It must overcome the institutional barriers that make it seemingly impossible to forge a common position on external cyber policy. And it needs to take the foreign-policy implications of its actions seriously: When EU countries talk about data localization, others do too.