In March 2018, a new law was passed with far-reaching implications for both companies and consumers. The law, called the Clarifying Overseas Use of Data Act (CLOUD), changed the approaches U.S. law enforcement can take to access data stored in other countries.
What is the CLOUD Act?
The CLOUD Act was attached to the Consolidated Appropriations Act, 2018 (also known as the "Omnibus" spending bill) as an add-on rather than a measure Congress voted on as a standalone. Due to Congress passing the $1.3 trillion bill, everything contained in it came into immediate effect.
Historically, the legal process has had a hard time keeping up with the speed of tech. The passage of this act attempts to address this imbalance, essentially updating the Electronic Communications Privacy Act (ECPA) of 1986. It also bypasses the Mutual Legal Treaty Assistance Act (MLAT), a law considered by many to be a cumbersome process.
User data is rarely stored in the vicinity of where it was created because storing data locally allows businesses to employ cost-effective strategies, improved services
How the CLOUD Act impacts business
The CLOUD Act gives any government, U.S. or foreign, the legal right to access data stored by companies without their user's knowledge or permission. Businesses are faced with a conundrum because the CLOUD Act potentially takes away their control over user privacies.
The Executivebranch has the legalright to enter into executive agreements with foreign nations, without the need for Congressional approval, allowing agreement nations the ability to access user data in either country.
- Tech companies must turn over data to the government regardless of what country the servers are located as CLOUD eradicates the ability for companies to shield data located in other countries.
- Through reciprocal agreements, foreign governments can potentially access the data of U.S. citizens stored in the U.S.
- CLOUD eliminates the need for a warrant and the person(s) being targeted by either the U.S. or a foreign government would be unaware their data was given to the requesting agency. This includes email, social media or any other electronic communications or transmissions.
With the passage of the CLOUD Act, companies need to quickly get up to speed to understand how the law affects them and their customers, along with the steps they need to take to ensure compliance and determine how to provide users with transparency.
Important factors for companies to know
While a long-reaching regulation, there are some restrictions in place. For instance, any executive agreements to access data must relate to terrorism or serious crimes and be based on "reasonable justification" that is "based on articulable and credible facts".
- Providers are allowed to file motions to nullify or modify a request within 14 days of being served if it meets certain specifications.
- Companies can still challenge search warrants.
- Businesses can attempt to deny requests if the order violates the laws of the country where data is stored.
The advancement of technology has created many difficult situations for businesses as they work to comply with existing laws. Employees must be aware of new laws being added to accommodate technological progress. While controversial, many believe the CLOUD Act provides companies with more consistency than older legislative regulations do.
Embrace the Change
While this new CLOUD Act may have you up in arms, it's important to have the right people in place to make it a successful change within the company. ICS can help you fill any gaps you might have in talent and bring you to a place where you can handle whatever comes your way. Click below to get started.