The Power to Know: From PRISM to the AI Data Centre Boom

In my 28 October post, ‘The geography of artificial intelligence is being built now’, I discussed Epoch AI’s projectionsfor the computing capacity of major AI data centres in the first quarter of 2030. What struck me was the scale of the American projects — from Stargate to Microsoft Fairwater and Meta Hyperion — and the fact that the physical location of processors, their ownership and the right to use their capacity do not necessarily coincide. I also emphasised a limitation: Epoch AI’s database does not capture all global computing capacity and provides much more detailed coverage of the United States.

Those figures have since brought me back to PRISM. Edward Snowden’s disclosures in 2013 revealed how important the concentration of communications on American platforms had become to US intelligence collection. Thirteen years later, I find myself asking whether we are witnessing a further shift: from the ability to obtain specified communications to the concentration, in the hands of a few operators, of the infrastructure through which people everywhere increasingly examine, analyse and rework information.

The parallel needs care. In its 2023 report on FISA Section 702, the US Privacy and Civil Liberties Oversight Board confirms that collection previously known as PRISM is now described as downstream collection. Under the relevant foreign-intelligence authority, the government can compel communications providers to produce communications associated with specified selectors. This is not a legal power to copy every file on every American server. The targeting framework concerns non-US persons reasonably believed to be abroad and is subject to statutory requirements and procedures. There is also an important recent development: the Congressional Research Service explains that Section 702 expired on 12 June 2026, while existing authorisations and directives remain effective during the statutory transition period. Certifications issued in March 2026 can therefore support continued activity until they expire.

The 2018 CLOUD Act, codified at 18 U.S.C. § 2713, adds another dimension. Where information is within a covered provider’s possession, custody or control, storing it outside the United States does not, by itself, remove statutory preservation or disclosure duties. This is mainly a law-enforcement mechanism, separate from FISA’s foreign-intelligence framework, and it does not authorise unrestricted access. It nevertheless illustrates a basic point: the physical location of data and the jurisdiction governing the company controlling it are not the same thing.

European courts have confronted the issue directly. In Schrems II (16 July 2020), the Court of Justice invalidated the Privacy Shield adequacy decision against the background of concerns about US surveillance and inadequate safeguards. The law has since changed. In 2023 the Commission adopted a new EU–US Data Privacy Framework adequacy decision. On 3 September 2025, the General Court dismissed the action in Latombe, assessing the protections in place at the time of adoption. The appeal, C-703/25 P, remains pending. It would be inaccurate either to assume that the legal position is unchanged since 2020 or to suggest that every controversy is now settled.

Large language models make this debate more consequential, but not for the simplest reason. We used to give digital platforms messages, photographs, searches and traces of social interaction. We now ask AI systems to review contracts, draft legal analyses, examine scientific material, compare datasets, write code and carry out tasks within organisations. A growing share of intellectual work passes through infrastructure controlled by a relatively small number of predominantly US companies, even when the machines are physically located elsewhere. Yet processing a document with an AI system does not automatically mean permanently exporting it to the United States or handing it over for model training. OpenAI and Anthropic both state that business customers’ inputs and outputs are not used for training by default. Data retention, processing location, access controls and contractual protections depend on the service and agreement. Epoch AI’s chart cannot establish that US intelligence agencies are systematically collecting AI users’ knowledge.

There is a structural issue even without that claim. Whoever controls compute infrastructure can influence who gets access to it, at what price, on what technical terms and with what risk of disruption or lock-in. The strategic advantage may lie less in appropriating the substance of every prompt than in operating the platforms, attracting capital, developing models and setting the conditions under which others use them. We should distinguish at least three maps: where the chips physically sit, who owns them and who has the right to use their capacity. A data centre in Europe is not automatically under European strategic control.

The European Commission now acknowledges the problem openly. Its 3 June 2026 proposal for a Cloud and AI Development Act, COM(2026) 502, states that three non-EU hyperscalers account for over 70% of the European cloud market and notes the potential conflict between extraterritorial third-country laws and European fundamental-rights protections. This figure refers to the European cloud market, not global AI-training capacity. The Commission’s official presentation focuses on infrastructure capacity and technological autonomy. Article 32 of the EU Data Act also provides safeguards against unlawful third-country governmental access to non-personal data held in the Union.

This is why I find Epoch AI’s chart worth examining. It does not prove the existence of an enormous new AI surveillance programme. It does, however, illustrate the physical foundations of a familiar asymmetry: users and institutions across the world depend on a small group of platforms, while corporate control, computing infrastructure and much of the capacity to capture value from digital activity remain concentrated in the United States. For Europe, the question goes beyond privacy. It is whether we can continue to generate knowledge, conduct research and operate essential services without becoming almost entirely dependent on infrastructure over which we have limited control. That is a question of security and economic autonomy, but ultimately also of the freedom to make our own choices.

Sources