The CLOUD Act and Data Privacy: What Does it Mean?

The current slew of questions surrounding data privacy received another complication with the passage of the CLOUD Act.   

The Clarifying Overseas Use of Data—CLOUD—Act allows the U.S. government to access data servers located overseas in a different manner than before. Previously, the government could only access data stored outside their borders via mutual legal-assistance treaties (MLATs). These required two or more nations put in writing the exact details of their cooperation in a legal investigation and a two-thirds vote of the Senate to pass.

The CLOUD ACT, which was included in the most recent spending bill signed by President Trump, allows U.S. law enforcement officers of any level can force technology companies to hand over their user data regardless of the storage location. The CLOUD Act also allows the executive branch—the State Department, the Department of Justice, etc.—to enter into agreements with other nations without congressional approval. The agreements would allow each nation to access information stored in the other, regardless of the location of the data.

The idea behind the law is to update how foreign data requests are handled, and therefore save both time and money. On average, previous MLAT requests took 10 months to fill out. Major tech companies including Microsoft welcomed the update to the laws, as it clarified data request procedures. Microsoft had a case pending in the Supreme Court on the issue.

However, the CLOUD ACT is being met with serious derision by civil liberties advocacy groups such as Amnesty International due to its method of passage and for potentially compromising the data privacy of users around the world. The CLOUD Act did not undergo legislative action or review prior to its passage as it was bundled in a must-pass spending bill to keep the government open. Law does not outline a procedure for vetting foreign data requests.