Digital Sovereignty and Digital Rights
What we hold to be true about the data that describes a person, and the standard we grade fifty states against.
A person's data is the record of a life: where they were, what they bought, who they spoke to, what they were afraid of. The law has mostly treated that record as the property of whoever collected it. We hold the opposite. The record is about you, it came from you, and the terms on which anyone else holds it are yours to set.
Privacy is the wish to keep something from being seen. Sovereignty is the power to decide who holds it, to take it back, and to hold someone to account when they misuse it. A state that offers the first and withholds the second has a privacy policy. This Declaration describes the second.
Ownership
Your data is yours. It is not merely about you.
- You may learn what is held about you, where it came from, and who received it, by name.
- You may correct what is wrong.
- What was inferred about you is covered the same as what you handed over.
- Sensitive data, including biometric, health, location, immigration status, religion and sexuality, is named and protected.
The test Is data yours, or merely about you?
Consent
Permission is something given. It is not something you failed to refuse.
- Sensitive data requires a yes, not a missed opt-out.
- Your browser's signal to opt out is honored by law, once, everywhere.
- Dark patterns in a consent flow are prohibited.
- Declining may not degrade your service or raise your price. A right you must purchase is a product.
- You may withdraw as easily as you agreed, and children get more protection, not less.
The test Was permission given, or merely not successfully refused?
Portability
You can leave, and you can take the record with you.
- In a structured, machine-readable format, not a PDF.
- Sent directly to another service you choose.
- Without a fee, and within 45 days.
- Including what was inferred, not only what you typed.
The test Can you leave and take the record with you?
Erasure
When you say delete, it dies.
- Deletion follows the data to the processors, affiliates and third parties who received it.
- A single request reaches every registered data broker.
- Data that is no longer needed is deleted on a schedule, without being asked.
- Deletion can be verified. It is not merely asserted.
The test When you say delete, does it die?
Accountability
A right you cannot enforce is a suggestion.
- You may bring your own case, without proving a financial loss.
- Damages are defined per violation and large enough to matter to the violator.
- There is a dedicated enforcer with its own budget and staff, and no cure period that lets a violator fix it and walk away.
- The law is enforced: public actions brought, penalties collected. A law never enforced is scored as such, however elegant its text.
The test When this is violated, what actually happens?
No rights with a back door
A right that stops at the employer's door, the agency's door or a revenue threshold is a right for some people.
- Workers are people. Data collected about them at work is theirs.
- Nonprofits and government agencies hold data too. A law that exempts the state from its own rules protects residents from everyone but the largest holder of their records.
- A threshold set so high that most businesses fall outside the law is an exemption, whatever it is called.
- Corporate data extraction and state data collection are two hands of the same problem. We object to both.
The test Who is left out of this law, and does anyone have to be?
What we will do about it
We will grade every state against these rights, in public, on one rubric, and show our work.
- One state a week for fifty weeks, scored on the same five pillars, with the criteria and the points published in advance.
- Laws are scored as enacted, not as promised. A bill in committee scores zero.
- An absence of enforcement is a finding, and we say how and when we checked.
- Every entry carries a date stamp and a public log of what changed since the audit. When we are wrong, the correction goes on the record and the original stays standing.
- If the rubric itself is flawed, we publish the flaw and re-score every state.
The test Could a reader check this, and could they disagree with it?
If your data were taken from you tomorrow, sold, leaked, subpoenaed, or used in a way you never agreed to, what, in this state, could you actually do about it?
If the honest answer is nothing, the state does not have digital sovereignty. It has a privacy policy.
Thinkers Dilemma · Digital Sovereignty Audit · Takes effect with Week 1,
The grading system · The methodology · The leaderboard