Digital sovereignty, autonomy, and public values: what exactly do we mean?

🟢 Digital Sovereignty

At SURF, by digital sovereignty we mean having control, influence, direction, freedom of choice, and the necessary innovative strength within an increasingly digital world.

🟢 Digital environment

This digital sovereignty takes place within the digital environment. By this we mean, though we are not limited to, aspects such as:

• the storage, security, and processing of data;
• used (AI) algorithms and the underlying models;
• ownership and application of digital identity;
• purchase, use, development, and access to applications, software, content, systems, and technologies;
• deployment of digital infrastructure such as computing capacity and connectivity;
• required architecture and instrumental standards;
• access to and functioning of digital ecosystems.

🟢 Values

Digital sovereignty in a digital environment is important, but not sufficient. There is a third, crucial component that guides how we have been digitizing education and research for decades: values.

Values are general, often abstract ideals that guide our actions as individuals, organizations, sectors, and society.

That may sound a bit academic, but it becomes concrete with examples we recognize well within digitization:

• Freedom of choice in selecting cloud providers (Within SURFcumulus, 20 providers can be chosen);
• Privacy in the protection of personal data (Conducting Vendor Compliance / DPIAs for, among others, Co-Pilot, Google, or Zoom);
• Sustainability, for example through more energy-efficient infrastructure (As with Supercomputer upgrades);
• Security, both digital and social (SURFcert, Innovation Zone Security);
• Respect, where every student and researcher is seen and heard as a person, not as a number or cog in a system. (an important foundational attitude of employees in the sector)

Public values

By “public values” we mean those values whose importance is so great that we organize and protect them at the societal level, or in our case: at the sector level.

The Value Compass

SURF and Kennisnet, together with experts from the field, have developed the Value Compass. This tool provides a shared language to conduct and steer the conversation about digitization and values in education and research.

The Values Guide contains more than twenty values, divided into 3 core values:

• Autonomy,
• Justice,
• and Humanity.

🟢 Bringing together digital sovereignty, public values, and autonomy

We want important values to be leading and provide guidance in digitization. But to actually uphold and protect values such as privacy, autonomy, and inclusion, digital sovereignty is necessary.

It is not enough to value these principles; without control, direction, influence, freedom of choice, or innovative strength (digital sovereignty), it becomes virtually impossible to implement or maintain them in practice.
(See the image with a schematic simplified representation at the bottom of this blog) 

🟢 And what about autonomy?

Autonomy is one of the core values within the Value Compass, alongside humanity and justice. It is a broad value that encompasses different layers: the autonomy of a student, a teacher, an institution, or even the sector as a whole. Sometimes increasing collective autonomy paradoxically requires (partially) giving up individual autonomy of an organization, think of collaboration within a cooperative like SURF!

Moreover, autonomy is under pressure. In recent months, the topic has been frequently in the news, especially in relation to geopolitical tensions and dependence on large tech companies. Precisely for this reason, it is crucial to actively safeguard autonomy as a public value.

🟢 Strategic autonomy and data sovereignty: how does that work?

The vision described earlier is a useful way for us to connect digital sovereignty and values such as autonomy within the context of digitization. Of course, there are different interpretations and feelings about these concepts, and not everyone will agree on everything. Still, this simplified model can help to grasp the coherence and different concepts.

Note: the model is simplified. If you look at it in more detail, you see that values like autonomy are not only part of digital sovereignty but also influence it. Autonomy is indispensable here: in this context, it means the ability to act independently and make choices yourself. So it is not only guiding but also a prerequisite, a building block of digital sovereignty. In this relationship, you can see digital sovereignty as the goal, and autonomy as the means to achieve that goal.

However, we must be careful not to consider digital sovereignty itself as the ultimate goal of education and research. It is not simply one of the items alongside talent development, labor market preparation, scientific progress, or economic growth. It is rather a condition to realize those goals in a free, safe, and valuable way and resembles the concept of “academic values.” Another concept(!) which, according to the UNL, consists of aspects such as academic freedom and institutional autonomy, honesty, diligence, transparency, independence, responsibility, diversity, equality, and inclusivity.

The way SURF approaches this is supported more broadly than just within SURF, also in literature, media, and among (parts of) SURF’s members. At the same time, interpretations and preferences vary, which is logical, no one writes a 10-minute blog about terms that are unambiguously defined in the dictionary.

🟢 Even more variations

In policy and government strategies, we see different variations of these terms. For example, some government departments use the term Strategic Autonomy, among others in the context of DOSA (Digital Open Strategic Autonomy). This concerns the question: how do we ensure that the Netherlands and Europe do not become completely dependent on foreign powers or commercial giants in strategic domains such as AI, cloud, chips, or energy?

The VNG (Association of Dutch Municipalities) also does important work under the banner of Strategic Digital Autonomy. The Dutch Court of Audit uses its own definition: “Digital sovereignty is the ability to decide and act autonomously on the essential digital aspects in economy, society, and democracy.”

At the European level, the term is increasingly used as well, for example in the European Commission’s Digital Decade program. There, digital sovereignty stands for taking technological development into one’s own hands, with respect for fundamental rights, sustainability, and openness.

🟢 From words to action: working together!

My call to everyone: make sure we understand each other, and use a common language where necessary. But don’t get stuck there, what ultimately matters is what we do.

The real challenge lies in operationalizing values. How do you embed them in policy? How do they end up in our digital environment, our procurement, or source code, and how do we keep that affordable, workable, and future-proof? How do you describe them concretely? What are the next steps on a roadmap or work agenda toward more digital independence?

Whether you call it strategic autonomy or digital sovereignty, it touches on the same core: taking back control, having influence, realizing genuine freedom of choice, having authority and give direction towards software, data, and systems, and being able to work from your own innovative strength, without undesirable dependencies or excessive external influences: being back in the driver’s seat!

Why is this so important?
Because there is one thing certain about this big, complex, and partly geopolitical theme: we will have to collaborate on shared goals and gain and maintain grip on our digital environment, in a way that fits the public values that we as SURF, sector, and society jointly stand for. Don’t challenge me to write a whole blog about the beauty of the difference between "common" and "together"! #Let’sGetToWork!

🌟 Bonus: persistent misunderstandings

In conversations about digital sovereignty and public values, misunderstandings often arise. Below we correct a few and offer some considerations:

• "Personal and public values exclude each other."
  Not true, think of privacy: often a fundamental value for the individual, but also a public value and even enshrined in universal human rights.
• "Public values are the opposite of commercial value."
  Not true. I believe most people mean that something can also have or create “economic value”! That is certainly true! However, I think the (KPI) "economic value" should not be discussed as a form or part of "public values". What can help is the compact threefold division: Values, Price, Functionality.
• "Values are subordinate to discussions about price and functionality."
  Where ‘price’ and ‘functionality’ have received much attention (the past 15 years?) in digitization choices and the shift from on premis to cloud, values like autonomy, transparency, and inclusion are at least as fundamental and touch on the functioning and design of technology. That technology is not neutral and must be developed and operated responsibly, especially when it affects core processes or when you are insufficiently resilient to protect an organization’s crown jewels.
• Digital sovereignty is a product you can buy.
  Unfortunately, it’s not a package or cloud service as some product names might lead you to believe. It is a continuous process of control, authority, and decision-making.
• Digital sovereignty means: doing everything yourself.
  Absolutely not! It’s not about isolation, and certainly not nationalism. You can be digitally sovereign while collaborating publicly, privately, or via open source. Autonomy or sovereign in the context of digitalization does not mean striving for zero dependencies. On the contrary, the sector is quite dependent on, for example, SURF when it comes to the network, eduroam, or SURFconext... however, they do have full control over those dependencies as a cooperative. The same applies to dependencies in the offline world, you still rely on a baker, a glazier, or a furniture maker, yet these operate within healthy ecosystems with ample freedom of choice and without billion-euro fines for violations of privacy or competition laws.
• "Digital sovereignty is the same as classical, state sovereignty."
  No, they are not comparable. Much confusion in conversations or lack of shared language stems from this. Where sovereignty in a nation-state is about things like taxation, border control, and foreign policy, and aimed at state actors as counterparts, digital sovereignty is more about power relations with dominant technology companies, not countries. Moreover, the term ‘digital sovereignty’ is not universally defined. Legal scholars even argue that digital sovereignty or digital autonomy does not exist as a separate concept: it’s simply regular sovereignty or regular autonomy applied to the digital environment. That’s precisely why it’s important to handle the term carefully and clarify what you mean by it.
• Sovereignty says nothing about ‘make or buy’.
  Correct! You can be digitally sovereign through in-house development, public-private partnership, commercial procurement, commons, or open source, provided you maintain control over conditions, standards, and values.
• Open source is not an end in itself, but a powerful means.
  Also correct! It helps safeguard public values such as efficiency, transparency, autonomy, and privacy. Think of the use of open standards, the ability to customize software yourself (or by your commercial IT partner/provider), and better control over security and compliance. It aligns with principles we as a sector feel at home with, as we have for decades in open science, open access, open standards, or open educational resources.
• "Digital sovereignty only concerns America and China."
  No, we don’t think so. Much discussion rightly focuses on dependence on Big Tech from the US or China, partly due to conflicting legislation (like the US Cloud Act and the GDPR). But vigilance is also needed within Europe. If we take values like autonomy and freedom of choice seriously, we must also be critical of potential future Big EuroTech players if we pursue them. Think now about federated models and governance that structurally organize authority and influence, freedom of choice, and interoperability-by-design. This is not only about technology or market position but also the path to get there: do we want to focus on “spreading” with European SMEs or scale by adopting the blueprint of current American Big Tech?

📚 More reading?! Here are some reading tips

• Rathenau Institute on a vulnerable society due to digital dependency (Dutch) (July 9, 2025).
• The Value Compass by SURF and Kennisnet.
• Trustworthy Public/Private Partnerships in education: The TrustFramework.
• The Dutch Court of Audit has a nice operationalization of sovereignty in the context of (government) cloud deployment, and substantively a clear but also very worrying report.
• The Institute for Information Law (IViR) with a clear and comprehensive scientific report on digital sovereignty in light of the transforming university.
• Utrecht University: Reflections on digital sovereignty Pre-advice Constitutional Law Conference 2020 (Lokke Moerel, Paul Timmers).
• Philosopher Miriam Rasch and her book “Autonomy. A self-help guide.” (Dutch)