🇺🇸Clarifying Lawful Overseas Use of Data Act (CLOUD Act)

← Back to laws in United States

The CLOUD Act governs cross-border access to electronic evidence

The Clarifying Lawful Overseas Use of Data Act, commonly called the CLOUD Act, is a United States law about government access to electronic communications and related records. Congress enacted it on 23 March 2018 as Division V of the Consolidated Appropriations Act, 2018. It amended the Stored Communications Act and related provisions of Title 18 of the United States Code.

The CLOUD Act is not a general consumer privacy law and does not create a general right for private organisations to obtain data. Its direct operational significance is greatest for providers of electronic communication services and remote computing services that receive valid legal process. It also matters to organisations that use such providers because data placed with a service provider may be within that provider's possession, custody or control even when stored outside the United States.

Location alone does not determine whether data must be produced

The Act added 18 U.S.C. section 2713. A covered provider must comply with the Stored Communications Act's obligations to preserve, back up or disclose communications and customer or subscriber records within its possession, custody or control, regardless of whether the information is located inside or outside the United States.

This is a control-based rule, not a rule that every item stored abroad is automatically available to the United States Government. The requesting authority must still use legal process authorised by the Stored Communications Act. The CLOUD Act principally resolves the separate question of whether foreign storage, by itself, places responsive data beyond the provider's production obligation.

The statutory motion to modify or quash is narrow and time-sensitive

A provider served with process seeking the contents of wire or electronic communications may use the special procedure in section 2703(h) where it reasonably believes both that the customer or subscriber is not a United States person and does not reside in the United States, and that disclosure would create a material risk of violating the laws of a qualifying foreign government. The provider ordinarily must file the motion within 14 days after service unless the government agrees to an extension or the court permits one on an application made within that period.

The court may modify or quash only if the statutory findings are met. These include an actual conflict with the qualifying foreign government's law, the interests of justice under the prescribed comity factors, and the customer's or subscriber's non-U.S. status and residence. Relevant factors include the interests of both governments, possible penalties, the person's location and nationality, the provider's U.S. ties, the importance of the information, and whether timely access is available through a less harmful route.

While that challenge is pending, the provider must preserve the requested information but ordinarily need not produce it, unless the court finds immediate production necessary to prevent an adverse result identified in 18 U.S.C. section 2705(a)(2).

Executive agreements create a separate route for qualifying foreign orders

The Act added 18 U.S.C. section 2523, allowing the United States to enter into executive agreements governing access to electronic data by foreign governments. The Attorney General, with the concurrence of the Secretary of State, must certify that the foreign government's law and practices provide the required protections for privacy, civil liberties, accountability and the rule of law. Congress receives notice and may use the statutory disapproval procedure before an agreement enters into force.

Orders covered by an agreement must satisfy detailed conditions. Among other things, they must concern serious crime, identify a specific person, account, address, device or other identifier, rest on articulable and credible facts, comply with the issuing country's law, and be subject to independent review or oversight. They may not intentionally target a United States person or a person in the United States, may not be used to infringe freedom of speech, and must be governed by minimisation, security and dissemination safeguards.

The terms of an agreement may not create an obligation that providers be capable of decrypting data, and may not prevent providers from decrypting data. This provision does not itself require an encryption backdoor or dictate a provider's encryption design.

What covered providers should operationalise

A provider should be able to identify and authenticate incoming legal process, preserve responsive information without altering it, determine what information is within its possession, custody or control, and route the matter immediately to trained legal personnel. The workflow should separately identify domestic U.S. process, a foreign order relying on a CLOUD Act executive agreement, and other international cooperation mechanisms.

The provider should record service time, scope, issuing authority, affected account, data locations, customer-status facts relevant to section 2703(h), possible foreign-law conflicts, challenge deadlines, preservation actions, production decisions and the legal basis for any disclosure. Access to preserved and produced material should be limited to authorised personnel, with an auditable chain of custody.

What customers of cloud and communications providers should assess

Using a non-U.S. data centre does not necessarily remove information from the reach of U.S. legal process when a covered provider has possession, custody or control of it. During vendor and transfer reviews, customers should therefore identify the provider entity, relevant jurisdictions, storage and support locations, access architecture, subprocessors, government-request policy, notification commitments and transparency reporting.

Contractual notification clauses remain subject to applicable law, court orders and nondisclosure restrictions. A contract cannot guarantee advance notice in every case. Organisations should avoid promising customers or regulators that data localisation, encryption or a particular contract clause completely prevents lawful government access.