Over the last few days you may have seen a bunch of articles about the “CLOUD Act” — recently introduced U.S. bipartisan legislation that would overhaul key aspects of how foreign government requests for the data of foreign persons held on the servers of U.S. companies would be handled.
I’m being frequently asked for my position on this, and frankly the analysis has not been a simple one.
Opponents, including EFF, the ACLU, and a variety of other privacy and civil right groups, are opposing the legislation, arguing that it eases access to such data by foreign governments and represents a dangerous erosion of privacy rights.
Proponents, including Apple, Facebook, Google, Microsoft, and Oath (Yahoo/Verizon) argue that the CLOUD Act provides much needed clarity to the technically and legally confused mess regarding transborder data requests, and introduces new privacy and transparency protections of its own.
One thing is for sure — the current situation IS a mess and completely unsustainable going forward, with ever escalating complicated legal entanglements (e.g. the ongoing Microsoft Ireland case, with a pending Supreme Court decision likely to go against Microsoft’s attempts at promoting transborder privacy) and ever more related headaches in the future.
Cutting to the chase, I view the CLOUD Act as flawed and imperfect, but still on balance a useful effort at this time to move the ball forward in an exceedingly volatile global environment.
This is particularly true given my concerns about foreign governments’ increasing demands for “data localization” — where their citizens’ data would be stored under conditions that would frequently be subject to far fewer privacy protections than would be available under either current U.S. law or the clarified provisions of the CLOUD Act. In the absence of the CLOUD Act, such demands are certain to rapidly accelerate.
One of the more salient discussions of the CLOUD Act that I’ve seen lately is: “Why the CLOUD Act is Good for Privacy and Human Rights” (https://www.lawfareblog.com/why-cloud-act-good-privacy-and-human-rights). Regardless of how you feel about these issues, the article is well worth reading.
Let’s face it — nothing about the Net is simple.
–Lauren–