The Recent Enactment of the CLOUD Act Modernizes US Data Privacy Laws and Establishes a Framework for Cross-Border Data Access by the US and Foreign Law Enforcement
The recent enactment of the Clarifying Lawful Overseas Use of Data (CLOUD) Act likely escaped the attention of many businesses and consumers because it was part of the 2,232-page, $1.3 trillion omnibus spending bill signed into law on March 23, 2018. The new law modernizes U.S. data privacy laws and establishes a framework for cross-border data access by U.S. and foreign law enforcement.
The most immediate effect of the CLOUD Act is to moot the ongoing legal dispute between Microsoft Inc. and the federal government. As explained in greater detail in a prior article, the U.S. Supreme Court was poised to decide whether warrants issued under the Stored Communications Act (SCA) could force Microsoft to disclose emails stored on a server in Ireland. However, the Cloud Act provides a legislative solution by amending the SCA to clarify that a “provider of electronic communication service” shall comply with a court order for data “regardless of whether such communication, record or other information is located within or outside of the United States.”
New Bilateral Agreements
Section 105 of the CLOUD Act authorizes the United States to enter into new bilateral executive agreements with foreign governments regarding demands for electronic data. The statute requires that countries satisfy several privacy and human rights requirements. Most notably, the Attorney General, in concert with the Secretary of State, must certify in writing, and provide an accompanying explanation, that the foreign government “affords robust substantive and procedural protections for privacy and civil liberties in light of the data collection and activities of the foreign government that will be subject to the agreement.”
Tech giants Microsoft, Google, Apple and Facebook supported the passage of the CLOUD Act. In a letter to Congress, the companies highlighted that the legislation would “create a concrete path for the U.S. government to enter into modern bilateral agreements with other nations that better protect customers.” They further highlighted that the Cloud Act’s “baseline privacy, human rights and rule of law standards in order for a country to enter into an agreement” will “ensure customers and data holders are protected by their own laws and that those laws are meaningful.” The letter also noted that the bill would “further allow law enforcement to investigate cross-border crime and terrorism in a way that avoids international legal conflicts.”
Civil rights groups have been less supportive of the CLOUD Act. In a letter to Congress, the American Civil Liberties Union (ACLU) raised concerns about potential civil rights abuses by foreign governments. “The human rights standards that countries must meet to be eligible for an agreement are vague, weak, and unclear,” the ACLU wrote. “For example, among other concerns, the bill does not explicitly prohibit agreements with countries that have a pattern or practice of engaging in human rights violations, nor does it require an assessment of whether a country has effective control of intelligence or law enforcement units.”
Data Requests by Foreign Governments
Of course, access to data will be a two-way street once bilateral agreements are in place. Critics of the CLOUD Act maintain that the new law does not provide enough oversight over foreign governments’ access to data stored by U.S. providers. Under the existing MLAT process, a U.S. judge must first approve a foreign government’s request to access data from U.S. providers. The CLOUD Act mandates that data requests be “based on requirements for a reasonable justification based on articulable and credible facts, particularity, legality, and severity regarding the conduct under investigation.” It further requires that data requests be subject to review or oversight by a local court, judge, or magistrate or other independent authority.
When seeking the data of U.S. citizens and residents, foreign governments would still need a mutual legal assistance treaty (MLAT) and to obtain a warrant based on probable cause. Nonetheless, civil rights and privacy groups have also raised concerns that the CLOUD Act lacks the necessary administrative and constitutional safeguards needed to protect Americans. The law provides that foreign governments must “segregate, seal, or delete, and not disseminate material” that is not “relevant to the prevention, detection, investigation, or prosecution of serious crime, including terrorism.” However, it also mandates that foreign governments share with the U.S. government any information that “relates to significant harm” the U.S. or its citizens.
In another letter to Congress, the ACLU, along with several other civil rights organizations, including the Electronic Frontier Foundation (EFF), Human Rights Watch, and Amnesty International USA, argued that the CLOUD Act will allow foreign governments to obtain information that could pertain to individuals in the U.S. without meeting constitutional standards. “The bill would allow searches and seizures within the U.S. that do not meet the standards set out in the Fourth Amendment,” the organizations argued. “It would also permit foreign governments to share incidentally collected data about Americans with U.S. governmental entities, even when obtained under standards lower than what the Constitution requires.”
Overall, the CLOUD Act represents a significant change in the way the United States will handle cross-border requests for data. Until the new law is put into practice and bilateral agreements are executed with foreign governments, it is difficult to predict whether the privacy concerns raised by critics will come to fruition. Our technology and data privacy attorneys will be closely monitoring the implementation of the CLOUD Act, with an eye towards how it will impact U.S. providers. We encourage you to contact us with any questions.
If you have any questions about the CLOUD Act, please contact us
Do you have any feedback, thoughts, reactions or comments concerning this topic? Feel free to leave a comment below for Fernando M. Pinguelo. If you have any questions about this post, please contact me or the Scarinci Hollenbeck attorney with whom you work. To learn more about data privacy and security, visit eWhiteHouse Watch – Where Technology, Politics, and Privacy Collide (http://ewhwblog.com).
Does Your Homeowners Insurance Provide Adequate Coverage?
Your home is likely your greatest asset, which is why it is so important to adequately protect it. Homeowners insurance protects you from the financial costs of unforeseen losses, such as theft, fire, and natural disasters, by helping you rebuild and replace possessions that were lost While the definition of “adequate” coverage depends upon a […]
Understanding the Importance of a Non-Contingent Offer
Making a non-contingent offer can dramatically increase your chances of securing a real estate transaction, particularly in competitive markets like New York City. However, buyers should understand that waiving contingencies, including those related to financing, or appraisals, also comes with significant risks. Determining your best strategy requires careful analysis of the property, the market, and […]
Fred D. Zemel Appointed Chair of Strategic Planning at Scarinci & Hollenbeck, LLC
Business Transactional Attorney Zemel to Spearhead Strategic Initiatives for Continued Growth and Innovation Little Falls, NJ – February 21, 2025 – Scarinci & Hollenbeck, LLC is pleased to announce that Partner Fred D. Zemel has been named Chair of the firm’s Strategic Planning Committee. In this role, Mr. Zemel will lead the committee in identifying, […]
Novation Agreement Process: Step-by-Step Guide for Businesses
Big changes sometimes occur during the life cycle of a contract. Cancelling a contract outright can be bad for your reputation and your bottom line. Businesses need to know how to best address a change in circumstances, while also protecting their legal rights. One option is to transfer the “benefits and the burdens” of a […]
What Is a Trade Secret? Key Elements and Legal Protections Explained
What is a trade secret and why you you protect them? Technology has made trade secret theft even easier and more prevalent. In fact, businesses lose billions of dollars every year due to trade secret theft committed by employees, competitors, and even foreign governments. But what is a trade secret? And how do you protect […]
What Is Title Insurance? Safeguarding Against Title Defects
If you are considering the purchase of a property, you may wonder — what is title insurance, do I need it, and why do I need it? Even seasoned property owners may question if the added expense and extra paperwork is really necessary, especially considering that people and entities insured by title insurance make fewer […]
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.
Sign up to get the latest from our attorneys!
Explore What Matters Most to You.
Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.
Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.
What NJ Businesses and Consumers Need to Know About the Cloud Act
Author: Scarinci Hollenbeck, LLC
The Recent Enactment of the CLOUD Act Modernizes US Data Privacy Laws and Establishes a Framework for Cross-Border Data Access by the US and Foreign Law Enforcement
The recent enactment of the Clarifying Lawful Overseas Use of Data (CLOUD) Act likely escaped the attention of many businesses and consumers because it was part of the 2,232-page, $1.3 trillion omnibus spending bill signed into law on March 23, 2018. The new law modernizes U.S. data privacy laws and establishes a framework for cross-border data access by U.S. and foreign law enforcement.
The most immediate effect of the CLOUD Act is to moot the ongoing legal dispute between Microsoft Inc. and the federal government. As explained in greater detail in a prior article, the U.S. Supreme Court was poised to decide whether warrants issued under the Stored Communications Act (SCA) could force Microsoft to disclose emails stored on a server in Ireland. However, the Cloud Act provides a legislative solution by amending the SCA to clarify that a “provider of electronic communication service” shall comply with a court order for data “regardless of whether such communication, record or other information is located within or outside of the United States.”
New Bilateral Agreements
Section 105 of the CLOUD Act authorizes the United States to enter into new bilateral executive agreements with foreign governments regarding demands for electronic data. The statute requires that countries satisfy several privacy and human rights requirements. Most notably, the Attorney General, in concert with the Secretary of State, must certify in writing, and provide an accompanying explanation, that the foreign government “affords robust substantive and procedural protections for privacy and civil liberties in light of the data collection and activities of the foreign government that will be subject to the agreement.”
Tech giants Microsoft, Google, Apple and Facebook supported the passage of the CLOUD Act. In a letter to Congress, the companies highlighted that the legislation would “create a concrete path for the U.S. government to enter into modern bilateral agreements with other nations that better protect customers.” They further highlighted that the Cloud Act’s “baseline privacy, human rights and rule of law standards in order for a country to enter into an agreement” will “ensure customers and data holders are protected by their own laws and that those laws are meaningful.” The letter also noted that the bill would “further allow law enforcement to investigate cross-border crime and terrorism in a way that avoids international legal conflicts.”
Civil rights groups have been less supportive of the CLOUD Act. In a letter to Congress, the American Civil Liberties Union (ACLU) raised concerns about potential civil rights abuses by foreign governments. “The human rights standards that countries must meet to be eligible for an agreement are vague, weak, and unclear,” the ACLU wrote. “For example, among other concerns, the bill does not explicitly prohibit agreements with countries that have a pattern or practice of engaging in human rights violations, nor does it require an assessment of whether a country has effective control of intelligence or law enforcement units.”
Data Requests by Foreign Governments
Of course, access to data will be a two-way street once bilateral agreements are in place. Critics of the CLOUD Act maintain that the new law does not provide enough oversight over foreign governments’ access to data stored by U.S. providers. Under the existing MLAT process, a U.S. judge must first approve a foreign government’s request to access data from U.S. providers. The CLOUD Act mandates that data requests be “based on requirements for a reasonable justification based on articulable and credible facts, particularity, legality, and severity regarding the conduct under investigation.” It further requires that data requests be subject to review or oversight by a local court, judge, or magistrate or other independent authority.
When seeking the data of U.S. citizens and residents, foreign governments would still need a mutual legal assistance treaty (MLAT) and to obtain a warrant based on probable cause. Nonetheless, civil rights and privacy groups have also raised concerns that the CLOUD Act lacks the necessary administrative and constitutional safeguards needed to protect Americans. The law provides that foreign governments must “segregate, seal, or delete, and not disseminate material” that is not “relevant to the prevention, detection, investigation, or prosecution of serious crime, including terrorism.” However, it also mandates that foreign governments share with the U.S. government any information that “relates to significant harm” the U.S. or its citizens.
In another letter to Congress, the ACLU, along with several other civil rights organizations, including the Electronic Frontier Foundation (EFF), Human Rights Watch, and Amnesty International USA, argued that the CLOUD Act will allow foreign governments to obtain information that could pertain to individuals in the U.S. without meeting constitutional standards. “The bill would allow searches and seizures within the U.S. that do not meet the standards set out in the Fourth Amendment,” the organizations argued. “It would also permit foreign governments to share incidentally collected data about Americans with U.S. governmental entities, even when obtained under standards lower than what the Constitution requires.”
Overall, the CLOUD Act represents a significant change in the way the United States will handle cross-border requests for data. Until the new law is put into practice and bilateral agreements are executed with foreign governments, it is difficult to predict whether the privacy concerns raised by critics will come to fruition. Our technology and data privacy attorneys will be closely monitoring the implementation of the CLOUD Act, with an eye towards how it will impact U.S. providers. We encourage you to contact us with any questions.
If you have any questions about the CLOUD Act, please contact us
Do you have any feedback, thoughts, reactions or comments concerning this topic? Feel free to leave a comment below for Fernando M. Pinguelo. If you have any questions about this post, please contact me or the Scarinci Hollenbeck attorney with whom you work. To learn more about data privacy and security, visit eWhiteHouse Watch – Where Technology, Politics, and Privacy Collide (http://ewhwblog.com).
Let`s get in touch!
Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!
