CLOUD Act

Content sourced from Wikipedia, licensed under CC BY-SA 3.0.

The Clarifying Lawful Overseas Use of Data Act, or CLOUD Act, is a U.S. federal law enacted in 2018 as part of the Consolidated Appropriations Act. It updates the Stored Communications Act to help law enforcement get data from cloud providers, no matter where the data is stored.

Why it was created
The FBI faced problems when trying to obtain data stored on servers outside the United States under the old law. A famous case involved Microsoft and emails stored in Ireland, which highlighted how the old rules were not fit for cloud computing. CLOUD Act aims to fix this by letting U.S. authorities issue warrants or subpoenas for data held by U.S.-based tech companies, even if the data lives overseas.

What the law does
- U.S. law enforcement can compel access to stored data from cloud providers with a warrant or subpoena, regardless of where the data is stored.
- The law creates a faster alternative to the traditional mutual legal assistance treaty (MLAT) process through executive agreements with foreign countries, as long as those countries have adequate data protections. The first such agreement was with the United Kingdom.
- Courts can require parent companies to provide data held by their subsidiaries.
- The act applies to all electronic communication or remote computing service providers that operate in the U.S., not just U.S.-based companies.

What happened after it passed
- The act was added to the Consolidated Appropriations Act, 2018, and signed into law on March 23, 2018.
- The Department of Justice supported CLOUD Act, along with major tech companies like Microsoft, AWS, Apple, and Google.
- Civil rights groups criticized it, arguing it could undermine Fourth Amendment protections and bypass U.S. courts, potentially exposing users to data requests from foreign governments.
- In 2018, the Supreme Court vacated part of a related Microsoft case because CLOUD Act allowed a new warrant to be issued, making the earlier dispute moot.
- The European Data Protection Supervisor warned of possible conflicts with GDPR, and some countries began pushing data to stay within their borders.

In short, CLOUD Act lets U.S. authorities access data stored abroad through warrants, while offering a framework to work with foreign governments to do so more quickly, as long as sufficient protections for privacy are in place.