoperable solution components, that can serve as alternatives to hyperscalers. In this work, Code from Finland acts as a facilitator. Rather than solving the problem itself, the association brings together the actual solution providers and fosters enthusiasm among them. The aim is to generate interest among the general public. Additionally, we support the citizens' initiative on digital sovereignty (fin: digitaalinen itsenäisyys -kansalaisaloite).”

How are digital sovereignty and information security linked?

“US-based systems are often considered more secure. In reality, Finnish and European providers take information security just as seriously. For example, Finnish programmers rank among the best in the world. However, a large user base can lead to issues being discovered and fixed more quickly.

Decentralizing services often increases the need for security as the number of vendors and integrations grows. However, decentralization ensures that if one system is compromised or breached, it does not necessarily affect the others. Security challenges differ between a single-vendor model and a decentralized model.”

Risks, common misconceptions and mistakes to avoid

In what situations should an organization genuinely be concerned about the state of its digital sovereignty?

“In situations involving external issues, such as problems related to GDPR compliance when dealing with foreign service providers. There can also be internal issues, for example, the organization might not know where its data is processed, where it travels, or who handles it. There is a lack of proper control over the data.”

What risks do organizations face if they fail to consider digital sovereignty?

“These include legal risks, which can be significant even if their probability is generally low. Another major risk is unpredictability and a lack of clear visibility into their own operations. The better an organization understands its own operations, the better it can control them. For example, the risk of data breaches decreases when there is greater understanding and suppliers can be required to provide explanations, rather than simply being trusted blindly.

In the long run, failing to support expertise within one’s own economic region leads to declining competence levels and an increased risk of economic decline.”

“Good things happen along the way, too.”

What is the most common mistake to avoid regarding digital sovereignty?

“An "all-or-nothing" mindset, trying to change everything at once. It is best to avoid abrupt moves and instead approach the matter step by step. Risks and measures should be categorized and prioritized before taking action. A phased yet determined approach pays off. Significant progress in digital sovereignty can be achieved within a few years.”

What is the most common misconception about digital sovereignty?

“A common misconception is that US-based solutions are significantly better or more cost-effective than European alternatives — in reality, we have solutions available that are of equal or even superior quality. Admittedly, the level of integration between solutions might be lower, and you may not necessarily get every required feature from a single service provider. However, relying on a single provider limits opportunities for negotiation or competitive tendering, and switching providers can be difficult. The pricing models used by these providers also often result in the customer paying more than they would if they utilized multiple service providers.

Another major misconception is the idea that there is nothing left to be done. Without attempting to address the issue, it is impossible to know whether it can be influenced. In practice, making the attempt would at least lead to increased competence here in Finland. And, in the best-case scenario, it would result in achieving digital sovereignty or improving its level. Good things happen along the way, too.”