Arnold & Porter Discusses How CLOUD Act Revamps Government Access To Data

The massive 2,232-page, $1.3 trillion spending bill signed into law on March 23 by President Trump does more than just fund the government. The bill also contains a provision that will have a significant impact on data privacy.  Tacked on the end of the spending bill is the Clarifying Lawful Overseas Use of Data (CLOUD) Act, which revamps the decades-old regime governing how law enforcement can access data stored abroad by service providers. Under the CLOUD Act, US officials can compel service providers to provide data regardless of where that data is stored.

First, a bit of background. The Stored Communications Act (SCA), passed as part of the Electronic Communications Privacy Act of 1986 (ECPA), permits the government to compel a service provider to produce its customer and user data by means of a court order.¹ The problem is that the SCA does not specify whether such a court order applies to data stored abroad. As a result, some companies, notably Microsoft, have