News

Demystifying the U.S. CLOUD Act: Assessing the law's compatibility with international norms and the GDPR

15 January 2019

This paper discusses the impact of a new U.S. law – the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) – on non-U.S. businesses and individuals who use cloud storage solutions. The CLOUD Act amends the Stored Communications Act (SCA), which restricts the disclosure of stored electronic data to third parties, including the U.S. government.

This paper specifically focuses on Part 1 of the CLOUD Act, which clarifies that U.S. law enforcement agencies may, under certain circumstances, lawfully demand data stored in foreign countries from entities subject to U.S. jurisdiction. Some commentators have worried that Part 1 of the CLOUD Act will give the U.S. government new powers to surveil the data of any non-U.S. citizen or business that uses a cloud services provider with operations in the United States.