 | This articleneeds additional citations forverification. Please helpimprove this article byadding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "CLOUD Act" – news ·newspapers ·books ·scholar ·JSTOR(May 2025) (Learn how and when to remove this message) |
.svg) | |
| Acronyms(colloquial) | CLOUD Act |
|---|---|
| Enacted by | the115th United States Congress |
| Effective | March 23, 2018 |
| Citations | |
| Public law | Pub. L. 115–141 (text)(PDF), Division V |
| Codification | |
| Acts amended | Stored Communications Act,Electronic Communications Privacy Act |
| Titles amended | 18 |
| U.S.C. sections amended | 2523 |
| Legislative history | |
| |
TheClarifying Lawful Overseas Use of Data Act orCLOUD Act (H.R. 4943) is a United Statesfederal law enacted in 2018 by the passing of theConsolidated Appropriations Act, 2018, PL 115–141, Division V.
The CLOUD Act primarily amends theStored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil.[1]
The CLOUD Act was introduced following difficulties that theFederal Bureau of Investigation (FBI) had with obtaining remote data through service providers through SCA warrants, as the SCA was written before cloud computing was a viable technology.[2] The situation was highlighted from a 2013 drug trafficking investigation, during which the FBI issued an SCA warrant for emails that a U.S. citizen had stored on one ofMicrosoft's remote servers in Ireland, which Microsoft refused to provide.
This legal challenge led to theSupreme Court inMicrosoft Corp. v. United States. The FBI contended that Microsoft had full control of the data and should be compelled to turn it over in response to the warrant, but Microsoft argued that the SCA did not cover data stored outside the United States.[3] The challenge recognized that while the FBI could request amutual legal assistance treaty (MLAT) to aid in data discovery during cross-border law enforcement, the process to acquire a new MLAT if one is not in place, or to process a request through an existing MLAT, can be slow and impede law enforcement efforts.[4]
Congress, primarily led by SenatorOrrin Hatch, had attempted to create legislation prior to the CLOUD Act to amend the SCA with the concerns of Microsoft and other technology companies with respect to foreign privacy rights. The Law Enforcement Access to Data Stored Abroad Act (LEADS Act) in 2015[5] and the International Communications Privacy Act (ICPA) in 2017 were both previous bills intended to amend the SCA but which failed to gain passage.[6][7]
The CLOUD Act asserts that U.S. data and communication companies must provide stored data for a customer or subscriber on any server they own and operate when requested by warrant, but provides mechanisms for the companies or the courts to reject or challenge these if they believe the request violates the privacy rights of the foreign country the data is stored in.
It also provides an alternative and expedited route to MLATs through "executive agreements"; theexecutive branch is given the ability to enter into bi-lateral agreements with foreign countries to provide requested data related to its citizens in a streamlined manner, as long as theAttorney General, with concurrence of theSecretary of State, agree that the foreign country has sufficient protections in place to restrict access to data related to United States citizens.[8][9] The first such agreement was with the United Kingdom.[10] There is a FAQ appended to thewhite paper published by the U.S. Department of Justice.[11]
The CLOUD Act received support from Department of Justice and of major technology companies likeMicrosoft,AWS,Apple, andGoogle.[12][13] The bill was criticized by several civil rights groups, including theElectronic Frontier Foundation, theAmerican Civil Liberties Union,Amnesty International, andHuman Rights Watch. These groups argued that the bill stripped awayFourth Amendment rights against unreasonable searches and seizures, since the government could enter into data rights sharing agreements with foreign countries and bypass U.S. courts, and affected users would not have to be notified when such warrants were issued.[13][14] Some of these groups feared the government would not fully review requests from foreign countries for their citizens' stored on servers in the U.S., potentially allowing such data to be used in bad faith in those countries.[15]
After being introduced in the115th United States Congress as H.R.4943, the act was included as a section of theConsolidated Appropriations Act, 2018 (H.R. 1625), anomnibus spending bill, which passed both houses of Congress and was signed into law, P.L. 115–141, on March 23, 2018.[16]
On April 17, 2018, the Supreme Court, based on concurring briefs submitted by the Department of Justice, vacated theMicrosoft Corp. v. United States and remanded it back to lower court to do the same, as the Department of Justice was able to secure a new warrant under the CLOUD Act and was no longer pursuing the initial warrant, rendering the casemoot.[17][18][19]
TheEuropean Data Protection Supervisor (EDPS) viewed the CLOUD Act as a law in possible conflict with theGDPR.[20][10][21] TheGerman Commissioner for Data Protection has warned against the use of US basedAmazon Web Services for storing sensitive data for theFederal Police.[22]
The law has been viewed as a parallel to China'sNational Intelligence Law.[23][24]
Following the CLOUD Act's passage, numerous countries have enacted measures to keep data within their borders.[25]