Europe can teach Canada a thing or two about digital sovereignty

Prime Minister Mark Carney is in Strasbourg, getting feted by the European Parliament.

The news is that Canada wants to get closer to the EU, and the Europeans are willing to consider Canada as some kind of “Associate Member” of the union.

The full scope of the partnership is unclear, but reporting suggests that we will see increased co-operation on defence, trade, critical minerals, science, culture and more.

One under-discussed area where Canada could particularly benefit from closer alignment, though, is digital sovereignty. Canada is new-ish to digital sovereignty concerns; our efforts to resist the dominance of U.S. tech giants really only revved up in the past two years, since Donald Trump was re-elected— in the past year, we are investing in sovereign AI, sovereign compute, data centres, and sovereign broadband. 

But the Europeans have a much longer and more developed history of working to assert their digital sovereignty. By using the EU as a model, Canada can accelerate our digital sovereignty at home, while also positioning ourselves for future economic co-operation with our friends across the pond.

Some of the EU regulation may be familiar to Canadians. The reason that iPhones switched from Lightning cables to USB-C a few years ago? That was in response to a European Parliament directive.

You might have also heard about GDPR, which was the gold-standard privacy law globally, when it was enacted in the EU in 2018. By comparison, Canada has been trying to pass a modernized privacy law since 2018, but multiple bills have stalled in Parliament. Our latest attempt, Bill C-36, was introduced in June. If it actually gets passed into law, it’ll include some measures directly inspired by GDPR. 

But the landmark policy from the EU is only part of the story. Since 2022, the EU has enacted 16 union-level pieces of legislation dealing with digital sovereignty.

This includes a suite of policies focused on investing in digital infrastructure and supporting sovereign EU cloud service providers.

Through the EU’s Cloud Sovereignty Framework, they are now assessing how sovereign a company is, based on the level of foreign control.

Individual states are taking this approach as well, with France, Germany, Belgium, Switzerland, Italy, and Austria choosing to move away from American-built software products in favour of open-source software programs for their public services. This is partly because they want sensitive data stored outside the jurisdiction of the US CLOUD Act, which allows the US government to subpoena data from any US-based company, even if the data is stored abroad. 

Germany’s Cyberagentur, the cybersecurity innovation agency, is another clear example of how Europeans are pursuing a clear digital sovereignty strategy. The agency aims to anticipate what Germany and Europe will need to assert digital sovereignty in 5-10 years, and then commissions research teams and industry partners to develop solutions.

In many cases, Canada can pursue deeper integration with the EU simply by copying their homework, and adopting their regulations in whole or in part. In other cases, like the Cyberagentur, Canada could leverage our own cybersecurity expertise to co-develop solutions with our European allies. 

Unfortunately, Canada can’t fully copy the Europeans’ work without running afoul of certain provisions that we’ve agreed to in major free trade agreements — the Canada-US-Mexico Agreement (CUSMA) and the Trans-Pacific Partnership (TPP), in particular. In some cases, we can adapt European regulations in a way that avoids violating these trade agreements —  sovereign infrastructure capacity and cybersecurity are likely covered by national security exemptions embedded in CUSMA and TPP. 

However, looking at the bigger picture, Canada is navigating a moment of geopolitical “rupture” as the prime minister has called it. We’ll need to decide whether these free trade agreements are benefitting us, whether we need to renegotiate them, or whether we should abandon them altogether. (Donald Trump has already sort of beaten us to that conclusion, at least with CUSMA. Thanks Donald!)

One of the most striking lessons that Canada has learned in the past two years, as we work to assert our own digital sovereignty, is the challenge of size. When Meta blocks all news links because they oppose the Online News Act, we implicitly see a company that is asserting that they’re too big to regulate, and Canada is too small for them to bother with. 

By aligning more closely with the EU, we join a population of more than 450 million people. Size matters.

In reading the EU’s published definition of digital sovereignty, we see something that Canada can partner with — a principle of self-determination mixed with collaboration: 

“The EU and its member states’ ability to act autonomously and to freely choose their own solutions, while reaping the benefits of collaboration with global partners, when possible. This involves setting and enforcing our own legal framework in accordance with internationally accepted principles.”