The Digital Legal Nexus: Rethinking Sovereignty, Personhood, and Harm

The digital revolution has not merely introduced new technologies but has fundamentally altered the ontological and epistemological foundations upon which modern legal systems are built. Law, as a social technology, has historically evolved in response to shifts in material conditions—from the agrarian to the industrial, and now to the informational. Yet the current transition is distinct in its velocity, its borderless topology, and its delegation of agency to non-human, autonomous systems. The classical trinity of sovereignty, legal personhood, and harm—cornerstones of jurisprudential thought from Bodin to Hobbes to modern tort and criminal law—are being strained to the point of conceptual rupture. Data flows defy territorial boundaries; algorithms make decisions that attribution of intent or negligence; and systemic, probabilistic harms challenge the individualized, causation-based models of redress. This chapter argues that continuing to apply these anthropocentric, territorially bounded, and ex-post-facto frameworks to algorithmic society is not merely inefficient but is a profound misrecognition of the nature of digital power. It creates a "governance gap," where significant sources of social ordering—code, platforms, machine learning models—operate with minimal democratic oversight or legal accountability. The task is therefore not one of incremental reform but of foundational rethinking: constructing new jurisprudential primitives suited to a distributed, networked, and post-human reality. This requires confronting three core conceptual tensions: the balance between individual and collective rights in an era of systemic risk; the shift from reactive, ex-post liability to proactive, ex-ante governance; and the perennial challenge of calibrating the law's protective function against the dynamism of innovation. The following deconstruction of sovereignty, personhood, and harm serves as the necessary first step in this intellectual excavation, clearing the ground for the new architectures of governance proposed in subsequent chapters.

**I. The Territorial Mirage: Sovereignty in a World of Flowing Bits**

The principle of territoriality is the bedrock of public international law and domestic jurisdiction. It posits that a state's legal authority is confined within its geographical borders, a concept that made sense in a world where physical presence, property, and effects were co-located. The digital realm, however, is characterized by what David Post famously termed "the rise of the network as a sovereign entity." Data—the lifeblood of the digital economy and the primary object of modern regulation—is simultaneously everywhere and nowhere. A single transaction involving a user in Germany, a server in Ireland, a company incorporated in Delaware, and cloud infrastructure in Singapore, defies the neat spatial logic of territorial sovereignty. This creates a tripartite crisis: the *where* of an act becomes indeterminate; the *whose* law applies is contested; and the *how* of enforcement is technically and politically fraught.

The traditional response has been one of jurisdictional expansionism, often through the doctrine of "effects." The landmark *Calder v. Jones* (1984) test in U.S. law, for example, asserts jurisdiction over foreign defendants if their intentional actions are "expressly aimed at" and cause harm in the forum state. This has been eagerly adopted in the digital context. The European Union's General Data Protection Regulation (GDPR), with its "targeting" criterion for its extraterritorial reach, represents the most potent contemporary example. A non-EU company processing data of individuals in the EU, regardless of where its servers are located, falls under its purview. While pragmatically necessary to protect fundamental rights in a borderless environment, this approach risks recreating a new form of digital imperialism, where the regulatory preferences of major markets (the EU, the U.S., China) become *de facto* global standards through the "Brussels effect" or "California effect," imposed not through treaty but through market size. Smaller nations are left with the binary choice of compliance or exclusion from global data networks.

Conversely, states like China and Russia have championed a model of "cyber-sovereignty" or "digital sovereignty," which seeks to re-territorialize the internet through data localization laws, content filtering, and control over critical internet infrastructure. This model asserts that the internet, like any other space, must be subject to the state's exclusive authority within its borders. While it resolves the jurisdictional ambiguity by force, it fragments the global network ("splinternet"), undermining the universalist ideals of a free and open internet and creating massive inefficiencies for global business. The philosophical underpinning is a reassertion of Westphalian sovereignty in the digital domain, treating data as a national resource akin to territory or minerals.

```mermaid graph TD A[Digital Act<br/>Cross-Border Data Flow] --> B{Jurisdictional Model}; B --> C[Effects-Based Extraterritoriality<br/>(e.g., GDPR)]; B --> D[Cyber-Sovereignty & Data Localization<br/>(e.g., China, Russia)]; B --> E[Multi-Stakeholder Governance<br/>(e.g., ICANN, IETF)]; C --> F[Regulatory Imperialism<br/>vs. Market-Driven Standardization]; D --> G[Network Fragmentation<br/>vs. State Control]; E --> H[Democratic Deficit<br/>vs. Technical Pragmatism]; F & G & H --> I[Persistent Governance Gap<br/>& Normative Conflict]; ```

This impasse suggests that the very concept of sovereignty as exclusive, territorial control may be anachronistic for regulating core digital phenomena. The alternative models—extraterritorial application and cyber-sovereignty—are both forms of what legal scholar Rebecca Crootof calls "digital borders," attempts to map a non-territorial space onto a territorial framework. They are inherently unstable, generating constant conflict, as seen in the Schrems II case, where the Court of Justice of the European Union invalidated the EU-U.S. Privacy Shield precisely because U.S. surveillance laws (extraterritorial in their own right) failed to provide an "essentially equivalent" level of data protection. The conflict is not between two legal systems but between two irreconcilable paradigms of sovereignty: one based on human rights and the territorial state's duty to protect, the other based on national security and the state's right to surveil beyond its borders.

A more radical reconceptualization may be required, moving from sovereignty as *control* to sovereignty as *responsibility*. This aligns with the "duty to protect" framework in international human rights law, which imposes obligations on states to prevent abuses by third parties within their jurisdiction, regardless of where the harm originates. In the digital context, this could mean that a state's responsibility is triggered not by where the server is, but by where the significant effects of an algorithm are felt, or where the key design decisions and business models are made. It shifts the focus from the location of bits to the locus of power and accountability. The state's role becomes one of ensuring that actors subject to its effective regulatory reach (based on incorporation, substantial business, or targeted effects) adhere to baseline standards, while cooperating internationally on enforcement. This does not solve all problems—it still grapples with the "who" of enforcement against truly decentralized entities like blockchain networks—but it better aligns legal authority with the economic and social reality of digital power.

**II. Beyond the Human Subject: The Crisis of Legal Personhood**

Legal personhood is the conceptual gateway through which entities enter the legal system, acquire rights, and incur duties. Its history is one of gradual expansion: from natural persons (human beings) to j