What NJ Businesses and Consumers Need to Know About the Cloud Act

The Recent Enactment of the CLOUD Act Modernizes US Data Privacy Laws and Establishes a Framework for Cross-Border Data Access by the US and Foreign Law Enforcement

The recent enactment of the Clarifying Lawful Overseas Use of Data (CLOUD) Act likely escaped the attention of many businesses and consumers because it was part of the 2,232-page, $1.3 trillion omnibus spending bill signed into law on March 23, 2018. The new law modernizes U.S. data privacy laws and establishes a framework for cross-border data access by U.S. and foreign law enforcement.

The most immediate effect of the CLOUD Act is to moot the ongoing legal dispute between Microsoft Inc. and the federal government. As explained in greater detail in a prior article, the U.S. Supreme Court was poised to decide whether warrants issued under the Stored Communications Act (SCA) could force Microsoft to disclose emails stored on a server in Ireland. However, the Cloud Act provides a legislative solution by amending the SCA to clarify that a “provider of electronic communication service” shall comply with a court order for data “regardless of whether such communication, record or other information is located within or outside of the United States.”

New Bilateral Agreements

Section 105 of the CLOUD Act authorizes the United States to enter into new bilateral executive agreements with foreign governments regarding demands for electronic data. The statute requires that countries satisfy several privacy and human rights requirements. Most notably, the Attorney General, in concert with the Secretary of State, must certify in writing, and provide an accompanying explanation, that the foreign government “affords robust substantive and procedural protections for privacy and civil liberties in light of the data collection and activities of the foreign government that will be subject to the agreement.”

Tech giants Microsoft, Google, Apple and Facebook supported the passage of the CLOUD Act. In a letter to Congress, the companies highlighted that the legislation would “create a concrete path for the U.S. government to enter into modern bilateral agreements with other nations that better protect customers.” They further highlighted that the Cloud Act’s “baseline privacy, human rights and rule of law standards in order for a country to enter into an agreement” will “ensure customers and data holders are protected by their own laws and that those laws are meaningful.” The letter also noted that the bill would “further allow law enforcement to investigate cross-border crime and terrorism in a way that avoids international legal conflicts.”

Civil rights groups have been less supportive of the CLOUD Act. In a letter to Congress, the American Civil Liberties Union (ACLU) raised concerns about potential civil rights abuses by foreign governments. “The human rights standards that countries must meet to be eligible for an agreement are vague, weak, and unclear,” the ACLU wrote. “For example, among other concerns, the bill does not explicitly prohibit agreements with countries that have a pattern or practice of engaging in human rights violations, nor does it require an assessment of whether a country has effective control of intelligence or law enforcement units.”

Data Requests by Foreign Governments

Of course, access to data will be a two-way street once bilateral agreements are in place. Critics of the CLOUD Act maintain that the new law does not provide enough oversight over foreign governments’ access to data stored by U.S. providers. Under the existing MLAT process, a U.S. judge must first approve a foreign government’s request to access data from U.S. providers. The CLOUD Act mandates that data requests be “based on requirements for a reasonable justification based on articulable and credible facts, particularity, legality, and severity regarding the conduct under investigation.” It further requires that data requests be subject to review or oversight by a local court, judge, or magistrate or other independent authority.

When seeking the data of U.S. citizens and residents, foreign governments would still need a mutual legal assistance treaty (MLAT) and to obtain a warrant based on probable cause. Nonetheless, civil rights and privacy groups have also raised concerns that the CLOUD Act lacks the necessary administrative and constitutional safeguards needed to protect Americans. The law provides that foreign governments must “segregate, seal, or delete, and not disseminate material” that is not “relevant to the prevention, detection, investigation, or prosecution of serious crime, including terrorism.” However, it also mandates that foreign governments share with the U.S. government any information that “relates to significant harm” the U.S. or its citizens.

In another letter to Congress, the ACLU, along with several other civil rights organizations, including the Electronic Frontier Foundation (EFF), Human Rights Watch, and Amnesty International USA, argued that the CLOUD Act will allow foreign governments to obtain information that could pertain to individuals in the U.S. without meeting constitutional standards. “The bill would allow searches and seizures within the U.S. that do not meet the standards set out in the Fourth Amendment,” the organizations argued. “It would also permit foreign governments to share incidentally collected data about Americans with U.S. governmental entities, even when obtained under standards lower than what the Constitution requires.”

Overall, the CLOUD Act represents a significant change in the way the United States will handle cross-border requests for data. Until the new law is put into practice and bilateral agreements are executed with foreign governments, it is difficult to predict whether the privacy concerns raised by critics will come to fruition. Our technology and data privacy attorneys will be closely monitoring the implementation of the CLOUD Act, with an eye towards how it will impact U.S. providers. We encourage you to contact us with any questions.

If you have any questions about the CLOUD Act, please contact us

Do you have any feedback, thoughts, reactions or comments concerning this topic? Feel free to leave a comment below for Fernando M. Pinguelo. If you have any questions about this post, please contact me or the Scarinci Hollenbeck attorney with whom you work. To learn more about data privacy and security, visit eWhiteHouse Watch – Where Technology, Politics, and Privacy Collide (http://ewhwblog.com).