Articles

The CLOUD-Act: U.S. sets the rules for cross-border e-evidence gathering?

The CLOUD-Act: U.S. set the rules for cross-border e-evidence gatheri

The CLOUD-Act: U.S. sets the rules for cross-border e-evidence gathering?

11.04.2018 BE law

On March 23, 2018, the U.S. Congress passed the Clarifying Overseas Use of Data Act (CLOUD Act), which provides for important changes in relation to cross-border law enforcement access to communications data.

The Cloud Act covers the disclosure of content, records and other information pertaining to a customer or subscriber within the possession, custody or control of a provider of an electronic communication service or remote computing service. The Act has a dual purpose, explicitly allowing US law enforcement authorities to access data stored abroad and allowing foreign (non-US) authorities to directly seek the disclosure of data by US-providers when certain conditions are met.  

Access by U.S. LEA to data stored abroad

Firstly, the Act aims to solve the issue in the Microsoft case, which is pending before the U.S. Supreme Court. This case addresses the question whether U.S. law enforcement can legitimately oblige Microsoft, located in the US, to provide communications data that are stored on servers in Ireland. The CLOUD Act explicitly gives U.S. law enforcement authorities the possibility to compel providers (such as email service providers, certain cloud service providers and social media providers) to disclose communication data regardless of where the data in question are stored (on or outside U.S. territory).

The Act also adopts a procedure for addressing potential conflicts of laws, taking into account foreign (privacy) laws:

  •  It provides for a specific balancing mechanism in relation to orders to disclose content that potentially breach the laws of a qualifying foreign government (i.e. a country that has signed an executive agreement with the United States to facilitate cross-border law enforcement access to data (infra)). In those circumstances, the (potentially foreign) provider concerned may file a motion to have the order for disclosure modified or quashed if it reasonably believes that (i) the customer or subscriber is not a United States person or he or she does not reside in the United States and (ii) the required disclosure would create a material risk that laws of a qualifying foreign government would be violated. A court will decide whether the order should be modified or quashed while having a rather wide margin of appreciation (taking into account the investigative interests of the US, the foreign government’s interest in preventing disclosure, the location and nationality of the subscriber or customer in question, etc.). This balancing mechanism shall be the sole basis for moving to quash on the grounds of a conflict of law related to a qualifying government.
  • The CLOUD Act does not give clear guidelines, however, when service providers are confronted with disclosure orders that could potentially violate foreign legislation outside said hypotheses (such as orders potentially violating the laws of non-qualifying foreign governments). It even explicitly states that the introduction of the balancing mechanism does not affect existing standards in relation to compulsory procedures not covered by the said mechanism. Therefore, the CLOUD Act does not answer the currently pressing question about what standards do apply in those circumstances. As long as governments do not acquire the capacity of a “qualifying foreign government”, it thus seems that providers are still left in the dark as to how they should respond to U.S. requests that could potentially violate foreign (privacy) laws (such as orders to produce data on a foreign customer or subscriber).

Cross-border cooperation orders from foreign LEA

Secondly, the CLOUD Act allows foreign (non-U.S.) governments the possibility to enter into an executive agreement with the United States. Once such executive agreement is concluded, the foreign government becomes a qualifying foreign government (supra). The executive agreement would permit U.S. service providers to intercept or disclose communication content in response to an order coming from a government that is signatory of the said agreement. This is not the case, however, if the order targets a U.S. person or person located in the U.S.

In order to be eligible to enter into an executive agreement, the criminal justice system of the foreign government must meet a set of criteria aimed at ensuring robust protection of the right to privacy and other civil liberties, such as the freedom of speech. Furthermore, the Cloud Act spells out procedural requirements in relation to said cross-border cooperation orders. The order should relate to serious crime, indicate a specific identifier as the object of the order, comply with the domestic law of the country concerned, be reasonably justified, and subject to review by an independent authority.

The executive agreements will be based on the principle of reciprocity. The foreign governments will have to remove restrictions on communications service providers (including providers that are subject to U.S. jurisdiction) and thereby allow them to respond to valid cooperation orders coming from U.S. governmental entities. Furthermore, the local laws have to provide substantive and procedural opportunities to service providers which are similar to the balancing mechanism mentioned above.

Awaiting disclosure of EU legislative initiatives

In the meanwhile, the European Commission is, in turn, working on legislation concerning cross border e-evidence gathering from an EU law perspective. Release of the said initiative has been expected for a while and is now scheduled for mid-April. It remains to be seen whether the EU point of view will coincide with the U.S. perspective and whether and/or under what circumstances it will remain possible for individual EU Member States to enter into executive agreements with the United States further to the CLOUD Act. 

To be continued…

(CLOUD-Act: H.R.1625 – 115th Congress, https://www.congress.gov/115/bills/hr1625/BILLS-115hr1625enr.pdf, 866 et seq.)

Related news

11.04.2019 NL law
Double roles in attributing knowledge

Short Reads - The knowledge of a person who in fact runs a company can be attributed to the company if the sole director and shareholder is a 'straw man', the Supreme Court confirmed in a judgment of 29 March 2019. The rules by the Supreme Court are not revolutionary or even new. But circumstances essential for the attribution of knowledge are ignored. The double role played by the 'man in charge' raises questions about how to apply the rules as identified by the Supreme Court to the facts

Read more

04.04.2019 NL law
European Court of Justice: actio pauliana is covered by jurisdiction rule of forum of contract. A judgment with foreseeable consequences?

Short Reads - Imagine that a debtor voluntarily concludes a transaction with a third party where he knows (or should know) that it hinders the creditor's possibilities of collecting the debt. In civil law countries, a creditor can invoke the nullification of that legal act by means of a so-called actio pauliana. This raises the question of which court has jurisdiction in the case of an international dispute, regarding an actio pauliana, that is instituted by a creditor against a third party?

Read more

10.04.2019 NL law
Damage due to a defective driveway and the Dutch twenty year limitation period: When does limitation start in case of a continuous event that causes damage?

Short Reads - On 22 March 2019, the Dutch Supreme Court ruled (ECLI:NL:HR:2019:412) that the strict liability for buildings (opstalaansprakelijkheid) is not linked to a specific damaging act but to a damaging condition, as referred to in section 6:174 DCC. Therefore, there is no reason to regard a damaging act as an 'event that caused damage' as referred to in section 3:310 DCC concerning the limitation period for claims for damages.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring