Data sovereignty starts with the individual

Digital identity matters because we use it constantly, often without noticing. It unlocks our phones, gives access to email, and lets us use countless public and private services. Digital identity today includes far more than a username, it can involve biometrics, cryptographic keys, and even patterns of how we use technology. As that information becomes more valuable, so does the incentive to misuse it, and the question of who really controls it becomes harder to avoid. 

This is the layer my research group, Cybersecurity and Applied Cryptography, works on: building the cryptography that lets people prove who they are, or what they are entitled to do, without handing over more than a situation actually requires. I am also a founding faculty member of HSG’s new Center of Geopolitics and Corporate Strategy, where I look at the same question from the state’s side: not just how individuals protect their data, but how nations and companies navigate a world where control over data, infrastructure, and identity has become a matter of geopolitical strategy. 

Sovereignty, Swiss-style 

Switzerland's own e-ID debate has really been a sovereignty debate all along. In 2021, voters rejected the first version of the electronic identity law because private companies, not the state, would have operated the system and handled sensitive identity data. Many people felt that put control of something fundamental in the wrong hands. A revised version, approved later, placed responsibility with the federal government and aligned the system with strict data protection rules, sending a clear message: digital progress only succeeds if people trust who is in control of it. Meanwhile, the EU is introducing a Digital Identity Wallet under its updated eIDAS rules. Switzerland isn't part of that system, but its existence shows how central control over digital identity has become to modern statehood, not just modern convenience. 

Companies are learning the same lesson the hard way. A Swiss firm can host its data in a data centre in Zurich and still have that data legally reachable by a foreign government, if its cloud provider is American: under the US CLOUD Act, Washington can compel AWS, Microsoft or Google to hand over data they control, regardless of where the servers physically sit. That distinction, between where data is stored and which country's law actually governs it, is why the EU has started formally scoring cloud contracts on sovereignty, and why Swiss providers are increasingly marketing themselves as free of any foreign legal exposure at all. For regulated industries like banking and insurance, that is no longer a footnote. It is a procurement decision.

Unnecessary risks 

Identity theft and online fraud can cause serious financial and personal damage, and Switzerland's cautious approach reflects an understanding that a digital identity system must be secure, trustworthy, and resilient against attacks. But a central question remains even once a system is secure: how can a person prove something about themselves online without disclosing far more than necessary? In most existing systems, identification still means overexposure. A user may need to reveal a full identity in situations where only one attribute matters, such as age, affiliation, or authorization. That is a sovereignty failure at the individual level: profiling, cross-service tracking, and greater exposure if a database leaks. 

Prove it, without giving it up 

This is where privacy-preserving authentication becomes essential. Such approaches let users access services while revealing as little private information as possible, proving exactly what is needed and nothing more, which is, in effect, what it means for a person to hold sovereignty over their own data. 

We tackle exactlythis problem for biometrics. Fingerprints and facial scans are convenient, but unlike a password, they cannot be reset once exposed. My team designs methods that let a system check whether your fingerprint or face scan matches the one on file, while keeping the actual biometric data scrambled and unreadable throughout, even to the system doing the checking. If a database of these scrambled templates is ever stolen, it should be worthless to the thief, even though matching still works perfectly for legitimate users. 

The same idea applies to digital certificates, a proof of age, a degree, a membership. Normally, checking a certificate means showing the whole document, name and all. Newer methods let you prove just the one fact that matters, say, that you are over eighteen, without revealing your name or letting different services compare notes and quietly build a profile of you. What sets our approach apart is what the security is built on: well-established mathematical foundations that have been tested for decades, rather than shortcuts that sound safe in theory but have not been thoroughly stress-tested. In practice, that means the privacy protection is designed to hold up against real attackers, not just look convincing in an academic paper. 

Computing without seeing the data 

We also tackle a more ambitious version of the same idea: not just proving something about yourself, but letting several parties run a joint calculation without any of them showing each other their raw data. This is called secure multi-party computation. In practice, several hospitals could jointly spot a rare disease pattern across their patient records, or several banks could check a transaction against a sanctions list, all while each party's underlying data stays locked under its own control, invisible to everyone else, including to the system doing the calculating. The answer comes out; the data that produced it never leaves its owner's hands. It is sovereignty enforced not by policy or contract, but by mathematics. 

Respect for the people behind the data 

These questions are not only technical, but also social and political. A digital identity system must not only function well; it must also convince people that it deserves their trust. This is one reason the Swiss debate has been so instructive: it shows that convenience alone is not enough. People want digital services that are secure, understandable, and designed to minimize unnecessary exposure of personal data. By avoiding identifiers that can be traced and by using strong cryptographic techniques, privacy-preserving protocols can make identity theft and fraud far more difficult, while giving users real control over how their data is shared. These tools fit closely with the goals of the new Swiss electronic identity, which focuses on decentralization, minimal data sharing, and strong protections for personal information. 

Data sovereignty is usually discussed as a contest between states and corporations over servers and jurisdictions, the world I see through the Center of Geopolitics and Corporate Strategy. But the more fundamental version of that contest happens one layer down, between a person and everyone who wants a piece of their data. Whether Switzerland and Europe get sovereignty right at the national level may ultimately depend on whether they get it right at that smaller, more personal one first.