Dependent by Design

And the fines have been real.

Meta got hit with over a billion euros by the Irish regulator in 2023.

Google, Amazon, they've all paid.

There's actual enforcement happening, which surprised a lot of people in Silicon Valley who'd assumed the GDPR was mostly theater.

Y aquí entra un personaje que me parece fascinante: Max Schrems, un estudiante de derecho austriaco que básicamente se convirtió en la pesadilla legal de Meta durante una década.

And here enters a character I find fascinating: Max Schrems, an Austrian law student who basically became Meta's legal nightmare for a decade.

Demandó a Facebook en 2013, justo después de Snowden, alegando que transferir datos de europeos a servidores estadounidenses violaba la legislación europea.

He sued Facebook in 2013, right after Snowden, arguing that transferring Europeans' data to American servers violated European law.

Y ganó.

And he won.

Dos veces.

Twice.

One guy with a law degree effectively invalidated two major international data transfer frameworks.

Schrems I, Schrems II.

The second decision in 2020 invalidated the Privacy Shield agreement, which was this whole carefully negotiated arrangement between the EU and the US.

Gone.

Lo que demuestra que el proyecto europeo de soberanía digital no lo está construyendo solo la Comisión Europea desde arriba.

Which shows that the European digital sovereignty project isn't being built only by the European Commission from the top.

También lo están moldeando ciudadanos y activistas desde abajo, a través de los tribunales.

It's also being shaped by citizens and activists from below, through the courts.

Eso me parece genuinamente notable.

I find that genuinely remarkable.

Okay, but here's what I keep wondering.

Regulation is one thing.

Actually building a competing tech infrastructure is a completely different order of problem.

Europe has tried this before and it hasn't gone well.

Tienes razón en que el historial no es glorioso.

You're right that the track record isn't glorious.

El proyecto GAIA-X, lanzado en 2019 por Francia y Alemania con grandes fanfarrias como la gran nube europea, se ha convertido en una burocracia enorme con poca sustancia operativa.

The GAIA-X project, launched in 2019 by France and Germany with great fanfare as the great European cloud, has become an enormous bureaucracy with little operational substance.

Han tardado años en ponerse de acuerdo sobre estándares técnicos mientras Amazon y Microsoft seguían ganando contratos públicos europeos.

They've spent years arguing about technical standards while Amazon and Microsoft kept winning European public contracts.

There's something almost darkly funny about that.

The European response to American tech dominance is to form a committee.

Es un cliché, pero tiene su parte de verdad.

It's a cliché, but there's truth in it.

Sin embargo, y esto es importante, hay una diferencia enorme entre GAIA-X, que es esencialmente un proyecto de gobernanza, y lo que está pasando en el sector privado europeo, que es donde las cosas se están poniendo más interesantes.

However, and this is important, there's an enormous difference between GAIA-X, which is essentially a governance project, and what's happening in the European private sector, which is where things are getting more interesting.

Mistral.

Mistral AI, fundada en París en 2023 por exempleados de Google DeepMind y Meta.

Mistral AI, founded in Paris in 2023 by former employees of Google DeepMind and Meta.

En menos de dos años, levantaron seiscientos millones de euros, publicaron modelos de lenguaje que compiten directamente con GPT-4, y lo hicieron con una filosofía distinta: código abierto, transparencia, y con sede en Europa, sujeta al derecho europeo.

In less than two years, they raised six hundred million euros, published language models that directly compete with GPT-4, and did it with a different philosophy: open source, transparency, and headquartered in Europe, subject to European law.

And the French government has been openly supportive.

Macron has basically said: this is exactly the kind of company we need.

Which raises an interesting question, because that's also the government that has a long tradition of industrial policy, of deciding which industries are strategic and backing them hard.

Es el gaullismo digital, si quieres llamarlo así.

It's digital Gaullism, if you want to call it that.

La idea de que Francia, y por extensión Europa, tiene que mantener una autonomía estratégica en los sectores que definen el poder en el siglo veintiuno.

The idea that France, and by extension Europe, must maintain strategic autonomy in the sectors that define power in the twenty-first century.

No es solo una cuestión económica;

It's not just an economic question;

es una cuestión de identidad política y de capacidad de actuar con independencia en el mundo.

it's a question of political identity and the capacity to act independently in the world.

The Airbus comparison gets made a lot here, and I think it's worth testing.

Europe decided in the 1960s that it couldn't be entirely dependent on American aerospace.

So it built Airbus, with state subsidies, with political will, over decades.

And it worked.

Boeing now has a genuine competitor.

Can that model transfer to AI and cloud infrastructure?

La analogía es seductora pero tiene límites importantes.

The analogy is seductive but has important limits.

Airbus tardó treinta años en ser competitivo y costó cantidades ingentes de dinero público.

Airbus took thirty years to become competitive and cost enormous amounts of public money.

Y el sector aeroespacial tiene barreras de entrada naturales, es intensivo en capital físico, requiere certificaciones que llevan décadas.

And the aerospace sector has natural entry barriers;

El software y la inteligencia artificial son radicalmente distintos: la velocidad de iteración es incomparablemente más rápida, el talento puede moverse a cualquier parte, y una startup de doce personas puede cambiar el panorama en meses.

it's capital intensive, requires certifications that take decades.

Which cuts both ways, though.

That same speed means a European company like Mistral can emerge fast.

But it also means an American competitor can leapfrog them just as fast.

There's no moat built from three decades of accumulated industrial investment.

Exactamente, y hay un debate muy serio dentro de Europa sobre si el enfoque correcto es intentar construir competidores europeos a Google o a OpenAI, o si es más inteligente asegurarse de que las infraestructuras existentes operen bajo marcos legales europeos robustos.

Exactly, and there's a very serious debate within Europe about whether the right approach is to try to build European competitors to Google or OpenAI, or whether it's smarter to ensure that existing infrastructures operate under robust European legal frameworks.

Son dos estrategias distintas, y no todo el mundo está de acuerdo en cuál perseguir.

Those are two distinct strategies, and not everyone agrees on which to pursue.

And there's a third voice in this debate that doesn't get mentioned enough, which is the companies themselves.

German manufacturers, French banks, Spanish telecom companies.

Because for a lot of them, the question isn't ideological.

It's just: where can I store my data with full legal certainty that no foreign government can get their hands on it?

Ese es el mercado real.

That's the real market.

Y ahí es donde proveedores europeos como OVHcloud, la empresa francesa, o Open Telekom Cloud de Deutsche Telekom están intentando posicionarse.

And that's where European providers like OVHcloud, the French company, or Deutsche Telekom's Open Telekom Cloud are trying to position themselves.

No como una cruzada ideológica, sino como una propuesta de valor concreta: somos europeos, estamos sujetos exclusivamente al derecho europeo, y si la NSA te llama a nosotros, les decimos que no con total respaldo legal.

Not as an ideological crusade, but as a concrete value proposition: we're European, we're subject exclusively to European law, and if the NSA calls us, we tell them no with full legal backing.

Though I'd push back slightly on the ideological framing.

Because Germany's anxiety about industrial espionage isn't abstract.

Volkswagen, Siemens, BASF, these are companies whose competitive advantage lives in their engineering secrets.

And there are documented cases of industrial espionage running through digital infrastructure.

This is a concrete economic threat, not just a philosophical one.

Totalmente de acuerdo, y el caso alemán es particularmente revelador.

Completely agree, and the German case is particularly revealing.

Alemania tiene la tradición del Mittelstand, esas medianas empresas industriales que son absolutamente punteras en nichos muy específicos, fabricantes de maquinaria de precisión, de componentes de automoción, de instrumentos médicos.

Germany has the Mittelstand tradition, those mid-sized industrial companies that are absolutely cutting-edge in very specific niches, precision machinery manufacturers, automotive components, medical instruments.

Son las empresas más vulnerables al espionaje industrial y las que tienen más que perder si sus datos acaban en manos equivocadas.

They're the most vulnerable to industrial espionage and the ones with the most to lose if their data ends up in the wrong hands.

So let me play devil's advocate for a minute.

The counterargument you hear from Brussels critics is that digital sovereignty is really just protectionism with a more sophisticated vocabulary.

Europe can't compete with American tech giants on pure merit, so it builds regulatory walls and calls it sovereignty.

Es un argumento que me cansa un poco, la verdad.

It's an argument I find a bit tired, honestly.

Porque si aplicásemos ese mismo razonamiento al derecho laboral europeo, diríamos que exigir contratos indefinidos o vacaciones pagadas es proteccionismo frente a las empresas que prefieren la precariedad.

Because if we applied that same reasoning to European labor law, we'd say that requiring permanent contracts or paid vacation is protectionism against companies that prefer precarity.

Hay cosas que una sociedad decide que no están en venta, aunque eso implique costes económicos.

There are things a society decides are not for sale, even if that implies economic costs.

La privacidad de los ciudadanos puede ser una de ellas.

Citizens' privacy may be one of them.

That's actually a strong reframe.

The GDPR as a labor law equivalent.

I'll sit with that.

Y además hay un argumento puramente geopolítico que va más allá de Estados Unidos.

And there's also a purely geopolitical argument that goes beyond the United States.

China está construyendo su propio ecosistema digital completamente cerrado, con empresas como Huawei expandiéndose por África y Asia con infraestructura de telecomunicaciones.

China is building its own completely closed digital ecosystem, with companies like Huawei expanding across Africa and Asia with telecommunications infrastructure.

Si Europa no tiene su propia capacidad tecnológica, en diez o quince años puede encontrarse atrapada entre dos modelos digitales completamente ajenos a sus valores.

If Europe doesn't have its own technological capacity, in ten or fifteen years it could find itself trapped between two digital models completely alien to its values.

The internet wasn't supposed to work that way.

The original architecture was explicitly designed to be borderless, decentralized, resistant to exactly this kind of national control.

And now we're watching it fragment into what some people are calling a splinternet.

American internet, Chinese internet, and maybe one day a European internet.

Y esa fragmentación ya está sucediendo en la práctica, aunque no siempre con ese nombre.

And that fragmentation is already happening in practice, even if not always under that name.

Cuando la Unión Europea exige que los datos de sus ciudadanos residan en servidores europeos, cuando Rusia desconecta tramos de su red en momentos de tensión, cuando China construye el Gran Cortafuegos, todos están, a su manera, afirmando que el espacio digital tiene dimensión territorial.

When the European Union requires that its citizens' data reside on European servers, when Russia disconnects sections of its network in moments of tension, when China builds the Great Firewall, they're all, in their own way, asserting that digital space has a territorial dimension.

El sueño de un internet libre y universal lleva años agrietándose.

The dream of a free and universal internet has been cracking for years.

Which brings me to a question I genuinely don't know the answer to.

Is the European version of this more defensible than the others?

Because there's a difference between China building a firewall to control what citizens can read and Europe requiring data residency to protect citizens from surveillance.

Those aren't morally equivalent, even if the technical mechanism is similar.

Esa distinción es fundamental y a menudo se pierde en el debate.

That distinction is fundamental and often gets lost in the debate.

La soberanía digital europea se construye, al menos en teoría, sobre la base de los derechos individuales, el habeas data si quieres llamarlo así, el derecho a que tus datos no circulen sin tu consentimiento.

European digital sovereignty is built, at least in theory, on the basis of individual rights, habeas data if you want to call it that, the right for your data not to circulate without your consent.

El modelo chino hace exactamente lo contrario: subordina completamente la privacidad individual al control estatal.

The Chinese model does exactly the opposite: it completely subordinates individual privacy to state control.

Son proyectos antagónicos que usan algunas herramientas similares.

They're antagonistic projects that use some similar tools.

So where does this actually end up?

Genuinely, ten years from now, is there a European tech stack that's viable and competitive, or does Europe remain the world's most sophisticated regulatory body sitting on top of American infrastructure?

Mi intuición es que el resultado será heterogéneo.

My intuition is that the result will be uneven.

En inteligencia artificial, empresas como Mistral demuestran que es posible competir.

In artificial intelligence, companies like Mistral show it's possible to compete.

En computación en la nube, la brecha con AWS o Azure es tan enorme que reducirla llevará décadas y requerirá cantidades de inversión que los mercados de capital europeos, históricamente más conservadores que los americanos, quizás no estén dispuestos a asumir.

In cloud computing, the gap with AWS or Azure is so enormous that closing it will take decades and require amounts of investment that European capital markets, historically more conservative than American ones, may not be willing to absorb.

Así que probablemente veremos una Europa con capacidades propias en algunas capas y dependiente en otras.

So we'll probably see a Europe with its own capabilities in some layers and dependent in others.

Partial sovereignty.

Which is maybe honest, actually.

Complete technological independence was never realistic.

The question is: what are the critical layers where you absolutely cannot afford to be dependent?

Oye, antes de que lo dejemos, me ha llamado la atención algo que has dicho antes.

Hey, before we leave this, something you said earlier caught my attention.

Usaste la palabra 'privacidad' varias veces, lo cual es curioso, porque hasta hace relativamente poco esa palabra no existía en español.

You used the word 'privacidad' several times, which is interesting, because until relatively recently that word didn't exist in Spanish.

Wait, really?

How did you talk about privacy before the word existed?

Con 'intimidad'.

With 'intimidad'.

Que es la palabra patrimonial, la que viene del latín 'intimus', lo más interior, lo más profundo de uno mismo.

Which is the native word, the one that comes from the Latin 'intimus', the innermost, the deepest part of oneself.

'Privacidad' es un calco del inglés 'privacy' que empezó a colarse en el español jurídico y periodístico en los años noventa, y que la Real Academia tardó años en aceptar.

'Privacidad' is a calque of the English 'privacy' that started creeping into Spanish legal and journalistic language in the nineties, and which the Real Academia took years to accept.

Hay lingüistas que todavía la consideran un barbarismo innecesario.

There are linguists who still consider it an unnecessary barbarism.

So 'intimidad' carries more weight than 'privacidad.' More personal, more existential almost.

Which is interesting because the GDPR debate is precisely about something that started as intimacy and got turned into data management.

Eso es exactamente lo que ha pasado, y me parece que el cambio de vocabulario no es inocente.

That's exactly what happened, and I think the vocabulary shift isn't innocent.

Cuando empezamos a hablar de 'privacidad' en lugar de 'intimidad', sin darnos cuenta adoptamos un marco más frío, más técnico, más compatible con la idea de que los datos son un recurso gestionable en lugar de una extensión de la persona.

When we started talking about 'privacidad' instead of 'intimidad', without realizing it we adopted a colder, more technical framework, more compatible with the idea that data is a manageable resource rather than an extension of the person.

Quizás si hubiésemos defendido la 'intimidad' digital desde el principio, el debate habría tenido otro tono.

Maybe if we'd defended digital 'intimidad' from the beginning, the debate would have had a different tone.

Octavio, I've been covering geopolitics for thirty years and I did not expect a vocabulary lesson to be the sharpest thing said in this episode.

'Intimidad' versus 'privacidad.' I'm going to be thinking about that one for a while.