The New US Cloud Act-History, Rules, and Effects

Abstract

According to foreign governments, US tech companies, and (at least before the CLOUD Act was passed) the Second Circuit Court of Appeals, US companies should be permitted to oppose requests by the US government to produce data residing outside the United States if such disclosure would violate the law of the country (or countries) where the data is stored. What appears to be very clear, however, is that unless the Attorney General certifies Ireland (or any country) as a "qualifying foreign government," the CLOUD Act itself gives ECS and RCS providers no new basis to oppose such a warrant. [...]the DOJ enters into executive agreements elevating certain nations to the status of a qualifying foreign government, any effort by such a provider to oppose production of data located abroad would have to be based on something else, as permitted by a "saving" clause in the CLOUD Act: RULE OF CONSTRUCTION.-Nothing in this section, or an amendment made by this section, shall be construed to modify or otherwise affect the common law standards governing the availability or application of comity analysis to other types of compulsory process or to instances of compulsory process issued under section 2703 of title 18, United States Code, as amended by this section, and not covered under subsection (h)(2) of such section.47 So . . . could a US cloud provider still fight a warrant based on pre-CLOUD Act law? Section 103 of the CLOUD Act refers to a violation of "the laws of a qualifying foreign government." [...]it would seem that a provider may move to quash if compliance would violate the laws of one or more qualifying foreign governments in which the data customer resides, or of which the data customer is a national, or where the requested data are stored. Cir 1984) (upholding the district court's civil contempt order against the Bank of Nova Scotia for repeated failures to comply with a grand jury subpoena for documents held by a subsidiary in the Cayman Islands). [...]even if personnel in the United States do not directly have access to the requested data, a BNS subpoena may be issued to compel a US-based subsidiary or affiliate to obtain information located outside the United States.73 In short, the "possession, custody, or control" standard set forth in the CLOUD Act is nothing new.