Cross-border data storage still cloudy

Congress, industry and privacy groups wrestled for years about how best to structure a law covering cross-border data requests, but it was a case involving Microsoft that moved the issue to the fore.

In Microsoft v. U.S., the company resisted an FBI warrant for data stored in an Irish data center, arguing that while the data pertained to a U.S. investigation, it was outside U.S. jurisdiction. The legal battle was rendered moot by the passage of the Clarifying Lawful Overseas Use of Data Act, or CLOUD Act, which modified the Stored Communications Act of 1986 to cover cloud storage by United States companies, regardless of where their servers may be located.

Speaking at the Academy of European Law Conference in London recently, Assistant Attorney General Richard Downing downplayed the importance of the CLOUD Act to U.S. cases.  The real impact, he said, is in encouraging international cooperation.  Downing said the new law is far superior to the Mutual Legal Assistance Treaty (MLAT) that governed such transactions between the U.S. and Ireland in the past.

Downing lamented a number of "misconceptions" that have followed the CLOUD Act -- namely that it was drafted primarily to serve U.S. interests and that it could make it easier for countries with questionable human rights records to obtain electronic data on their citizens from U.S. providers.

"It offers not simply a solution to the challenge of this moment, but also an aspirational kind of solution," he said. "That is, it is a solution aimed at fostering a community of like-minded, rights respecting countries that abide by the rule of law -- where countries can minimize their conflicts of law and advance their mutual interests based on shared values and mutual respect."

He claimed the impetus for the law came from "our foreign law enforcement partners, who expressed a need for increased speed in obtaining evidence held by U.S. providers" and noted that "the vast majority of major service providers" the CLOUD Act was designed to cover were, by the Justice Department's interpretation, already within the territory and jurisdiction of U.S. law enforcement.

Downing also reiterated assurances that the U.S. would not open up the law's benefits to countries "that do not respect the rule of law and fundamental human rights."

Language in the CLOUD Act gives the executive branch broad discretion to determine whether another country meets the necessary human rights and rule-of-law benchmarks needed to apply for such agreements, with Congress needing a veto-proof majority to reject any the terms of any proposed agreement. The U.S. has yet to establish any bilateral agreements with other nations pursuant to the law.

Downing said the law "does not seek to export U.S. legal standards to other countries," arguing that "few, if any, countries today would qualify" for such agreements if the law insisted that they meet U.S. evidentiary standards.

Neema Singh Guliani, senior legislative counsel for the American Civil Liberties Union, said that is precisely the concern groups like the ACLU and Electronic Frontier Foundation have expressed about the CLOUD Act. They argue that the law lowers the evidentiary threshold required for foreign countries to obtain data stored in the U.S. Both groups have called for policymakers to address outstanding cross-border data issues through MLAT reforms to require countries who request data from the U.S. to meet stricter Fourth Amendment warrant standards.

How it fits with GDPR

While the CLOUD Act was created to resolve legal conflicts faced by private companies that may violate one country's laws by complying with the data requests of another, there are signs that the law itself may be creating new conflicts.

Last year, U.S. law firm Reed Smith wrote that companies that comply with the CLOUD Act could find themselves in violation of Article 48 of the European Union's new General Data Protection Regulations (GDPR), which states that any law requiring the transfer of personal data must be based on international agreements, such as an MLAT.

In January, Matthias Artzt and Walter Delacruz, two lawyers charged with aligning data protection policies at Deutsche Bank with international law, expressed similar concerns.

"From the EU perspective, there is significant concern that U.S. authorities might undermine the GDPR requirements set out in Article 48 by utilizing the U.S. CLOUD Act to compel U.S. organizations providing electronic communication services and remote computing services to allow access to certain types of data stored outside the U.S.," the pair wrote.

The EU is in the midst of considering another law, the E-Evidence Act that would govern many of the same cross-border data issues covered under the CLOUD Act. Downing said the EU proposal "does not offer a pathway for non-EU countries to access evidence they need directly from providers located in EU" and "does not lift any legal restrictions under EU or Member State law that could create a conflict of law."

This article was first posted to FCW, a sibling site to GCN.