In September 2018, Microsoft published six recommendations on its website for dealing with secret requests from US intelligence and law enforcement agencies for customer data from cloud providers. Today, these secret requests are made without a judicial search warrant or even a formal investigation by the respective intelligence agency. It goes without saying that the cloud provider is not allowed to disclose the secret data requests to the person affected by the request. If they do, they face draconian penalties from the Department of Justice (DoJ).

Microsoft's 6 principles on the CLOUD Act

The Clarifying Lawful Overseas Use of Data Act (CLOUD Act) was approved and ratified by the US Congress on March 26, 2018, after the Department of Justice (DoJ) lost patience with Microsoft in Ireland. At the time, the DoJ wanted Microsoft to hand over data of a US citizen on Microsoft's cloud servers in Ireland to the DoJ. Microsoft refused to do so, citing the local data protection laws of Ireland and the EU. The DoJ then sued Microsoft in the USA and wanted to force Microsoft to hand over the data with the help of the court. The proceedings dragged on because the judges could not easily derive the DoJ's demand from the law. So the DoJ simply addressed Congress with the bill for the CLOUD Act mentioned above. At the time, the EFF (Electronic Frontier Foundation) supported Microsoft's push against the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) and called on other corporate giants such as Amazon and Google to follow suit. However, the efforts of Microsoft and the EFF were unsuccessful. Microsoft ultimately had to comply with the new law and hand over the data. 

The law states that US cloud providers such as Microsoft Azure, Amazon Web Services, Gmail or Hotmail must hand over data to the US authorities on request - even if this violates local data protection laws. Providers such as Dilligent, Brainloop or E-Shares are not affected by this. The obligation to hand over data applies regardless of where the provider's servers are located and does not require a search warrant or court proceedings. The so-called CLOUD Act thus overrides national data protection laws for US providers and forces them to break them under threat of penalties.

Conclusion

The CLOUD Act does not provide any legal basis for whether and how users must be informed about access to their data, let alone whether this access is lawful at all. There are also no independent authorities or third-party bodies that could review or restrict access to data.

In his thesis paper, Brad Smith clearly shows that with the CLOUD Act, the US government has given the surveillance authorities a powerful and at the same time supranationally unlawful tool for unhindered access to data. Despite the six principles proposed by Microsoft, the current legal situation raises questions as to how different national legal systems will deal with these regulations. There has been no public discussion on this so far.

Microsoft has called on other major cloud providers such as Google and Facebook to join the theses and exert joint pressure on the US government. However, this call has so far gone unanswered. It seems that these companies have given up on the prospect of change and have instead chosen the strategy of concealing the issue from customers in order to avoid critical questions. Although Microsoft deserves credit for raising the issue, the sobering reality remains: Data stored with US cloud providers cannot be protected from access by the 17 US intelligence agencies in the long term.

Under the guise of law enforcement, far more data is presumably accessed and stored than is actually necessary or legally justified. The fundamentally different understanding of data protection in the USA is also underlined by the Patriot Act. This law also allows US authorities to access all data of US citizens and companies without the need for a court order.

While such practices are now accepted in the US, the same approach is widely rejected in Europe. The GDPR obliges European companies to guarantee the data protection of their customers, which makes the use of US cloud services virtually impossible for many data categories.

We at Loomion are keeping a close eye on developments surrounding the CLOUD Act and will continue to report. With the imminent introduction of the European «eVidence» law in response to the CLOUD Act, it will be exciting to see how this draft will actually strengthen data protection within the framework of the GDPR.