 the owner of the e-mails being sought was a U.S. citizen or resident. He agreed with the government that the term “warrant” only implied the need for issuance under Fourth Amendment standards, rather than suggesting it was a search warrant with a specific place. He also noted that Microsoft chose to store the e-mails in Ireland based on the account holder’s unverified statement of residence and on Microsoft’s business interest in minimizing network latency. No one disputed that if Microsoft had chosen to store the emails in the U.S., the warrant would have been valid.
dissetnL “has substantially burdened the government’s legitimate law enforcement efforts; created a roadmap for the facilitation of criminal activity; and impeded programs to protect the national security of the United States and its allies”, and called on a higher court or the U.S. Congress to rectify the outdated language of the SCA.15
In February 2017, federal magistrate judge, presiding over a District Court within the Third Circuit, ruled that Google must comply with a government warrant to turn over data from foreign servers. The magistrate judge rejected Google’s reliance on the current standing from the Microsoft case, and stated in his opinion that the scope of the invasion of privacy for the case was entirely within the United States, and not where the electronic transfer of the data occurs, making the SCA warrant enforceable.716
Rivals Apple and Amazon as well as privacy advocates and academics supported Microsoft. The government received backing from the majority of U.S. states (though not Microsoft’s home state of Washington or tech-heavy California). Already, Google and Verizon Communications Inc.’s Yahoo have stopped complying with at least some search warrants for emails and other user data stored outside the country, the Justice Department said.
Rights that he CLOUD Act ensured
The Act retained the common law right for cloud service providers to go to court to challenge search warrants when there is a conflict of laws, independent of any international treaties on extraterritorial reach for US warrants (provided under action 103(c) of the Act).
This comity right is especially important in light of the Europe General Data Protection Regulation (GDPR) which was implemented in 25 May 2018. If there is a conflict of laws regarding the reach of the US search warrants according to GDPR’s relevant provisions, cloud serveice providers such as Microsoft is under the common law given the right to launch a comity analysis, which better protects EUorpean customers.
What the CLOUD Act creates
The CLOUD Act is an important milestone in the journey to modernise the law. It has the important implication of not only preserving rights but it also creates a foundation for a new generation of international agreements to find the fundamental balance between data protection and efficiency of state prosecution involving multiple jurisdictions.
The Act provides the framework and statute authority for US to cooperate with other countries for purposes of crime investigation and law enforcement. These agreements can provide similar but more concrete guidance with respect to the Cyberspace than existing Mutual Legal Assistance Treaties.
The litigation and the passage of the Act also incentivises other government to review their digital privacy law and surveillance requests. In Europe last week, the European Commission presented its proposed e-Evidence legislation to the European Parliament. Many other governments are similarly seeking to update their laws to protect privacy, promote digital security and address the challenge of an increasingly borderless world.
Fifth, the CLOUD Act gives cloud service providers added and direct legal rights to protect privacy under these international agreements. These rights come in two complementary forms. The first gives providers the right to inform foreign governments that have these agreements when their citizens are impacted by U.S. warrants. And second, providers can go directly to court to raise comity concerns under a new st