The US CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US federal law passed in 2018 that enables US law enforcement agencies to access data managed by service providers under US jurisdiction \u2013 regardless of the country in which that data is stored. The US CLOUD Act amends the Stored Communications Act and conflicts with Article 48 of the GDPR.<\/p>\n
The US CLOUD Act is a law that clarifies the geographical scope of existing US investigative powers. It was passed on 23 March 2018 as part of a budget bill and amended the Stored Communications Act, which has governed access to stored communications data since 1986. At the heart of the new legislation is the provision 18 U.S.C. \u00a7 2713: providers of communications and data processing services must hand over data that is in their possession, custody or under their control \u2013 even if that data is located outside the US.<\/p>\n
It is important to understand what the US CLOUD Act is not. It does not create any new powers of access, nor does it grant authorities direct access to systems. What a US investigator may request continues to be governed by existing procedural law: for the content of communications, a court order based on reasonable suspicion is generally required, whilst lower-threshold instruments suffice for traffic and metadata. The US CLOUD Act addresses solely the question of whether the location of the data abroad precludes such access \u2013 and answers it in the negative.<\/p>\n
The second part of the Act, which is less well known in Europe, concerns the reverse direction. The US CLOUD Act establishes, in 18 U.S.C. \u00a7 2523, the basis for bilateral agreements under which qualified third countries can request data directly from US providers without having to go through the lengthy process of mutual legal assistance. The US CLOUD Act is thus not only an access tool but also a cooperation tool.<\/p>\n
The US CLOUD Act was enacted because the legal situation regarding the scope of US orders relating to data stored abroad was unclear. The catalyst was a case that became known as the Microsoft-Ireland case: US investigators requested the contents of emails that Microsoft was storing in a data centre in Ireland. In 2016, a US federal court of appeal ruled that the Stored Communications Act had no extraterritorial effect.<\/p>\n
The case was before the US Supreme Court when the legislature intervened. Once the US CLOUD Act came into force, the subject of the dispute had ceased to exist, and the case was declared closed. The legislative intent was explicitly to ensure that investigations would not be thwarted by where a provider technically stores data \u2013 from the US government\u2019s perspective, a question of practicability in a cloud architecture where storage locations are dynamic and not identifiable to investigators.<\/p>\n
From a European perspective, the US CLOUD Act thus shifted the focus of the debate: it was no longer the server location, but rather jurisdiction over the company that became the decisive criterion. This shift continues to shape the discussion on cloud sovereignty to this day.<\/p>\n
The US CLOUD Act applies to providers of electronic communications services and data processing services that are subject to US jurisdiction. The decisive factor is not the customer\u2019s nationality or the location of the data, but whether a provider is subject to the jurisdiction of US courts and whether it has control over the requested data.<\/p>\n
The term \u2018possession, custody or control\u2019 is the key factor in this regard. Control may exist even if the data is formally held by a European subsidiary, provided that the parent company has legal or de facto access to it. The following are therefore typically affected:<\/p>\n
This last point is regularly overlooked in procurement procedures. A European software provider may itself be outside US jurisdiction and yet still operate data in an environment controlled by a US provider. The entire chain is therefore relevant to the assessment, not just the contractual partner.<\/p>\n
Under the US CLOUD Act, US authorities may request the content of communications, as well as metadata and traffic data, controlled by a service provider. The scope depends on the type of data: the content of messages, files and stored communications generally requires a court order, whilst information on customer accounts, login times, IP addresses and communication connections can be obtained subject to less stringent requirements.<\/p>\n
Of practical significance is the possibility of linking the disclosure to a confidentiality obligation. Under 18 U.S.C. \u00a7 2705(b), a court may prohibit the service provider from informing the data subject. This creates a structural blind spot for European data controllers: they cannot assume that they will be informed of any access to their data. The transparency reports published by major service providers only reflect aggregated figures and do not provide any information about individual customer relationships.<\/p>\n
It should also be noted that providers can only disclose what they actually have access to. If data is available exclusively in encrypted form and the provider does not possess the keys, it can only supply the ciphertext and the available metadata. This technical limitation is the most effective safeguard \u2013 and the reason why key sovereignty is increasingly being explicitly required in tenders.<\/p>\n
Executive Agreements are bilateral agreements between the US and eligible third countries that allow direct access to data held by service providers in the other country. The legal basis is 18 U.S.C. \u00a7 2523. A prerequisite is a determination by the US Government that the partner country adheres to sufficient standards of the rule of law and data protection.<\/p>\n
The US concluded the first agreement of this kind with the United Kingdom; it came into force in October 2022. The US signed a further agreement with Australia. Negotiations between the US and the European Union on a similar agreement have been ongoing since 2019 but have not yet been concluded; the current status should be checked before making any binding statements.<\/p>\n
The existence of an agreement has a little-known side effect. The US CLOUD Act, in 18 U.S.C. \u00a7 2703(h), allows service providers to challenge a production order if the data subject is not a US person and the production would violate the law of a partner state. However, this legal remedy applies only to states with an Executive Agreement. It does not yet exist for EU Member States \u2013 providers there can only invoke general considerations of international law, the prospects of success of which are considerably more uncertain.<\/p>\n
The US CLOUD Act is in direct conflict with Article 48 of the GDPR. This provision stipulates that judgements by courts in third countries and decisions by third-country authorities requiring the disclosure of personal data are only recognised or enforceable if they are based on an international agreement in force, such as a mutual legal assistance treaty \u2013 without prejudice to other grounds for transfer set out in Chapter V.<\/p>\n
The European Data Protection Board and the European Data Protection Supervisor assessed this conflict in a joint opinion addressed to the LIBE Committee of the European Parliament in July 2019. The key finding was that, in the absence of an international agreement, a US production order alone does not constitute a valid basis for a transfer. Nor does a legal obligation under Article 6(1)(c) of the GDPR provide a solution, as this refers to Union law or the law of a Member State, not to the law of a third country. Exceptions under Article 49 of the GDPR are narrowly defined and are not suitable for regular transfers.<\/p>\n
This gives rise to a genuine conflict of obligations: The service provider may find itself caught between a US order and European data protection law, without being able to fulfil both requirements. However, the European controller using the service remains responsible under supervisory law. For GDPR compliance<\/a>, it is therefore not sufficient to attribute the risk to the service provider \u2013 the assessment of the transfer risk, usually in the form of a Transfer Impact Assessment, forms part of the controller\u2019s documentation obligations.<\/p>\n The US CLOUD Act differs from FISA Section 702 in terms of its purpose, procedures and intended recipients: the US CLOUD Act relates to criminal investigations on a case-by-case basis with judicial oversight, whilst FISA Section 702 relates to intelligence surveillance for the purposes of foreign intelligence gathering. The two sets of regulations are frequently conflated in German-language discussions, which leads to incorrect conclusions.<\/p>\nHow does the US CLOUD Act differ from FISA Section 702 and Schrems II?<\/h2>\n