

US-based software does have hosting physically in EU, which makes it in the same legal domain, but US has the CLOUD Act, where US can force their companies, even if abroad, to pull data to US. So, being simply in the same legal domain or country does not make it sovereign. You actually need your own hardware and the full software stack where there is no foregin ownership to actually be sovereign.
And if you just scale up from individual persons to nations/blocks, whats the difference between “I will not use Google Drive, I will selfhost Nextcloud” and “EU will not use Google Drive, it will selfhost Nextcloud”.
Me in this case is just not a person, but a country/political entity. EU is selfhosting instead of using US-provided hosting.

What is “minimum necessary data”? Or does everyone define that for themselves?