Litigating Data Sovereignty

Abstract

Because the Internet is so thoroughly global, nearly every aspect of Internet governance has an extraterritorial effect. This is evident in a number of high-profile cases that cover a wide range of subjects, including: law enforcement access to digital evidence; speech disputes, such as requests to remove offensive or hateful web content; intellectual property disputes, and much more. Although substantively distinct, these issues present courts with the same jurisdictional challenge: how to ensure one state's sovereign interest in regulating the Internet's local effects without infringing on other states' interests?

The answer, for better or for worse, is a subset of foreign affairs law known as the sovereign-deference doctrines. Sovereign-deference arguments now pervade a number of consequential cases, including Google's challenge to the "right to be forgotten" in Europe and Microsoft's ongoing challenge to a court order to produce foreign-held emails under the Electronic Communications Privacy Act, and they will play a significant role in future cases. But foreign affairs law's proper application to cross-border Internet disputes is not what many litigants and courts have claimed. Crucially, no sovereign-deference doctrine prohibits global takedown requests, foreign production orders, or other forms of extraterritorial exercises of jurisdiction over the Internet. To the contrary, one of the key lessons of the sovereign-deference jurisprudence is that in order to avoid tensions between sovereigns, courts often enable, rather than retard, extraterritorial exercises of authority.

This article has three goals: (1) to identify and characterize an emerging body of case law-what we might call the data sovereignty litigation-a diverse set of cases that each pits national sovereigns against large Internet firms; (2) to show how the doctrinal rules of sovereign deference ought properly to apply to these disputes; and (3) to make the case for a policy of sovereign deference beyond courts. The stakes are considerable. If we do not find ways to accommodate legitimate sovereign claims over global cloud activity, states will forcefully assert those interests-typically through mandatory data localization and related measures-imposing significant costs on entrepreneurship, privacy, and speech.