THE JURISPRUDENCE OF THERMODYNAMICS: DOCTRINAL CONFLICTS BETWEEN HIGH-AVAILABILITY CYBERSECURITY AND ENVIRONMENTAL FINITUDE IN DATA CENTRE REGULATION

The digital era brings to the foreground the need for securing data against the onslaught of incredibly sophisticated, persistent adversaries, but the physical reality in the Anthropocene brings to us the need of healing our planet from staggering resource depletion. At the moment, the European law stands between these two existential issuances opposing each other in a zero-sum game manifested at the data center walls.     The insistence on "absolute" resilience along with the maximum-security measures in the continuity, which don't count on the cost of thermodynamics, current cybersecurity regulations practically enforce the loss of energy on a large scale. On the opposite side, the basic system requirements to be achieved of true sustainability through methods like dynamic throttling, latency acceptance, and algorithmic approximation, cause the security measures to become lax from the initial rigid demand of law, exposing the operators to stringent legal liability, hefty fines, and irreparable reputational harm.     Legal scholarship should move beyond its dystopic perspective of software and engage actively with the reality of finite hardware in cyberspace. The extremely secure and low-energy data center is a technical challenge to be overcome, however, under the current legal paradigms, it is fraught with peril. Until the legislative measures and judicial thinking i.e. the hard and fast laws of energy provision and boundless firewalls, data center managers will stay galleyed in the friction of finitude forced to choose between the well-being of the server and the health of the planet.

[1] Proposal for a Regulation laying down harmonised rules on artificial intelligence (AI Act) COM/2021/206 final (illustrating the shift toward risk-proportionate technology regulation).[1] NIS 2 Directive, art 20(1).[1] UN General Assembly, 'Report of the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace' (2015) UN Doc A/70/174.[1] NIS 2 Directive, art 21(1).[1] Consolidated Version of the Treaty on European Union [2012] OJ C326/13, art 5(4).[1] Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (Schrems II) Case C-311/18 [2020] ECLI:EU:C: 2020:559; Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources Joined Cases C-293/12 and C-594/12 [2014] ECLI:EU:C:2014:238.[1] Commission v Germany Case C-418/04 [2007] ECR I-10947.