Data Sovereignty and the Future of Citizenship

When Vietnam’s government voted to pass a cybersecurity law on June 12, objections were raised both inside and outside the country; objections largely  centered around the government’s tightening grip on social media and its stifling effect on free speech. In addition, the new cybersecurity bill includes a provision that requires foreign Internet firms operating in Vietnam to house the data of Vietnamese users within the country, thus putting the user’s data under the jurisdiction of Vietnam’s laws.

Data Sovereignty

This concept, known as data sovereignty, is not new. A 2017 report by the Information Technology and Innovation Foundation (ITIF), a Washington D.C. think tank, cites 36 countries as implementing some form of data sovereignty or its cousin, data localization. ITIF cites this as a potential scourge for the global economy, with the potential knocking up to 3% off the gross domestic products of some of the world’s largest economies. Certainly, any barrier to trade increases the economic risk of a given country. As such, Vietnam’s new law – and other data sovereignty laws- need to be considered in this context.

Data sovereignty also brings up another context, one that asks questions surrounding the concept of an individual’s digital citizenship. Before I get too far down a dystopian road where the singularity exists and we all function in a Second-Life environment (or, God forbid, a Fortnite environment) let me be clear: these are questions — and extreme questions at that —   concerning where we could go as citizens of the Internet. (I refuse to use Netizens, since it conjures too many emotions surrounding Netscape, my favorite browser circa 1997.)

Okay. Off we go.

The Sovereignty of Digital Personas

Our online lives have created a digital version of each of us, a digital persona that represents who were are based our inputs into various online entities. As stated in a 2013 paper What is a Digital Persona, authors Derrick de Kerckhove and Miranda de Almeida define a digital persona as a model of…individuals established through the collection, storage, and analysis of data about that person.

So here’s the speculative question: what citizenship rights do digital personas have?

The key to this is in the collection and storage of an individual’s data. If a large portion of an individual’s data were housed in the United States, could an individual claim digital birthright citizenship given that, in theory, an individual’s digital persona was born within the United States?

Additionally,  we need to consider to what extent country’s will go to protect their digital citizens. Is it conceivable that an armed attack — cyber or analog — could be initiated as a preemptive strike on policy or program that is harming their citizens. Countries have gone to war under similar circumstances: consider that the 2008 conflict in South Ossetia began as a response to what the Russians felt were threats to their citizens living in Georgia. (There’s a lot more that could be said about this conflict and questions of citizenship, but I digress.)

While these questions are highly speculative, they broadest takeaway is this: despite its near-ubiquitous presence in global life, there is much to be sorted out in terms of the Internet and data. As Kerkhove and Almeida state:

“…society, experts, institutions and groups are still in a fragile, unconscious or preconscious phase, regarding the nature of the digital persona; ethical and mature management of its features (from legal to behaviour features, from political visions to technological ethics); and the need to develop more comprehensive, ethical, and friendly self-management tools.”