1. What is Data Sovereignty?

Data sovereignty = Data is subject to laws of the country where it is collected or where data subject resides, regardless of where it is stored.

Three models fighting globally:

1. Territorial Model (EU / India): Data of our citizens stays under our protection even if transferred. GDPR Art 44-49, India RBI localization.
2. Extraterritorial Access Model (US CLOUD Act): US provider must produce data in its possession, custody or control regardless of where in world data physically sits.
3. Absolute Localization Model (China, Russia, Vietnam): Personal data of citizens must be stored locally, copy cannot leave without security assessment.

Conflict arises when Model 2 demands what Model 1 or 3 prohibits.

2. Types of Conflicts

A. Transfer vs Localization Conflict
RBI says payment data must be stored only in India. GDPR says EU personal data cannot go to India unless India has adequate protection. US CLOUD Act says Microsoft must hand over data stored in Ireland if DOJ asks.

B. Investigation vs Privacy Conflict
US prosecutor wants emails in Dublin for drug trafficking case. Irish law says disclosure violates EU privacy.

C. Sovereign Access vs Trade Secret
India DPDP Act 2023 Sec 17(2) exempts State from law for sovereignty, security, public order. So government can access data that GDPR says must be protected.

3. Landmark Case Laws - The Core Conflict Cases

A. The Origin of Conflict - US vs Microsoft (Microsoft Ireland Case 2013-2018)

Facts: Between 2013 and 2018, US authorities demanded that Microsoft, via warrant under Stored Communications Act, hand over customer's emails stored on servers in Ireland. Microsoft resisted all way to Supreme Court.

Microsoft argument: US warrant cannot reach Ireland, would break European privacy rules.

Outcome: Never decided on merits because Congress passed CLOUD Act in March 2018 to clarify answer. That law says US companies must produce data regardless of location. Supreme Court vacated case as moot in April 2018.

Legal Principle Established: Territorial restraint is dead. US moved to "control" test, not "location" test. This is direct cause of today's sovereignty conflicts.

B. Schrems I & Schrems II - EU Strikes Back

Schrems I (Case C-362/14, 6 Oct 2015): CJEU invalidated Safe Harbor framework. Max Schrems argued Facebook Ireland transfer to US exposed him to NSA surveillance. Court held US does not provide essentially equivalent protection.

Schrems II (Case C-311/18, 16 July 2020): CJEU invalidated EU-US Privacy Shield. Found US Foreign Intelligence Surveillance Act FISA Section 702 and EO 12333 + CLOUD Act did not provide adequate protection or effective redress for EU data subjects. Directly cited CLOUD Act as incompatible with EU fundamental rights.

Result: 5,000+ companies using SCCs suddenly illegal unless they do Transfer Impact Assessment.

Schrems III (Pending / Data Privacy Framework Challenge): EU-US Data Privacy Framework adopted July 10, 2023 with Executive Order 14086 and Data Protection Review Court. Already challenged, General Court upheld framework Sept 2025 but appeals expected. Shows conflict unresolved.

C. Google Pennsylvania Case - Location Irrelevant

US court held data location becomes irrelevant when US courts determine jurisdiction by where authorities review information, not where it's stored. Even if data in EU, if Google US can access remotely, it must produce.

D. India - Localization Conflicts

1. RBI Circular 6 April 2018 - Payment Data Localization:
Mandated all payment system operators to ensure end-to-end payment data stored only in India. Visa, Mastercard, Amex forced to build India data centers, delete foreign copies. Cost $500M+. Case: Compliance report filed - WTO challenge by US that this violates trade commitments, but India defended on sovereignty.

2. Justice K.S. Puttaswamy vs Union of India (2017) 10 SCC 1:
Supreme Court declared privacy fundamental right, but also recognized State can restrict for sovereignty, integrity, security. This is legal basis for DPDP Act Sec 17 exemption - State access overrides privacy. Creates internal sovereignty conflict: Private sector must localize, State can access foreign data.

3. Internet Freedom Foundation vs MeitY - Data Localization Debate:
India significantly watered down data localization requirements in final DPDP Act 2023 following industry criticism. Draft 2019 Bill required hard localization (mirror + critical data). Final Act 2023 allows cross-border transfer to any country except blacklisted. But RBI, IRDAI, Ministry still impose sectoral localization. So conflict: DPDP Act allows transfer, RBI says no.

4. Amazon vs Future Retail - Data Sovereignty in E-commerce:
Government asked Amazon to set up server in India to prevent unchecked migration of personal customer data. No law then, but executive pressure used to enforce sovereignty.

E. Other Global Conflicts

Russia - LinkedIn Blocked 2016: Russia requires personal data of citizens stored within country. LinkedIn refused, Russia blocked LinkedIn. First major enforcement of absolute localization.

China - Didi Case $1.2B Fine 2022: Didi transferred data to US for IPO, violated Cybersecurity Law data export assessment. Shows China enforces sovereignty even after transfer.

4. How Companies Get Trapped - Real Scenario

You are Indian SaaS company using AWS US-East, with EU customers:

• EU customer asks for deletion under GDPR Art 17. You delete.
• US DOJ serves CLOUD Act warrant on AWS for same data for investigation, AWS must retain copy.
• RBI says if payment data, you must keep in India.
• You comply with one, you violate two others.

This is called conflict of laws defence - no perfect compliance possible.

5. Legal Solution - How Courts Are Resolving

1. Comity Analysis: US courts now do 3-step test under CLOUD Act: Is there conflict? Which interest stronger? Can you seek via MLAT?
2. SCC + TIA + Encryption: Under Schrems II, if you encrypt data so US provider cannot read, you can transfer - because CLOUD Act cannot compel what you cannot decrypt.
3. Data Segregation: Keep three copies - EU copy in EU (with EU provider not subject to CLOUD Act), India payment copy in India, US copy in US. Costly but only way.
4. India DPDP Rules 2025 (Notified 14 Nov 2025): Rather than EU-style adequacy, India adopted blacklist model - you can transfer anywhere unless government notifies country as restricted. Lighter regime to avoid conflict.

Key Takeaway from Case Law: The Microsoft Ireland case taught that data location no longer matters - what matters is who controls the key and which government can compel that entity. If your cloud provider is US company, US can compel even if data is in Ireland or India.

For Indian companies, best practice is to use EU-headquartered provider for EU data (OVH, Scaleway) to avoid CLOUD Act, and Indian provider for payment data to satisfy RBI.