In case you missed it – and unless you are a legal technology nerd like me, you probably did – the US Congress amended the Stored Communications Act (SCA) as part of the recently passed $1.3 trillion omnibus spending bill. In a provision buried deep in the spending package, Congress passed the Clarifying Lawful Overseas Use of Data (CLOUD Act). The CLOUD Act specifically addresses what information American-based companies will be required to turn over to foreign governments about their citizens who have data stored with them.

Only weeks earlier, the Supreme Court of the United States heard arguments on a case that will now be directly affected by the new law. The case (United States v. Microsoft Corp.) deals specifically with an issue asking if warrants issued under the old SCA could force Microsoft to hand over emails, stored in Ireland, to the US government. The justices even wondered openly during oral arguments if the question at hand was being discussed in the wrong government building. “Wouldn’t it be better if the case at hand was rectified by Congress instead,” they asked?

The measure, which received unanimous support from tech giants such as Google, Microsoft, Facebook, Apple and many more, is championed as “notable progress to protect consumers’ rights and would reduce conflicts of law”. On the other hand, civil rights and privacy advocates are wary of the CLOUD Act to say the least. It has been called “a law overstepping constitutional and administrative privacy protections and potentially enabling civil rights abuses by foreign governments” by its detractors.

For the purposes of this blog, we won’t spend time on “why” or “how” something that some find as important as our data privacy laws can get buried in a spending bill. Instead we will focus on the “what” it means for you, me and your clients.

Setting aside the speed with which this occurred (you have to admit, three weeks for an act of Congress is speedy even if it’s a coincidence), let’s focus on the meat of the changes.

• Previously, each request for data from a foreign government for a US based company was governed by agreements such as the Mutual Legal Assistance Treaties (MLATS) which requires 2/3 approval by the US Senate to be enacted.
• The CLOUD Act now allows for the executive branch to approve bilateral data transfer agreements on its own.
• Many civil rights experts are concerned with the extent to which foreign governments without strong data privacy and civil rights protections will now be able to gain access to the personal data of their citizens.
• There is a provision in the bill that the US only enter into such bilateral agreements with countries whose law “affords robust substantive and procedural protections for privacy and civil liberties”.
• The ACLU isn’t buying it – in fact, in a letter sent to congress, the ACLU wrote, “The human rights standards that countries must meet to be eligible for an agreement are vague, weak and unclear”.
• Under the recently enacted CLOUD Act, it falls solely to the discretion of the US Attorney General and the US Secretary of State to determine which countries meet the law’s civil rights and data privacy standards.
• Officials do have to provide written certification to Congress on new agreements with any country, but Congress has only 180 days to pass a joint resolution to block the agreement.
• Also, once in place, the agreements that fall under the CLOUD Act “shall not be subject to judicial or administrative review”.
• The CLOUD ACT not only would require US based companies to comply with foreign governments and their requests, it would also require foreign based companies that are located in a country, that is under a bilateral agreement with the US, to comply with our government’s requests as well.

There are strong thoughts and feelings on both sides of this issue. As with most laws that get enacted, it all depends on your point of view. From a litigation standpoint, this law will have an impact on proceedings for years to come. What type and to what extent is to be seen in the near future.

We welcome the opportunity to talk to you about your case and how we can help in the early stages of discovery. Contact Jeff to learn more.