Legislation clarifies government’s ability to reach data stored abroad
Q: What’s the CLOUD Act, and how does it change the way government may be able to access companies’ data?
A: Congress recently passed the Clarifying Lawful Overseas
Use of Data Act, which more clearly defines the ability of law enforcement to access data stored in another country.
The CLOUD Act allows U.S. law enforcement agencies to compel data providers to produce data stored in a foreign jurisdiction. The act incentivizes foreign governments to enter into agreements with the United States by promising reciprocal access to data between the countries. Previously, since 1986, the government had been able to access data stored within the United States using the Stored Communications Act. But whether the SCA allowed the government to access data stored abroad remained an open question that was pending before the U.S. Supreme Court at the time the CLOUD Act was passed.
Q: How will the CLOUD Act work?
A: The CLOUD Act allows the federal executive branch to enter into reciprocal agreements with countries that offer specified legal protections, including fair trial rights and prohibitions against arbitrary arrests and detention. Once the executive branch proposes an agreement with a country, Congress has 180 days to decide whether to accept or reject the proposed agreement. The executive branch has yet to enter into a reciprocal agreement with another country. The CLOUD Act also ensures that data providers served with a subpoena for data stored abroad retain the right to challenge the subpoena in court, and the statute provides a framework for courts to consider when a provider challenges a subpoena. This framework looks to several factors, including the government’s investigatory interests in the case, the possibility of accessing the information through other means, and the possibility that a provider may be subject to penalties from a foreign government should it comply with the U.S. subpoena.
Q: How might the CLOUD act affect American companies?
A: The CLOUD Act marks a significant victory for law enforcement agencies, as it removes jurisdictional red tape and resolves legal questions that had lingered for years. Not everyone views the CLOUD Act in a positive light, however, as many have emphasized the importance of balancing effective law enforcement with robust privacy rights. Whether the CLOUD Act strikes that balance remains to be seen. In any event, U.S.-based entities and individuals with data stored overseas should be aware that, under the CLOUD Act, the government may be able to reach their data stored abroad.