Civics · Law · Geopolitics: Privacy and Surveillance

"Data sovereignty" tackles a new problem: data flows without borders, but jurisdiction has borders. A single piece of information may be generated in country A, sit on a server in country B, and be processed by a company in country C — so when something goes wrong, whose law applies? States have developed two families of tools.

Data localization: requiring certain data to be stored domestically, so national law and law enforcement can "reach" it. Extraterritoriality: conversely, extending domestic rules abroad — if you handle our citizens' data, wherever your company sits, you must follow our law. Both are different ways of stuffing "borderless data" back into "bordered law."

• EU: extraterritoriality anchored to the "individual." The General Data Protection Regulation (GDPR), effective 2018, applies to any company processing the data of people in the EU, even from abroad, with fines up to €20 million or 4% of global annual turnover, whichever is higher. It ties protection to the person, not the server's location.
• US: a "long arm" anchored to control. The 2018 CLOUD Act requires companies under US jurisdiction to hand over data they control in response to lawful demands — even if the data is stored abroad. The logic: whoever controls the data is responsible, regardless of where it sits.
• China: anchored to "domestic storage + tiering." The Data Security Law and the Personal Information Protection Law require "important data" and data held by "critical information infrastructure" to be stored domestically, with security reviews for cross-border transfers. The logic treats data as a strategic resource bearing on national security, managed by tier.

The two faces of localization. For (steelman): if data sits domestically, national law can genuinely protect citizens, enforcement can reach it, and the risk of foreign intelligence access falls — this is both a privacy argument and a sovereignty argument. Against (steelman): mandatory localization raises corporate costs, fragments the global market, and may make it easier for one's own government to access the data — "protection" and "ease of surveillance" are often two sides of the same coin. In 2020, the EU Court of Justice, in the Schrems II case, struck down the "Privacy Shield" framework governing EU–US data transfers, citing the inadequate, non-equivalent protection under US surveillance law — a landmark of exactly this tension: cross-border data flow is, at bottom, a question of whether different surveillance-and-protection regimes can trust each other.

Misconception: "Whichever country the data sits in governs it." Reality is more tangled — GDPR asserts jurisdiction by "who the data subject is," the CLOUD Act by "who controls the company," both potentially overriding the server's physical location. The same batch of data may be claimed by two or three legal regimes at once; how to reconcile the conflict is precisely what makes data sovereignty so thorny.

There is a structural reason surveillance capacity swells: cost collapse. Tailing one person used to require agents on the ground — so expensive it could only target a handful, which was itself a "natural limit." Now location data, cameras, and cross-linking make mass, continuous, retrospective surveillance nearly free at the margin — so the constraint on "whom to watch" no longer comes from cost, and must come from institutions.

The classic institutional restraint is the warrant requirement: before a search, the government must state its reasons to a neutral judge and obtain authorization, rather than deciding on its own. Its essence is inserting a third-party review between watcher and watched — turning "search whenever you like" into "get approval first."

• US: courts slowly catching up to technology. In Carpenter v. United States (2018), the FBI obtained 127 days of a suspect's cell-site location records (about 12,900 location points) without a warrant. The Supreme Court held 5–4 that obtaining seven or more days of historical location data is a "search" requiring a warrant — and made clear that "the fact that data was handed to a third party (the phone carrier) does not by itself surrender constitutional protection."
• EU: limits set by proportionality. The EU Court of Justice has repeatedly ruled that requiring telecoms to indiscriminately and generally retain everyone's communications metadata violates fundamental rights — surveillance must be "targeted and proportionate to the threat," not universal retention merely because it is technically feasible.

Security vs. checks. For more surveillance room (steelman): against terrorism, transnational crime, and child sexual abuse material, after-the-fact investigation is often too late; intelligence must act quickly and covertly, and cumbersome warrants may lose the moment. For strong restraint (steelman): the danger of surveillance power is that it is inherently covert and hard to hold accountable — those watched often don't know and cannot complain; once "exceptions" become routine, the chilling effect quietly reshapes a whole society's speech and conduct. The question is not "surveillance or not" but where the review checkpoint sits, who staffs it, and whether it can later be discovered and held to account.

Misconception: "I've done nothing wrong, so why mind being watched?" This "nothing to hide" argument has two blind spots. First, privacy protects not only "secrets" but the freedom not to be arbitrarily scrutinized — knowing you might be watched, people unconsciously shrink their words and actions (the chilling effect). Second, it assumes the watcher is always benevolent, never errs, and power never changes hands — yet institutional design exists precisely to guard against the moments those assumptions fail.

A "right to privacy" is not an ancient, fixed right, but one redefined with each technological shock. Tracing its evolution reveals a pattern: the law's understanding of privacy always lags behind technology, then is forced to catch up.

Roughly three stages: the right to be let alone — privacy was first understood as "the right not to be disturbed," aimed at covert photography and exposure of private life; a reasonable expectation of privacy — the focus shifted from "physical space" to "human expectation": where you are matters less than whether society accepts that you have reason to expect not to be watched at that moment; informational self-determination — the digital age shifted further toward "you have the right to decide how information about you is collected and used," turning privacy from "hiding it" into "being able to control it."

• From space to expectation: the US case Katz v. United States (1967) established the "reasonable expectation of privacy" standard — police wiretapped outside a public phone booth, and the Court held the Constitution "protects people, not places." This shifted privacy from "did they break into your home" to "did you have reason to expect this conversation not to be heard."
• Informational self-determination codified: Germany's Federal Constitutional Court, in its 1983 "census ruling," established the "right to informational self-determination" — individuals have the right to decide for themselves how their personal data is disclosed and used, an idea that deeply shaped later European data-protection law.
• The contested "right to be forgotten": the EU Court of Justice, in a 2014 case, recognized that under certain conditions individuals may ask search engines to remove outdated, inappropriate links about them. Supporters see it as an extension of informational self-determination; critics worry it collides with the public's right to know and with the historical record — every expansion of privacy must redraw a boundary with some other value.

Is privacy "individual" or "social"? Privacy as an individual right (steelman): it protects individual autonomy and dignity, the last shield against the state and the giants, and should not be lightly overridden by "collective interest." Privacy as social infrastructure (steelman): privacy also has a public face — in a society where everyone feels watched, dissent, creativity, and trust wither, so privacy in fact protects the health of public life as a whole and cannot be left entirely to individual "consent." This split directly shapes institutional choices: the former leans toward "informed consent" models, the latter toward hard floors of "even if you consent, some data may not be collected."

Misconception: "I clicked 'agree,' so clearly I don't care about privacy." In practice, so-called "informed consent" is often a lengthy clause no one reads plus a take-it-or-leave-it choice — hard to call a real, free decision. That is exactly why many jurisdictions set hard floors beyond "consent" (e.g., certain sensitive data may not be collected regardless of consent), because they believe: staking privacy entirely on one individual click cannot protect what privacy truly aims to guard.

"Security vs. liberty" is one of the oldest political tensions, and new technology tends not to ease it but to push it to the extreme — because technology often has no "middle gear." Two contemporary flashpoints illustrate this best.

End-to-end encryption: only the two communicating parties can decrypt, not even the service provider can see the content. It gives ordinary people strong protection against theft, but also means law enforcement cannot read it even with a lawful warrant. The difficulty is that a "backdoor" almost cannot be made "for the good guys only" — once you open a gap for enforcement, technically it is equally open to criminals and foreign intelligence, and security drops for everyone at once. Facial recognition is the reverse: for the first time it makes it cheap and feasible to "identify everyone, in public space, at mass scale, in real time," erasing the historical norm of "anonymity in the crowd."

• The encryption fight: no middle ground. Law-enforcement bodies in several countries ask firms to retain "lawful access" to encrypted communications; most cryptographers and technologists reply that mathematically you cannot build a backdoor that "opens only for lawful requests and closes for attackers" — weakening encryption weakens it for everyone. This is one of the rare issues where an engineering fact directly constrains the policy space.
• Facial recognition: spectrum regulation. Facing the same technology, jurisdictions choose very differently: at one end, some cities and regions ban or strictly limit government use of real-time facial recognition; at the other, it is widely used for public safety and governance. The EU's AI Act takes a middle path of risk-based tiering, imposing strict limits and exceptions on real-time remote biometric identification in public spaces.
• The "surveillance capitalism" debate: scholars argue that the real business model of many free services is collecting behavioral data at scale to predict and influence people's choices. The dispute: is this a knowing, equivalent exchange by consumers, or a new kind of extraction that is hard to call voluntary given the vast gap in information and power?

Encryption backdoors: two demands that both hold. For access (steelman): encryption is being used for serious crime, and if enforcement hits a "can't read it" wall even with a lawful warrant, that creates a legal blind spot. For strong encryption (steelman): a backdoor cannot be for the good guys only — it simultaneously weakens the communications of journalists, dissidents, businesses, and even the government itself; "making everyone more vulnerable to catch a few bad actors" is a bad bargain. The tension in facial recognition is different: it may not violate any specific piece of privacy, but it changes the social baseline of "anonymous by default" — once everyone is identifiable at any moment by default, even if no one actually looks you up, the very sense of "possibly being recognized" shrinks the freedom of public life. What both share: technology makes the trade-off coarser-grained, forcing all-or-nothing choices.

Misconception: "Just leave a backdoor only the government can use — best of both worlds, right?" This is perhaps the most common misconception on this topic, and the one technologists most oppose. The cryptographic consensus: a backdoor is a systemic weakness that does not care "who is knocking" — the gap you open for enforcement can be found and exploited by attackers and foreign intelligence too. So this is not primarily a political question of "do you trust the government," but first an engineering question of "can such a backdoor even exist securely" — and most experts' answer is no.