Ascountries race tobuild domesticdata centersin the name of sovereign AI,Saudi Arabia is betting on a more creative idea: data embassies.
A data embassy is where data is stored outside of a country’s physical borders butoperatesunder its laws, much like a diplomatic embassy.
The concept is not new. Estoniaestablishedthe first data embassy in 2017andthere’sonly been one other since,fromMonaco.Bothembassiesare inLuxembourgand holdabackup ofthecountries’critical data, set upas a security measure againstcyberand climate risks.
As AI scales, the concept couldgain momentumas a way tobuild data centers overseas — in places that have plenty of resources and power, given energy is one ofEurope’s biggest bottlenecks in buildingAI infrastructure — while stilloperatingwithin the laws of the developer’s country.
At least,that’swhat Saudi Arabia is counting on as it positions itself asanexporter of data rather than oil.Saudi Arabiais betting hard onsolar energy, but its water resources— needed to cool data centers —are scarce,dousingthe idea in doubt. It comes as the country battles its neighbors to become an AI hub as global investors and tech firms turn to the Middle East for its deep pockets and influx of talent, representing a potential shift in global power.
Data embassy dealmaking
Getting data embassies up and runningwouldbe tricky in practiceas theyrequirebilateral international agreementsonjurisdictionandthere is currently norelevantlegal framework in place,Viktor Mayer-Schönberger, professor of Internet governance and regulation at the University of Oxford,told CNBC.
The guest country and host statewouldhave to agree onassurances that neither party is violating the terms of the agreement,Mayer-Schönberger,said.However, this will ultimately”depend on the trust of theparties involved,” headded.
Saudi Arabia, however, has set its sights on becoming the first G20 country to introduce such a framework. In April, its Global AI Hub Law draft set outthree levels of data embassies, ranging from the guest countryretainingfull autonomy tohybrid legal protectionswhere Saudi courts couldassistforeign courts.
It is another example of howthe AI racecouldreshapegeopolitics as the Kingdom cozies up to the U.S.There has been no indication of the U.S. being a preferred partner for data embassies, but the pair has established a “Strategic Artificial Intelligence Partnership” with Saudi Arabia that includes the “building and developing advanced AI infrastructure.”
When asked whether the concept could solve tensions around ByteDance’s TikTok, where the U.S. feared itscitizens’data was being accessed by the Chinese government andused to influence votersahead of the 2024 election,Mayer-Schönbergerwas not convinced.
“It would require a complex bilateral treaty between China and the US that would take very long to negotiate; moreover, given the distrust between the two nations, it is hard to imagine that the US would trust China to keep the data off limits,” he said.
Big Tech firms Google and Microsoftalreadyoffertheircloud computing customers with local datacentershosted in Europe for sensitive data, as well asa special governance structure designed to limit U.S. government access to that data.
“Whether such arrangements wouldactually protectthe data from access remains to be seen, however,”Mayer-Schönbergersaid.
Pressing concerns, waning globalization
While concerns of data sovereignty have come into focus as globalization backslides and fresh emphasis is put on national security and economic competitiveness, there is little clarity on how regulations will evolve when it comes to embassies.
Sovereignty is an undefined term, noted NathalieBarrera,who heads upprivacy anddataregulationsin the EMEA regionatPalo Alto Networks.”Everyone’s talking about it, but no one has defined it, meaning sovereignty for France looks different than sovereignty for Spain,” shetold CNBC.
Palo Alto Networks’ customers care about three things: autonomy, which involves the protection of data, understanding who has access, and control; digital resilience to ensure uninterrupted services; and foreigngovernmentdata access.
Barrerasees data embassies falling in the middle category, especially in the context of Estonia and Monaco.
“This is not unsimilar than the extra territoriality effect of GDPR,” she said, noting that there can be data in the U.S. that is still subject to European laws.
“And so, this is just adifferentoption or a setup to protect certain categories of data, which, from my understanding, it’s pretty much sensitive data that the government needs to hold, such as tax information, health information, administrative information, from its citizens and employees,” she added.
Part ofSaudi Arabia’slure is itscost, as land for data centers is significantly cheaper, as is powerand capital. Thecountryiswell positionedgeographicallyas aconnection between Europe, the Middle East and Asia.
“It makes sense if Saudi Arabia can offer data centre services at a lower cost than countries that need them,” said HortenseBioy, head ofsustainable investing research at MorningstarSustainalytics.
However, “the rise of data centres introduces new ESG considerations which are nowwidely recognised, with carbon emissions and water intensity among the most pressing concerns.”
While the sun is plentiful in the arid state,itsgrid is stilllargelypowered by fossil fuels. Around 64% of Saudi Arabia’s total energy supply wasfrom oil in 2023, according to International Energy Agency data, suggesting in this case thetrade-offfor sovereignty could besustainability.
In all,Mayer-Schönbergerremains skeptical on the potential for data embassies to become the nextbig thing. “The nation stateremainstoo powerful and globalization iswaning,” he said.
About The Author
