As countries race to build domestic data centers in the name of sovereign AI, Saudi Arabia is betting on a more creative idea: a data embassy.
A data embassy, similar to a diplomatic embassy, is a place where data is stored outside a country’s physical borders, but operates under the laws of that country.
This concept is not new. Estonia established its first data embassy in 2017, but since then there has only been one data embassy from Monaco. Both embassies are located in Luxembourg and store backups of important data from both countries as a safeguard against cyber and climate risks.
As AI scales, this concept could gain traction as a way to build data centers overseas while operating within the laws of the developer’s country, given that energy is one of the biggest bottlenecks in building AI infrastructure in Europe.
At least that’s what Saudi Arabia hopes to see, as it positions itself as an exporter of data, not oil. Saudi Arabia is keen on solar energy, but the idea is in doubt because it lacks the water resources needed to cool its data centers. It comes as the country competes with its neighbors to become an AI hub and represents a potential shift in global power, as global investors and tech companies look to the Middle East for its rich influx of capital and talent.
Dealing with data embassies
Victor Mayer Schoenberger, a professor of internet governance and regulation at the University of Oxford, told CNBC that setting up and operating a data embassy would require bilateral international agreements on jurisdiction, which would be difficult in practice as the relevant legal framework is currently not in place.
Meyer-Schönberger said the guest and host countries would need to agree on guarantees that neither party breached the terms of the agreement. However, he added that this ultimately “depends on the trust of the parties involved.”
But Saudi Arabia aims to become the first G20 country to introduce such a framework. The draft Global AI Hub Act, released in April, established three levels of data embassies, ranging from guest countries with full autonomy to hybrid legal protections where Saudi courts can assist foreign courts.
This is another example of how AI competition could reshape geopolitics as Saudi Arabia leans closer to the US. There is no indication that the US is a preferred partner for the data embassy, but the two have established a “strategic artificial intelligence partnership” with Saudi Arabia that includes “building and developing advanced AI infrastructure.”
Asked whether the concept could resolve tensions over ByteDance’s TikTok, where the United States fears its citizens’ data is being accessed by the Chinese government and used to influence voters ahead of the 2024 election, Mayer-Schönberger was unconvinced.
“That would require complex bilateral agreements between China and the United States, which would take a very long time to negotiate. Moreover, given the distrust between the two countries, it is unlikely that the United States would trust China enough to make its data off-limits.”
big tech companies google and microsoft The company already offers its cloud computing customers local data centers hosted in Europe for sensitive data and a special governance structure designed to limit access to that data by the U.S. government.
“However, it remains to be seen whether such arrangements will actually protect access to data,” Mayer-Schönberger said.
A pressing concern: the decline of globalization
As globalization retreats and a new emphasis is placed on national security and economic competitiveness, data sovereignty concerns are in the spotlight, but there is little clarity on how regulations will evolve when it comes to embassies.
Sovereignty is an undefined term, notes Natalie Varela, head of privacy and data regulation for the EMEA region. palo alto networks. “Everyone is talking about it, but no one is defining it. So French sovereignty seems to be different from Spanish sovereignty,” she told CNBC.
Palo Alto Networks customers value three things. One is autonomy, protecting your data and understanding who has access and control. Digital resiliency to ensure uninterrupted service. Foreign Government Data Access.
Barrera sees data embassies falling into an intermediate category, especially with regard to Estonia and Monaco.
“This is not unlike the extraterritorial effect of GDPR,” he said, noting that there may still be data in the United States that is subject to European law.
“So this is just another option or setting to protect certain categories of data. My understanding is that these data are fairly sensitive data that governments need to keep from their citizens and employees, such as tax information, health information, administrative information, etc.,” she added.
Part of Saudi Arabia’s appeal lies in cost, and land for data centers is significantly cheaper, as is power and capital. The country is geographically located in an important position connecting Europe, the Middle East and Asia.
“If Saudi Arabia can provide data center services at a lower cost than the countries that need them, it makes sense,” said Hortense Bioy, head of sustainable investing research at Morningstar Sustainalytics.
However, “the rise of data centers has introduced new ESG considerations, with carbon emissions and water usage now widely recognized as the most pressing concerns.”
Arid regions have an abundance of sunlight, but their power grids are still powered by fossil fuels. According to data from the International Energy Agency, approximately 64% of Saudi Arabia’s total energy supply in 2023 will come from oil, suggesting that in this case the trade-off for sovereignty may be sustainability.
Overall, Mayer Schoenberger remains skeptical that data embassies can become the next big thing. “Nation states remain powerful and globalization is in decline,” he said.
