The Data Trilemma: Sovereignty, Interoperability, and Economic Regulation

On August 13, Data Privacy Brasil, in partnership with the Diplo Foundation, held the panel “The Data Trilemma: Sovereignty, Interoperability, and Economic Regulation” during CPDP Latam. Moderated by Jaqueline Pigatto (Data Privacy Brasil), the panel featured Marília Maciel (Diplo Foundation), Carolina Rossini (University of Massachusetts), Jamila Venturini (Derechos Digitales), and Cristiane Rauen (Brazilian Ministry of Development, Industry,  Commerce and Services). This blog post not only presents the discussions held during the panel, but also expands on some of the complex issues raised during the conversation at the event, such as digital sovereignty, Brazil’s current position in the international landscape, and some possible paths forward for the country.

The panel first sought to situate data governance within the global agenda, particularly since 2024, when the issue gained momentum organically in the context of Brazil’s G20 presidency, during which topics such as Artificial Intelligence and Digital Public Infrastructure were being discussed. Still in 2024, “data governance” explicitly emerged as one of the five major objectives of the United Nations Global Digital Compact, leading to the creation of a dedicated Working Group within the UN Commission on Science and Technology for Development, which is currently moving toward finalizing its first report.

Next, Marília Maciel drew a connection between narratives of sovereignty and economic security. She illustrated these tensions through the layered architecture of Artificial Intelligence – hardware and computing capacity, models, application interfaces (APIs), and the language/content layer – showing how export controls and other economic security measures affect each of these layers differently, with negative effects on the ability of Global South countries to access cutting-edge technology and participate in the AI value chain.

The location of data centers was discussed as another point of tension within these narratives. According to her, localization can have a positive impact on the enforcement of domestic laws and can help boost the digital economy, but it is insufficient to guarantee sovereignty, development, and economic security. Other countries, such as the United States, may use extraterritorial mechanisms, such as the CLOUD Act, to access data in Brazil. Moreover, greater value generation is concentrated in higher layers – such as algorithm and platform development – rather than in data processing. According to Maciel, it is necessary to develop an industrial policy that distinguishes between foreign and domestic, public and private data centers. Such a policy should be aligned with instruments aimed at strengthening competition, such as the bill on competition in digital markets, as well as measures that leverage Brazil’s data economy.

For Cristiane Rauen, a representative of the Brazilian government, attracting data centers should be tied to a data policy, going beyond proposals for specific regimes, such as Redata. Rauen brought a perspective centered on the so-called Digital Economy and its relevance for Brazil. Her definition describes the Digital Economy as the share of economic activity that is enabled, scaled, or transformed by digital infrastructure, data, connectivity, platforms, and digitally skilled human capital. Growing sectors within this economy include software and AI services, semiconductors, and cybersecurity.

In this context, Rauen discussed the Digital Stack, in which each layer of this chain represents a critical link in national sovereignty, including data. She also presented quantitative data on the Brazilian context: 5,066 digital services in 2026, 554 data centers in the country, and 90% of the population with Internet access. Regarding value generation from data, she pointed out, based on the results of a 2026 public consultation conducted by the Ministry of Development, Industry and Foreign Trade (MDIC), that 86% of industrial data is not used in the country, compared to 70% globally. From an industrial perspective, the data exists but remains siloed, meaning that there are opportunities for data use and sharing. The demands identified through the consultation indicate that 81% seek legal certainty, while 62% seek clear and standardized rules.

To treat data as an economic asset, Rauen presented the proposal for “Bolsas de Dados” (Data Exchanges), aimed at facilitating the offering, discovery, contracting, remuneration, access, delivery, and monitoring of the use of non-personal data through organized market platforms, embedded in or integrated with data-sharing spaces. Furthermore, the consultation results show that 53% of respondents identified a lack of a data-oriented organizational culture as a barrier to data sharing.

Several federal government initiatives stand out in this context: the Brazilian Artificial Intelligence Plan (PBIA), with initiatives focused on processing language models and applications requiring high-performance computing and Portuguese-language databases; the National Data Infrastructure, with large datasets from public entities and state-owned IT companies; the National Digital Inclusion Plan, focused on infrastructure, meaningful connectivity, and digital literacy; and CIT Digital, an Interministerial Committee for Digital Transformation with a Technical Chamber on the Digital Economy. According to Rauen, fostering the digital economy should be a public policy priority for promoting Brazil’s industrial and technological sovereignty.

For Carolina Rossini, adopting AI needs to be connected to countries’ strategic challenges, something Brazil still needs to define in terms of investment priorities, namely what its service offering should be. This leads to a discussion about interoperability and which standards the country will adopt, as this directly affects the distribution of power: economic power, market power, and regulatory capacity.

Therefore, the question should not simply be “how do we open data?”, but rather “who has the capacity to absorb what is being opened up?” Formal openness, masked by neutrality, can produce a material asymmetry: if everyone has access to the same data, but only some actors have the computational, financial, or organizational capacity to transform it into value, interoperability may reinforce precisely the concentrations of power it was intended to reduce.

From this perspective, it is necessary to determine where interoperability should be mandatory. An essentiality test could be used, inspired by the logic of essential infrastructure: the obligation should apply where access to data is a relevant condition for competing or exercising a right. This could include identity, payment systems, healthcare, urban mobility, or transaction histories in highly concentrated markets. In other words, these are areas that a company or country may consider strategic for development, thereby connecting to a possible digital sovereignty strategy.

In organizational terms, Rossini proposes a formalized interinstitutional coordination mechanism involving the National Data Protection Authority (ANPD), the Administrative Council for Economic Defense (CADE), the Ministry of Development, Industry,  Commerce and Services (MDIC), the Ministry of Management and Innovation in Public Services (MGI), and relevant sectoral regulators. It is not enough to rely on informal cooperation. Clear protocols are needed regarding competencies, case referrals, and conflict resolution. The experience of the Digital Regulation Cooperation Forum in the United Kingdom offers an interesting reference in this regard.

It is also necessary to delegate regulatory authority for defining and updating technical standards, with multistakeholder participation and review cycles established from the outset. There is little sense in embedding rigid technical specifications in ordinary legislation when they may become obsolete even before implementation. Finally, there is the issue of sustainable funding. A data infrastructure without recurring revenue or a recurring budget is an empty structure.

Jamila Venturini emphasized the importance of data protection as an instrument for enabling digital sovereignty. According to her, although it is not sufficient on its own, its principles should be asserted, including in international spaces where they are commonly rendered invisible. Venturini addressed the very concept of “sovereignty” from a civil society perspective. In this regard, she pointed out that its adoption by Latin American social movements since the 1990s highlights the idea that peoples should be able to determine context-specific policies and modes of production. In other words, this understanding prioritizes the protection of the rights of people and communities in the face of global production chains.

For her, this notion is not reflected in some of the interpretations of sovereignty currently advanced by states, which, in the case of the Global South, focus on the possibility of participating in the digital economy as a pathway to development. This is because proposals involving Digital Public Infrastructures (DPIs) or AI models and applications not only maintain dependencies at the infrastructural, technological, and legal levels, but are also based on weakening guaranteed rights, including the right to personal data protection, to enable database integration, secondary uses, and sharing with third parties. The same applies to the installation of large data centers, which not only fail to overcome dependency relationships but also act as drivers of environmental harm in the territories where they are located.

According to Venturini, studies by Derechos Digitales point to a possible expansive interpretation of the exception for data use in the context of public policies aimed at enabling the integration of AI into the public sector. At the same time, new spaces for abuse emerge, including discrimination and state surveillance, if additional safeguards are not incorporated to address these new uses.

According to her, integration into the digital economy on these terms entails risks, while the benefits are unclear both for communities and for national development. She referred to the recent Report of the UN Scientific Panel on AI, which shows that there is no scientific evidence of macroeconomic gains resulting from the integration of AI into productive systems.

Therefore, genuine digital sovereignty must challenge the inevitability of AI and ensure that people can determine how and whether to incorporate it. This is particularly important when the state seeks to act as a driver of value generation from data, raising the fundamental question of meaningful civil society participation, particularly that of the groups most affected, in the development of policies and decision-making on AI throughout its lifecycle.