Articles

The CLOUD-Act: U.S. sets the rules for cross-border e-evidence gathering?

The CLOUD-Act: U.S. set the rules for cross-border e-evidence gatheri

The CLOUD-Act: U.S. sets the rules for cross-border e-evidence gathering?

11.04.2018 BE law

On March 23, 2018, the U.S. Congress passed the Clarifying Overseas Use of Data Act (CLOUD Act), which provides for important changes in relation to cross-border law enforcement access to communications data.

The Cloud Act covers the disclosure of content, records and other information pertaining to a customer or subscriber within the possession, custody or control of a provider of an electronic communication service or remote computing service. The Act has a dual purpose, explicitly allowing US law enforcement authorities to access data stored abroad and allowing foreign (non-US) authorities to directly seek the disclosure of data by US-providers when certain conditions are met.  

Access by U.S. LEA to data stored abroad

Firstly, the Act aims to solve the issue in the Microsoft case, which is pending before the U.S. Supreme Court. This case addresses the question whether U.S. law enforcement can legitimately oblige Microsoft, located in the US, to provide communications data that are stored on servers in Ireland. The CLOUD Act explicitly gives U.S. law enforcement authorities the possibility to compel providers (such as email service providers, certain cloud service providers and social media providers) to disclose communication data regardless of where the data in question are stored (on or outside U.S. territory).

The Act also adopts a procedure for addressing potential conflicts of laws, taking into account foreign (privacy) laws:

  •  It provides for a specific balancing mechanism in relation to orders to disclose content that potentially breach the laws of a qualifying foreign government (i.e. a country that has signed an executive agreement with the United States to facilitate cross-border law enforcement access to data (infra)). In those circumstances, the (potentially foreign) provider concerned may file a motion to have the order for disclosure modified or quashed if it reasonably believes that (i) the customer or subscriber is not a United States person or he or she does not reside in the United States and (ii) the required disclosure would create a material risk that laws of a qualifying foreign government would be violated. A court will decide whether the order should be modified or quashed while having a rather wide margin of appreciation (taking into account the investigative interests of the US, the foreign government’s interest in preventing disclosure, the location and nationality of the subscriber or customer in question, etc.). This balancing mechanism shall be the sole basis for moving to quash on the grounds of a conflict of law related to a qualifying government.
  • The CLOUD Act does not give clear guidelines, however, when service providers are confronted with disclosure orders that could potentially violate foreign legislation outside said hypotheses (such as orders potentially violating the laws of non-qualifying foreign governments). It even explicitly states that the introduction of the balancing mechanism does not affect existing standards in relation to compulsory procedures not covered by the said mechanism. Therefore, the CLOUD Act does not answer the currently pressing question about what standards do apply in those circumstances. As long as governments do not acquire the capacity of a “qualifying foreign government”, it thus seems that providers are still left in the dark as to how they should respond to U.S. requests that could potentially violate foreign (privacy) laws (such as orders to produce data on a foreign customer or subscriber).

Cross-border cooperation orders from foreign LEA

Secondly, the CLOUD Act allows foreign (non-U.S.) governments the possibility to enter into an executive agreement with the United States. Once such executive agreement is concluded, the foreign government becomes a qualifying foreign government (supra). The executive agreement would permit U.S. service providers to intercept or disclose communication content in response to an order coming from a government that is signatory of the said agreement. This is not the case, however, if the order targets a U.S. person or person located in the U.S.

In order to be eligible to enter into an executive agreement, the criminal justice system of the foreign government must meet a set of criteria aimed at ensuring robust protection of the right to privacy and other civil liberties, such as the freedom of speech. Furthermore, the Cloud Act spells out procedural requirements in relation to said cross-border cooperation orders. The order should relate to serious crime, indicate a specific identifier as the object of the order, comply with the domestic law of the country concerned, be reasonably justified, and subject to review by an independent authority.

The executive agreements will be based on the principle of reciprocity. The foreign governments will have to remove restrictions on communications service providers (including providers that are subject to U.S. jurisdiction) and thereby allow them to respond to valid cooperation orders coming from U.S. governmental entities. Furthermore, the local laws have to provide substantive and procedural opportunities to service providers which are similar to the balancing mechanism mentioned above.

Awaiting disclosure of EU legislative initiatives

In the meanwhile, the European Commission is, in turn, working on legislation concerning cross border e-evidence gathering from an EU law perspective. Release of the said initiative has been expected for a while and is now scheduled for mid-April. It remains to be seen whether the EU point of view will coincide with the U.S. perspective and whether and/or under what circumstances it will remain possible for individual EU Member States to enter into executive agreements with the United States further to the CLOUD Act. 

To be continued…

(CLOUD-Act: H.R.1625 – 115th Congress, https://www.congress.gov/115/bills/hr1625/BILLS-115hr1625enr.pdf, 866 et seq.)

Related news

22.05.2020 BE law
International Comparative Legal Guide to Restructuring & Insolvency 2020 - Belgium chapter

Articles - The Belgium Chapter of the International Comparative Legal Guide to Restructuring & Insolvency 2020 is online. The publication, authored by Paul Van der Putten and Pieter Wouters, covers common topics in restructuring and insolvency, including issues that arise when a company is in financial difficulties, restructuring options, insolvency procedures, tax, employees, and cross-border issues in 27 jurisdictions. 

Read more

27.05.2020 NL law
Accountants advising in real estate transactions: be aware of penalties in mortgage deeds

Short Reads - The Court of Appeal of Arnhem-Leeuwarden ruled on 3 March 2020 that an accountant did not properly advise her client with respect to a sale of real estate (ECLI:NL:GHARL:2020:1875). In her research concerning the consequences of the sale, the accountant had failed to properly review the contracts between the seller and the financier of the real estate. The accountant had therefore acted unlawfully.

Read more

20.05.2020 NL law
Stibbe in Amsterdam answers questions from consumers, small business foundations and NGOs about the coronavirus [updated]

Inside Stibbe - In a special Q&A (in Dutch), lawyers from our Amsterdam office share their legal expertise and strive to provide answers to questions put to us by consumers, self-employed persons, enterprises large and small, foundations and NGOs as a result of the corona crisis.

Read more