How compatible is the US ‘CLOUD Act’ with cloud computing? A brief analysis

... The efforts of law enforcement authorities to lawfully access data stored on foreign servers are hindered by, among other things, two major problems. First, many countries have privacy laws that prohibit service providers from disclosing user data to foreign governments. Secondly, the Mutual Legal Assistance Treaty (MLAT) system has failed to keep up with the pace of today’s technology. The CLOUD Act is a response to these challenges. As its name indicates, the CLOUD Act seeks to clarify the extent to which the USA and foreign governments can access user data held by US-based communications-service providers, in the course of a criminal investigation. It seeks to meet four main objectives: (i) to enable US authorities to get timely access to data stored outside the USA; (ii) to enable foreign governments to get expedited access to content data stored in the USA; (iii) to avoid potential conflicting legal obligations; and (iv) to provide substantive and procedural safeguards.1 This article analyses the CLOUD Act against these objectives. By so doing, this article attempts to answer how the Act is compatible with cloud computing. It submits that even though the newly introduced regime makes it easier for law enforcement agencies to access foreign-held data, the adequacy and clarity of the privacy protections it affords are questionable, especially when compared to those provided by the MLAT system. This article also points out some business and technological realities of cloud computing that could be potential challenges to the effectiveness of the Act. The article closes with some highlights on the global implications of the CLOUD Act by comparing it with impending pieces of legislation in Europe.