WASHINGTON – Today, U.S. Senators Orrin Hatch (R-UT) and Chris Coons (D-DE) applauded the inclusion of their legislation, the Clarifying Lawful Overseas Use of Data (CLOUD) Act, in the 2018 federal funding bill poised to become law over the next few days.  The CLOUD Act will help put the United States and other countries on a path towards resolving the problem of cross-border data requests by law enforcement in the age of email and cloud computing.

“For over four years now I’ve been working to update our privacy laws to account for revolutions in the way we store and access email and other data in the cloud,” Senator Hatch said. “My efforts began with the Law Enforcement Access to Data Stored Abroad (LEADS) Act, continued with the International Communications Privacy Act (ICPA), and culminated with this year's Clarifying Lawful Overseas Use of Data (CLOUD) Act, which will be enacted into law as part of the omnibus spending package. The CLOUD Act will create a clear, balanced framework for law enforcement to access data stored in other countries while at the same time encouraging our allies to strengthen their domestic privacy laws. I’m grateful to Senators Coons, Graham, and Whitehouse for their tireless efforts on this legislation and to Senator McConnell and Speaker Ryan for supporting its inclusion in the omnibus.”

"In a globalized world, we need clear rules governing access to data stored abroad,"said Senator Coons. "Our legislation is supported by law enforcement and the tech community, and I’m excited that it’s been included in the 2018 federal funding bill.  This legislation will go a long way toward protecting data across borders and encouraging fair treatment by our international partners. I’m grateful to have worked with Senators Hatch, Graham, and Whitehouse on this important issue." 

Existing law, both in the United States and around the world, has failed to keep pace with the evolution of internet-based communications technology, often referred to as cloud computing. U.S. and foreign law enforcement investigating crimes increasingly rely on the assertion of extraterritorial authority to seek data stored outside their borders—data that is often essential to preventing and solving crime. Technology companies, in turn, are caught between a rock and a hard place: confronting obligations to disclose data in one country while simultaneously facing laws in other countries that prohibit disclosure. 

The CLOUD Act will encourage governments to develop a clear framework for technology companies to comply with investigative demands. The legislation incentivizes countries to remove conflicts of law and raise privacy standards.

Clarifying Lawful Overseas Use of Data (CLOUD) Act of 2018 Pillars: 

·          Bilateral Agreements: The CLOUD Act enables the United States to enter into formal agreements with other nations to set clear standards for cross-border investigative requests for digital evidence. The CLOUD Act further identifies a series of statutory requirements that these agreements must satisfy, including privacy and security protections. 

·         Extraterritoriality of US Warrants and International Comity: The CLOUD Act amends US law to make clear that US warrants and other legal process issued for data held by communications providers reach data stored anywhere in the world. The reach of US warrants and legal process, however, would be limited by international comity. The CLOUD Act would give providers, for the first time, a statutory right to challenge legal process based on international comity concerns.

·          Transparency: When a communications provider receives a request from US law enforcement related to a national or resident of a country that has entered into a bilateral agreement with the United States, the provider will be permitted to notify that government of the existence of the request. This will allow the foreign government to assess compliance with the terms of the bilateral agreement and enable it to intervene diplomatically if it believes the request is inappropriate.

·         Reciprocity: The CLOUD Act would also require participating countries to remove legal restrictions that prevent compliance with data requests from US law enforcement. To qualify for the statutory benefits of the legislation (removal of the US blocking statute, a right for providers to object based on international comity and a right for providers to notify the government of the existence of requests), a foreign government must provide reciprocal rights and benefits to US law enforcement and communications providers.