The standard vocabulary of digital rights has long been shaped by files: who collects them, who stores them, who shares them, and whether the subject gave meaningful consent. That frame remains necessary, but it is no longer sufficient for the most consequential frontier in bio-digital governance. Across hospitals, laboratories, insurers and public health systems, the body is being translated into a set of computable signals: heart rhythms rendered as prediction targets, retinal images as risk scores, speech as a proxy for neurological decline, gait as a fraud indicator, and brain activity as an input for machine interpretation. In this environment, sovereignty is not exhausted by the question of who holds the data. It turns on who may compute on the body, under which legal authority, and with what capacity for scrutiny, refusal and redress.
That shift matters because digital health systems increasingly generate value not from static records but from layered inferences. A blood test is no longer simply a result; it may become training data for a triage model. A hospital scan is no longer only an image; it may support future pattern-recognition systems whose downstream use was unimaginable when the scan was taken. The politically consequential asset is no longer the record but the modelled body.
From data protection to computation governance
European and international rules already recognise that health-related information deserves higher protection than ordinary personal data. Yet most legal instruments were drafted when collection and disclosure were the main points of vulnerability. The computational turn changes the object of governance. The central act is now often not transfer but transformation: converting biological traces into statistical proxies, categorical labels and intervention triggers.
This is visible in the architecture of modern care. Wearables and remote monitoring systems feed longitudinal streams into clinical dashboards. Diagnostic systems rely on software that identifies patterns inaccessible to ordinary observation. Administrative systems infer likely no-shows, medication adherence and cost risk from combinations of medical and social variables. Each layer produces a new representation of the patient that may shape treatment, pricing, eligibility or surveillance. These representations are often neither obvious to the person concerned nor contestable in practice.
The OECD Recommendation on Health Data Governance and the WHO guidance on AI for health both point in this direction: governance must address secondary use, accountability and trustworthy oversight, not mere storage hygiene. By mid-2026, the gap between privacy compliance and substantive control over computational uses of biodata has become one of the defining weaknesses of health policy.
The clinic as a sovereignty boundary
Sovereignty is usually discussed at the scale of the state, but the clinic has become an operational border post. It decides which external datasets enter patient care, which software outputs count as evidence, and which foreign-developed models are treated as clinically authoritative. These are not neutral technical choices. They determine whether a health system can explain, audit and, when needed, override the computational judgements made about its population.
Consider the practical difference between storing domestic health records on national infrastructure and relying on opaque external systems to derive risk scores from them. In the first case, the state may secure data residency while still surrendering interpretive power. In the second, the crucial dependency lies in the inference layer: the methods, validation standards, performance thresholds and update cycles that shape care. Clinical sovereignty therefore depends on the ability to contest an inference, not just to access a file.
The body is becoming a site of continuous computation.
This is why the debate over health-data spaces in Europe matters beyond interoperability. The policy challenge is not simply making information portable across borders or institutions. It is ensuring that the rules for access, reuse and algorithmic deployment do not create a one-way pipeline from public clinical environments to private or extra-jurisdictional inference systems that public authorities cannot meaningfully govern.
The politically consequential asset is no longer the record but the modelled body.
Why consent weakens under continuous sensing
Consent remains an important ethical and legal device, but continuous sensing exposes its limits. A patient may agree to remote cardiac monitoring, but cannot realistically foresee all future inferences that may be drawn from variations in pulse, sleep or activity. A worker may accept fatigue detection in a safety-critical setting, yet not understand how similar signals could later be repurposed in insurance assessment or disciplinary review. In neurotechnology, the problem is even sharper, because signals captured for assistance or rehabilitation may also reveal attention, stress or intention-related patterns that carry social meaning beyond medicine.
UNESCO's recommendation on responsible innovation in neurotechnology reflects this concern by treating brain-related data as especially sensitive and by emphasising agency, autonomy and mental privacy. The lesson extends more widely. If the same stream of physiological data can support care, productivity management, consumer profiling and state oversight, then individual permission cannot bear the full burden of governance. The relevant sovereign question becomes institutional: which uses are prohibited, which require public interest justification, and which must remain inside specially governed clinical or research contexts.
Inference rights are becoming more important than access rights
For two decades, information policy has emphasised rights of notice, access, correction and deletion. Those remain valuable, but they are poorly matched to machine-derived health inferences. A person may be able to download a record and still have no way to inspect the latent variables, feature weightings or benchmark populations used to classify their body as risky, non-compliant or impaired. Nor is deletion a complete remedy if the consequential decision rests on a model trained on many similar bodies and then applied afresh.
A more fitting agenda is emerging around inference rights: the right to know when clinically or administratively significant conclusions are machine-derived; the right to understand the evidentiary basis and validation context of such conclusions; the right to challenge them before human authorities with real power to reverse decisions; and the right to limits on the use of especially intimate signals, including neural and behavioural biometrics, outside clearly bounded purposes. These ideas are scattered across data protection law, medical device regulation, bioethics and administrative procedure, but they have not yet been consolidated into a coherent doctrine.
The AI regulatory framework in Europe begins to address high-risk uses, especially in health and biometrics, yet implementation will determine whether oversight reaches the actual site of harm: not the abstract model, but the institutional workflow where a body is translated into action.
Biometrics are migrating from identity to behaviour
Much public discussion of biometric sovereignty still centres on faces, fingerprints and border control. That is too narrow. In medicine and adjacent sectors, biometrics are increasingly behavioural and physiological: voice, micro-movements, pupillary response, gait, tremor, respiration, typing cadence and electroencephalographic patterns. These do not merely identify a person; they can be used to infer capacity, impairment, distress, deception or probable future need.
The governance implications are profound. Identity biometrics typically answer the question, is this person who they claim to be. Behavioural biometrics answer a more intrusive one, what is this body likely to do, feel or become. That second category blurs the boundary between diagnosis, surveillance and prediction. It also invites institutional overreach, because probabilistic indicators generated in one context may be treated as objective facts in another.
Here sovereignty requires proportionality rules that attach to function, not only to data type. A pulse waveform used to manage an arrhythmia should not silently become a basis for employability assessment. A speech pattern recorded for telemedicine should not automatically migrate into systems that score cognitive decline for unrelated administrative purposes. The problem is not only misuse after collection; it is the false legitimacy conferred when medical-looking signals travel into non-medical domains.
Clinical sovereignty depends on the ability to contest an inference, not just to access a file.
Public health lessons from emergency measures
The pandemic years offered a preview of this tension. Emergency data practices showed that extraordinary access to health-related information can be justified under pressing public need, but also that temporary infrastructures have a habit of outlasting the event that made them politically acceptable. As the New England Journal of Medicine noted early in the crisis, privacy debates in public health emergencies cannot be reduced to a simple trade-off. Legitimacy depends on necessity, proportionality, time limitation and institutional trust.
Those principles now need translating to peacetime digital medicine. Continuous health monitoring, synthetic data development, federated learning and large-scale clinical decision support may all serve legitimate aims. But absent clear boundaries, systems built for care can become platforms for routine behavioural scrutiny. Bio-digital sovereignty therefore includes the capacity to sunset exceptional measures, constrain repurposing and preserve spaces in which the body is not continuously legible to institutions.
The overlooked problem of benchmark populations
One of the least discussed sovereignty issues lies in benchmark populations: the reference groups against which bodies are measured. A risk model built on one population may travel poorly to another because disease prevalence, clinical practice, environmental exposure and reporting norms differ. This is often discussed as a fairness or safety problem. It is also a sovereignty problem, because imported benchmarks can quietly redefine what counts as normal, urgent or pathological in a local health system.
If a neurological or cardiometabolic model is validated mainly on external cohorts, domestic clinicians may inherit thresholds that do not match local realities. This can affect resource allocation, screening intensity and even reimbursement. National capability, in this context, does not mean autarky. It means having the scientific and regulatory means to evaluate whether the computational body being used in care resembles the actual population under care.
Clinical sovereignty depends on the ability to contest an inference, not just to access a file.
This concern also cuts across intellectual property debates. Patents, trade secrets and proprietary validation claims can make it difficult for public authorities and independent researchers to inspect benchmark choices or update mechanisms. WIPO's work on assistive and health-related technologies illustrates the scale of innovation. The public question is how to preserve incentives for development without allowing clinically significant opacity to become structurally unaccountable.
Neurodata sharpens every fault line
No subfield makes these issues clearer than neurotechnology. Brain-related data have long attracted exceptional ethical concern because they appear unusually close to intention, cognition and emotion. In practice, the most immediate policy challenge is less science fiction than institutional creep. Signals collected for communication aids, rehabilitation, sleep analysis or research may gradually feed broader systems of assessment and optimisation. Once neurodata are normalised as just another sensor input, existing governance categories begin to strain.
UNESCO and other international bodies have therefore stressed mental privacy, autonomy and human dignity. Yet these values need administrative expression. A sensible approach would distinguish sharply between therapeutic use, research use and non-clinical behavioural inference, while imposing heightened evidentiary thresholds for any claim that neural signals can robustly support decisions about competence, intent or character. In other words, sovereignty in the neural domain depends not only on stronger confidentiality but on public control over what institutions are permitted to infer from uncertain signals.
The body is becoming a site of continuous computation.
Standards are political instruments
Much of this future will be decided not in legislatures alone but in standards bodies, procurement rules and certification regimes. NIST's privacy framework, the WHO's digital health strategy, and European efforts around data spaces and AI oversight all show that governance increasingly operates through technical and organisational standards. Choices about logging, traceability, auditability, interoperability and post-market monitoring determine whether oversight is symbolic or real.
Standards are often presented as neutral plumbing. They are not. A requirement to record model updates, preserve validation documentation, separate clinical from non-clinical use cases, and allow independent auditing can materially redistribute power between public institutions, vendors, researchers and patients. Conversely, poorly designed interoperability can make extraction and repurposing easier than accountability.
The crucial point is that bio-digital sovereignty cannot be secured by constitutional principle alone. It must be built into the mundane mechanics of health infrastructure: who can query what, under which warrant, with what logs, and subject to whose review.
What a sovereign approach would actually protect
A serious doctrine of bio-digital sovereignty would protect at least four things. First, context integrity: biological signals collected for care should not freely migrate into unrelated decision systems. Second, inference accountability: significant classifications about a person's body should be reviewable, explainable in context, and reversible. Third, institutional competence: public authorities need the technical capacity to evaluate clinical models, benchmark populations and post-deployment drift. Fourth, zones of non-computation: some bodily domains, especially those proximate to thought, emotion and intimate behaviour, should face strict limits on routine machine interpretation outside therapeutic or well-governed research settings.
None of this implies opposition to digital medicine. On the contrary, robust governance is a precondition for preserving trust in beneficial uses. Health systems need data, analytics and interoperable tools to improve care, allocate resources and accelerate research. But if the body becomes permanently available for institutional computation without meaningful limits, then the result is not modernisation. It is a quiet transfer of authority over human interpretation from clinicians, patients and publics to remote systems that are difficult to see and harder still to contest.
A new constitutional question for the digital state
By mid-2026, the most important question in this field is no longer whether biodata are sensitive. That has been settled for years. The harder question is constitutional in character: when public and private institutions can continuously sense, model and infer from the body, what forms of authority should they be allowed to exercise on that basis.
The answer will shape more than privacy law. It will influence labour relations, insurance markets, disability rights, medical research, policing boundaries and the legitimacy of public health administration. The old paradigm assumed that freedom depended on limiting access to personal files. The new one must recognise that freedom also depends on limiting the kinds of machine-readable claims institutions may make about the body, and the actions they may take in response.
The next sovereignty dispute will therefore not be about data location alone. It will concern the lawful perimeter of bodily computation: who may turn flesh into signals, signals into inferences, and inferences into power.
