Digital sovereignty and the question of data

Read the PDF edition (2 pages)

Technological dependence on a few foreign suppliers raises a question that the Geneva financial centre has known since the days of banking secrecy: that of the location and protection of client data. Swiss law protects the banker’s professional secrecy and personal data, whereas the laws of certain states, including the United States, allow their authorities to require their companies to hand over data stored abroad.¹ Geneva institutions that use foreign cloud services must reconcile these requirements through contractual, technical and organisational measures, such as encryption in which the institution keeps the keys, and must inform their clients. FINMA permits outsourcing to foreign providers on these conditions.²

Switzerland has launched digital sovereignty initiatives: a sovereign cloud for the federal administration, artificial intelligence models developed by the federal institutes of technology and published under open access, and national computing infrastructure.³ These initiatives are of interest to the financial centre in two respects: they offer alternatives to foreign suppliers for the most sensitive uses. They also create a pool of skills from which Geneva, with its university, its universities of applied sciences and the proximity of the École polytechnique fédérale de Lausanne, can benefit. Geneva’s international organisations, including the International Telecommunication Union, add to this ecosystem a standard-setting dimension that few financial centres possess.

Notes

1. Wikipedia (en), article “CLOUD Act”: Clarifying Lawful Overseas Use of Data Act, enacted on 23 March 2018 in the Consolidated Appropriations Act, 2018; the Act “primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil”; bilateral data access agreements with foreign states; the case Microsoft Corp. v. United States (e-mails stored in Ireland) rendered moot. ↩
2. FINMA, press release of 5 December 2017, “La FINMA publie la circulaire sur l’outsourcing” (FINMA publishes the outsourcing circular): Circular 2018/3 “Outsourcing – banks and insurers”, in force on 1 April 2018, applicable to banks, securities dealers and insurance companies, based on the institution’s continuing responsibility for outsourced activities; transitional period of five years for banks’ existing outsourcing arrangements; Wikipedia (en), article “CLOUD Act” (access by the US authorities to data held by providers established in the United States). ↩
3. Apertus, an open language model with 8 and 70 billion parameters, trained on the Alps supercomputer and released on 2 September 2025 by EPFL, ETH Zurich and the Swiss National Supercomputing Centre within the Swiss AI Initiative; “Lancement officiel d’Apertus, le LLM conçu par l’EPFL et l’EPFZ”, ICTjournal, 2 September 2025. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of September 2025.