Clarifying Lawful Overseas Use of Data Act

Clarifying Lawful Overseas Use of Data Act
U.S. Government · Public domain · source
Name	Clarifying Lawful Overseas Use of Data Act
Enacted	2018
Colloquialacronym	CLOUD Act
Enactedby	115th United States Congress
Effective	2018-03-23
Title	United States Code
Publiclaw	Public Law 115–141

Clarifying Lawful Overseas Use of Data Act is a 2018 United States statute that amended federal electronic communications law and addressed access to data stored abroad by service providers. It interacts with prior statutes, landmark court decisions, and executive branch policies while affecting relationships among technology companies, law enforcement agencies, foreign states, and international organizations. The Act has been central to debates involving privacy advocates, civil liberties organizations, multinational corporations, and national security institutions.

Background and Legislative History

The Act was drafted in the aftermath of the 2013 disclosures by Edward Snowden and subsequent litigation including United States v. Microsoft Corp. and earlier decisions under the Stored Communications Act and Electronic Communications Privacy Act of 1986. Legislative discussions involved members of the United States Senate, the United States House of Representatives, committees such as the Senate Judiciary Committee and the House Judiciary Committee, and input from executives at Microsoft, Apple Inc., Google LLC, Amazon.com, Inc., Facebook, Inc. and civil society groups including the American Civil Liberties Union, Electronic Frontier Foundation, and Human Rights Watch. The bill passed the 115th United States Congress and was signed into law amid concurrent executive actions by the Trump administration and ongoing litigation before the United States Supreme Court.

Key Provisions and Scope

The Act amends the Stored Communications Act to clarify the ability of executive branch actors to compel disclosure of electronic communications and associated data held by United States-based providers, regardless of whether the data are stored domestically or abroad. It authorizes the United States Attorney General and the United States Secretary of State to negotiate bilateral agreements with foreign governments for cross-border data requests and creates procedures for law enforcement subpoenas, warrants, and mutual legal assistance. The statute also creates criteria for assessing foreign governments’ human rights records and establishes safeguards including notice provisions and executive review that engage institutions like the United States Department of Justice and the United States Department of State.

Legal and Constitutional Issues

The Act raised questions touching on precedents such as Katz v. United States, Riley v. California, and Carpenter v. United States regarding expectations of privacy and the Fourth Amendment as interpreted by the United States Supreme Court. Courts have considered conflicts between domestic compulsory process and foreign privacy or secrecy laws exemplified by disputes involving Microsoft Corporation and other multinational providers. Constitutional challenges invoked separation of powers concerns involving congressional statutes, executive agreements, and judicial warrants, with litigants referencing doctrines from cases like Chevron U.S.A., Inc. v. Natural Resources Defense Council, Inc. and Youngstown Sheet & Tube Co. v. Sawyer.

International Implications and Cross-Border Data Access

The Act’s treaty-like agreements mechanism affected relations with partners such as the United Kingdom, Australia, Canada, Ireland, Germany, France, Japan, and members of international organizations including the Organization for Economic Co-operation and Development and the Council of Europe. It intersects with instruments like the Budapest Convention on Cybercrime and regimes under the European Union law framework, notably decisions of the Court of Justice of the European Union and the implications of Schrems II and the prior EU–US Privacy Shield debates. The bilateral executive agreements contemplate compatibility with foreign legal orders, creating tension with national data protection authorities such as the Federal Commissioner for Data Protection and Freedom of Information (Germany) and agencies like the European Data Protection Board.

Implementation, Compliance, and Enforcement

Implementation involves coordination among the Federal Bureau of Investigation, Department of Homeland Security, United States Postal Inspection Service, and private sector compliance teams at firms like Microsoft, Apple Inc., Google LLC, Amazon Web Services, and Dropbox, Inc.. Providers must navigate compulsory process, secrecy orders, and potential conflicts with foreign blocking statutes and criminal penalties. The Act prescribes executive branch review processes and judicial oversight avenues under American statutes, while enforcement actions can implicate multinational contracts, arbitration under rules such as those of the International Chamber of Commerce, and administrative orders from regulators like the Federal Trade Commission.

Criticism, Litigation, and Policy Debate

Criticism has come from legal scholars at institutions like Harvard Law School, Yale Law School, and Columbia Law School as well as advocacy organizations including the American Civil Liberties Union, Electronic Frontier Foundation, and Center for Democracy & Technology. Litigation and policy debates have focused on privacy harms, human rights risks in partner states such as United Arab Emirates and China, and potential conflicts with supranational adjudicators like the European Court of Human Rights. Academic articles in journals such as the Harvard Law Review and policy briefs from think tanks like the Brookings Institution, Center for Strategic and International Studies, and Carnegie Endowment for International Peace have analyzed tradeoffs between surveillance capabilities and transnational privacy protections. Ongoing challenges in courts and legislatures continue to shape amendments, executive agreements, and multinational corporate practices.

Category:United States federal statutes Category:Information privacy law Category:International law