Digital Independence for Wales

To pay for parking in a growing number of Welsh towns, you need a smartphone app. To install the app, you need an account with Apple or Google. A child in a Welsh school does their homework through Microsoft and Google accounts, arranged for them by Hwb, the national schools platform.¹ Many community councils make their announcements on Facebook.

None of these companies answers to the laws that protect the people using them: they answer, in the end, to the jurisdiction of the United States.

Each of these, on its own, is a small irritation of modern life. I meet them every day, and mostly I shrug. But I’ve come to think that, taken together, they add up to something more serious than they look. I’d like to explain why, and to suggest a different way of doing things that I think Wales could lead.

I should say who I am and who I am not. I’ve been a software engineer for over thirty years. I’m a Chartered Engineer, I help run a small family software company, and I’ve written in public about privacy and open technology since 2008.² What I am not is a policy professional. I have no political experience and no organisation behind me. I’m writing because this issue affects me directly, and because I think Wales has a rare opportunity to lead on it. Where I stray into questions of implementation, others will be better placed to judge the mechanics. The principle, though, is one I can speak to directly.

1. What concerns me

This isn’t an argument about whether American technology is good. Much of it is excellent, and I use plenty of it by choice. My concern is what happens when there is no choice, when the only route into a public service is controlled by a company our laws can’t reach.

Under the United States CLOUD Act, a US-headquartered company can be compelled to hand over data it holds, wherever in the world that data is stored, and a Welsh datacentre does not change that.³

Until last year I might have called this theoretical. Then in May 2025 the chief prosecutor of the International Criminal Court lost access to his Microsoft-hosted email after the US government sanctioned him.⁴ A month later, in the French Senate, Microsoft France’s legal director was asked under oath whether he could guarantee that French citizens’ data would never be passed to US authorities without French approval. He answered: “No, I cannot guarantee it.”⁵ I don’t see how he could have answered differently, and the same would apply to data about people in Wales.

None of that is a complaint about any particular president or company. Relations between countries warm and cool, and always have. What the cool spells reveal is the underlying arrangement: decisions that affect Wales, taken under laws that no one in Wales elects.

The legal bridge that currently permits UK–US data transfers is itself being challenged in the European courts and may not survive.⁶ If it falls, every Welsh public service built on US platforms inherits the problem.

There’s another dependency that’s easier to miss. In 2021, Apple and Google blocked an update to the NHS Covid app because it broke their app-store terms. The state could not ship its own public-health feature without the consent of two companies.⁷ The same is true of any service that’s only available as a smartphone app.

2. Where Wales stands today

Welsh digital services are often well made, and the people building them work hard for the public good. What seems to be missing is any habit of treating jurisdiction as something to design for.

NHS Wales runs on a single all-Wales Microsoft 365 tenancy, under a framework agreement worth up to £450 million over six years.⁸ Hwb brokers Microsoft 365 and Google Workspace accounts to every maintained school in Wales, around 3.5 million logins a month. Councils lean on Facebook to reach residents; one Gwent council recently restarted a printed newsletter after finding that residents “knew nothing” of consultations announced online.⁹ And the Digital Strategy for Wales, for all its strengths, has six missions, none of which mentions jurisdiction or dependence.¹⁰

A schoolchild cannot decline the platform their school chose. Nearly a third of people over 75 in Wales are digitally excluded, and the Older People’s Commissioner has documented what happens when offline alternatives disappear.¹¹ We do have accessibility rules for digital services, but they only help once you’re through the door. They say nothing for the people who never get through it. The Digital Strategy already promises that people who “cannot, or decide not to, participate digitally” will have alternative routes “as good as those offered online”.¹² And the Well-being of Future Generations Act asks every Welsh public body to weigh the long term in what it does today; I’d say decades of dependence on suppliers our laws cannot reach is exactly the kind of long-term risk it has in mind.¹³ Much of this paper just asks Wales to mean what it already says.

3. Others are already acting

I find it reassuring that none of this would require Wales to go first. Denmark’s Ministry of Digital Affairs began moving off Microsoft Office in 2025, with its minister talking of “digital independence”.¹⁴ The German state of Schleswig-Holstein, a government of about 30,000 staff, roughly the size of ours, has largely completed the same move and reports savings of €15 million a year.¹⁵ France has built its own secure messaging and video tools, now used by hundreds of thousands of civil servants, and certifies clouds as sovereign only if US law cannot reach them.¹⁶ Germany packaged an open-source alternative to Microsoft 365, called openDesk, for this purpose; its adopters now include the International Criminal Court.¹⁷ Estonia, a country of 1.3 million people, has run its state on an open-source data exchange for two decades, and lets every citizen see which official has looked at their data and why.¹⁸ The European Union is moving the same way, with its digital identity rules and its data legislation, but it’s worth noticing that none of the countries above waited for Brussels: they acted with the powers they had.¹⁹

The citizen side has precedents too. German and French education authorities have restricted schools’ use of Microsoft and Google platforms on data-protection grounds, providing public alternatives instead.²⁰ France’s highest administrative court has ruled that the state may only make an online channel mandatory if a real human alternative exists.²¹ EU law now says that use of the coming European digital identity wallet “shall be voluntary” and that no one may be disadvantaged for declining it.²² And when Swiss cantons held referendums in 2023 and 2024 on adding a right to an offline life to their constitutions, the measures passed with 94% and 92% of the vote.²³ So it seems I’m not the only one who cares about this.

4. What I’m proposing

Most of what has been written on this subject, including the Liberal Democrats’ recent plan (UK-wide),²⁴ is about the first part only: the state freeing its own operations. That matters, not least because a government that runs its schools through Google can hardly ask its citizens to expect better.

But I don’t think it’s enough on its own. Denmark, a leader in state digital sovereignty, also makes digital post mandatory for its citizens. A state can sort out its own systems and still leave its people with no choice about using someone else’s.

It’s the second part I care most about: the state should guarantee that its citizens can be digitally independent themselves. What I have in mind is a Digital Participation Guarantee written into the Digital Service Standards for Wales:

Telecoms, internet regulation and data protection law are reserved to Westminster, so some of this is out of Welsh hands. But schools, the NHS, councils, procurement and the Welsh language are all devolved, and those are the places where most of us actually deal with government.

Then there’s the language. A language with six hundred thousand speakers is never going to be a priority for the big commercial platforms, so if Cymraeg is to get first-class technology I suspect it will have to be built as public infrastructure. Minecraft makes the point well: children in Wales had been playing it for well over a decade before its education edition appeared in Welsh, at the end of 2024, and that happened because Cadw led the work, translating the game and rebuilding Conwy Castle inside it.²⁵ Bangor University’s language technology unit has been working on this for years, most recently helping to build Welsh capability into a sovereign UK language model.²⁶ To my mind, digital independence and Cymraeg 2050 point the same way.

There’s an economic side to this too, though I’m wary of overselling it. Money spent on foreign licences leaves Wales every year. Work on open, public infrastructure could be done here instead, by Welsh firms and by young people coming through Welsh colleges and universities. I can’t put a number on that, but it seems worth including in the thinking.

5. Some suggestions

If I could put a few thoughts in front of the right people, they would be these:

6. The difficulties

The obvious objection is Munich, which famously moved to Linux and then moved back. The post-mortems, including one commissioned from Accenture, found the failure was political and organisational rather than technical, and the lessons are ones Wales could learn from.³⁰ Schleswig-Holstein and the French Gendarmerie, eighteen years on Linux now, suggest it can be made to stick.

It’s also worth saying what this is not. Anyone who remembers the NHS National Programme for IT will be wary of grand public technology projects, and rightly so.³¹ Nothing here proposes building one big system. The suggestions are about standards, contracts and rights of access, and mostly about what public bodies should stop requiring rather than what they should build.

Cost is harder to call. Some of this would cost more, at least to begin with, though it’s worth remembering that the NHS framework, at up to £450 million, is what we’re paying already and will presumably go on paying at each renewal. Schleswig-Holstein reckons its move saved money, though I’d want to see how that claim holds up over time. Exit clauses at least cost nothing.

On security, the big cloud companies probably are better than smaller suppliers at keeping criminals out. What happened in 2025 wasn’t a criminal attack though, and I can’t see what a security operations centre could do about a sanctions order.

Small suppliers can also fail: the UK’s own sovereign cloud provider collapsed in 2022 and cost the government millions.³² Which is why I think the aim has to be resilience rather than simply buying local: open standards, more than one supplier, escrow and public bodies as anchor customers.

On sequencing, existing contracts and transition, I can see that there would be significant challenges but I’m in no position to offer suggestions.

Finally

Government in Wales, national and local, is answerable to the people it serves: we fund it, and we can vote it out. The companies that increasingly stand between us and it answer to their shareholders and to the laws of another country. That’s fine for the things we choose to buy from them, but I don’t think it’s any basis for access to public services.

None of this would have needed saying until quite recently. I’m not asking Wales to invent a new right, just to keep an old one as the tools change. I think this is worth the Senedd’s attention, and I wanted to explain why.