The Clarifying Lawful Overseas Use of Data Act or “CLOUD Act” is a United States federal law enacted in 2018 on access to data by foreign governments. It is generally viewed as an act which serves to strengthen the case for cross-border government surveillance.
The CLOUD Act (which amends the Stored Communications Act (SCA) of 1986) allows federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. Until 23 March 2018, the only way for the American government to access overseas data had been to form a Mutual Legal-Assistance Treaty, whereby two countries consent to share information and work together to solve a legal investigation.
The CLOUD Act gives due consideration to data encryption. It also discourages the government from using it to insist that companies loosen their encryption. This is a process integral to the security of data.
The same act already applies to technological firms like Google, Facebook, Twitter and Instagram. Facebook and Google actually contributed to the new legislation draft along with Apple and Microsoft. The government’s collaboration with these companies indicates a shift in balance towards the large scale technical solution provider. All enterprises will have the responsibility to assign a legal representative for data disclosure matters.
As a result of the CLOUD Act, the European Commission has made a legislative move to enable data information requests. The Commission will also clear the way for the use of electronic evidence stored by EU-registered companies, regardless of specific member state privacy laws. It logically follows that the act will lead to a chain reaction. Other countries will mirror the data disclosure laws and also demand information across borders. One feared consequence of this is that it may trigger an overall degradation in the level of data privacy across the globe.
United Kngdom is already party to an agreement with the U.S. in regard of mutual application of the CLOUD Act. Following such agreement with the United Kingdom, the United States announced formal negotiations with Australia about joining the CLOUD Act as well.
Under the CLOUD Act, Australia can obtain judicial authority at home and then contact a U.S.-based company directly. This is aimed to reduce the administrative burden on both countries caused by collecting data to be provided to Australia. However, legislation has to be introduced in Australia that matches the CLOUD Act.
[Source: Cloudsigma, Lexology]
