Proposed US law would let Federal law enforcement agencies take data from computers anywhere worldwide

Written by David Adams

The US Congress is considering passing legislation that would mean US law enforcement agencies could demand emails and other personal communications from computers overseas, using a judicial subpoena. It would also allow other governments to ask to see the personal data of their citizens stored on computers in the US, subject to sharing agreements.

The Clarity Lawful Overseas Use of Data (CLOUD) Act is actually a by-product of a long-running legal dispute between the US Government and Microsoft, which involves the government trying to access a Microsoft customer’s emails stored on a server in Ireland. The Supreme Court will rule on the case later in 2018.

This week 35 US states’ Attorney Generals signed an open letter calling for the Act to be passed as quickly as possible. The letter states that the Act: “creates incentives for our foreign partners to enter into bilateral agreements that will facilitate cross-border criminal investigations, while ensuring that privacy and civil liberties are respected.”

The legislation is supported by President Trump, Microsoft and some other technology companies, plus politicians elsewhere, including Theresa May. Human rights and other online activists are strongly opposed to it. Camille Fischer, a Frank Stanton Fellow working with the Electronic Frontier Foundation (EFF), has written that the Act is “a bill that diminishes the data privacy of people around the world”, because it would effectively “give unlimited jurisdiction to US law enforcement over any data controlled by a service provider, regardless of where the data is stored and who created it.”

Fischer advocates strengthening the existing system of Mutual Legal Assistance Treaties (MLATs) instead, which allow law enforcement agencies and governments around the world to cooperate in accordance with national data privacy laws if seeking to obtain data held on computers elsewhere.

As things stand, the potential passage of the CLOUD Act is something to which any company storing data within its servers on behalf of customers and/or business partners should pay close attention. This could have significant implications for your company.