Saudi Arabia eyes data embassies amid sovereign AI push
As countries race to build local data centers in the name of sovereign AI, Saudi Arabia is investing in a more creative idea: data embassies.
A data embassy is where data is stored outside a country’s physical borders but operates under its own laws, like a diplomatic embassy.
The concept is not new. Estonia established its first data embassy in 2017, and only one other embassy has opened since then, Monaco. Both embassies are located in Luxembourg and maintain backups of the countries’ critical data as a security measure against cyber and climate risks.
As AI scales, the concept could gain momentum as a way to set up data centers abroad in places with abundant resources and power, while still operating within the laws of the developer’s country, given that energy is one of Europe’s biggest bottlenecks in building AI infrastructure.
At least that’s what Saudi Arabia is counting on as it positions itself as an exporter of data rather than oil. Saudi Arabia is investing heavily in solar energy, but water resources needed to cool its data centers are scarce, casting the idea in doubt. It represents a potential shift in global power and comes at a time when the country is battling its neighbors to become an artificial intelligence hub, as global investors and tech firms turn to the Middle East for their deep pockets and influx of talent.
Data ambassador agreements
Viktor Mayer-Schönberger, Professor of Internet Governance and Regulation at the University of Oxford, told CNBC that setting up and operating data embassies will be difficult in practice because they require bilateral international agreements on jurisdiction and there is currently no relevant legal framework.
The guest country and the host state must agree on assurance that neither party violates the terms of the agreement, Mayer-Schönberger said. But he added that this would ultimately “depend on the trust of the parties involved.”
However, Saudi Arabia aims to be the first G20 country to implement such a framework. In April, the draft Global AI Hub Law identified three levels of data stewardship, from the host country having full autonomy to hybrid legal protection where Saudi courts can assist foreign courts.
This is another example of how the AI race could reshape geopolitics as the Kingdom. Proximity to the US There is no indication that the US is a preferred partner for data embassies, but the pair have established a “Strategic AI Partnership” with Saudi Arabia that includes “the construction and development of advanced AI infrastructure”.
Asked whether the concept could resolve tensions around ByteDance’s TikTok, where the United States fears its citizens’ data is being accessed by the Chinese government and used to influence voters ahead of the 2024 election, Mayer-Schönberger was unconvinced.
“This would require a complex bilateral agreement between China and the US that would take a very long time to negotiate; moreover, given the distrust between the two countries, it is difficult to imagine that the US would trust China to keep data outside its borders,” he said.
Big Technology Companies Google And Microsoft cloud computing currently offers customers local data centers hosted in Europe for sensitive data, as well as a proprietary management structure designed to limit U.S. government access to that data.
“It is not yet clear whether such regulations can truly protect data from access,” Mayer-Schönberger said.
Urgent concerns, declining globalization
While data sovereignty concerns are being raised as globalization recedes and new emphasis is placed on national security and economic competitiveness, there is little clarity on how regulations will evolve when it comes to embassies.
Nathalie Barrera, responsible for privacy and data regulations in the EMEA region, stated that sovereignty is an undefined term. Palo Alto Networks. “Everyone is talking about it but no one has defined it, which means France’s sovereignty looks different than Spain’s sovereignty,” he told CNBC.
Palo Alto Networks’ customers care about three things: Autonomy, which includes protection of data, who has access, and control; digital flexibility to ensure uninterrupted service; and access to foreign government data.
Barrera considers data embassies to be in the middle category, especially in the context of Estonia and Monaco.
“This is no different from the extraterritorial impact of the GDPR,” he said, noting that there may still be data in the US that is subject to European law.
“And this is a different option or setup to protect certain categories of data, which, as I understand it, are highly sensitive data that the government needs to keep from citizens and employees, like tax information, health information, administrative information,” he added.
Part of Saudi Arabia’s appeal is its cost, as land as well as energy and capital for data centers are significantly cheaper. The country is geographically well positioned as a connecting point between Europe, the Middle East and Asia.
“It makes sense for Saudi Arabia to be able to offer data center services at a lower cost than countries that need them,” said Hortense Bioy, head of sustainable investment research at Morningstar Sustainalytics.
However, “the rise of data centers brings with it new ESG considerations that are now widely accepted, with carbon emissions and water intensity among the most pressing concerns.”
Although solar is abundant in the arid state, its grid is still largely powered by fossil fuels. According to data from the International Energy Agency, approximately 64% of Saudi Arabia’s total energy supply was provided by oil in 2023; this suggests that the compromise for sovereignty in this case may be sustainable.
As a result, Mayer-Schönberger remains skeptical about the potential for data embassies to be the next big thing. “The nation state is still very strong and globalization is weakening,” he said.
