Responding to a request by the European Parliament's
Committee on Civil Liberties, Justice and Home Affairs (LIBE), the
EU's data protection supervisory bodies released an initial
joint opinion on the impact of the U.S. Clarifying Lawful Overseas
Use of Data Act ("CLOUD Act") on the EU data protection
framework.
The preliminary assessment by the European Data Protection
Supervisor ("EDPS") and European Data Protection Board
("EDPB") leaves service providers facing a familiar
dilemma.
Although the CLOUD Act now makes clear that U.S. disclosure
orders have an extraterritorial reach, the EDPS and EDPB see very
limited options for service providers to comply with such orders
without breaching the EU's General Data Protection Regulation
("GDPR").
