Privacy and Criminal investigations – a potential judicial warzone between EU and US

The EU has been negotiating with the US to address concerns about the US CLOUD Act that was enacted in 2018 to reach a mutually acceptable agreement. In this process the European Court of Justice has played a crucial role in shaping the EU’s position on data protection and cross-border data transfers. The EU’s approach emphasizes the importance of data protection as a fundamental right and the need for international cooperation on law enforcement matters. Overall, the EU seeks a solution that balances law enforcement needs with privacy, data protection and respects EU sovereignty.

Introduction

The Clarifying Lawful Overseas Use of Data Act, commonly known as the US CLOUD Act, was enacted in the United States in 2018. This legislation has significant implications for data protection and privacy in the European Union (EU), particularly in relation to the General Data Protection Regulation (GDPR). This report explores the impact of the US CLOUD Act on the EU, focusing on data protection, legal conflicts, and potential solutions.

Overview of the US CLOUD Act

The CLOUD Act allows U.S. law enforcement to compel U.S.-based technology companies to provide data stored on servers, regardless of their location. This means that companies like Microsoft, Amazon, Google, and Apple must comply with U.S. law enforcement requests for data, even if that data is stored on servers in other countries.The legislation was introduced to address difficulties the FBI faced in obtaining remote data through service providers under the Stored Communications Act (SCA), which predated cloud computing technology. The US CLOUD Act has been praised for streamlining the process of obtaining data for criminal investigations, particularly in cases involving terrorism or cybercrime. The law also creates a framework for establishing bilateral agreements with other countries to facilitate cross-border data sharing. The US government has entered into US CLOUD Act agreements with several countries, including the United Kingdom and Australia.

Impact on Data Protection in the EU

The US CLOUD Act has raised significant concerns about data protection and privacy in the EU. Since, the legislation allows U.S. authorities to access data stored by U.S. companies in the cloud, regardless of whether this data is stored on servers in the USA or outside the USA. This provision conflicts with the GDPR, which aims to protect the personal data of EU citizens. With this background the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have expressed concerns that the US CLOUD Act may conflict with GDPR, potentially undermining privacy protections. This has led to warnings against using U.S.-based cloud services for storing sensitive data, as it could be accessed by U.S. law enforcement.

Legal Conflicts and Challenges

As a result of this the US CLOUD Act has created legal conflicts for companies operating in the EU. These companies may face a conflict of laws between U.S. law and the GDPR, as well as other applicable EU or national laws. This situation leaves companies in a difficult position, where

EDPB and EDPS have highlighted that the extraterritorial effect of the US CLOUD Act could result in service providers could be facing a direct conflict of laws between US law and the GDPR. 

Potential Solutions and Negotiations

To address these challenges, the EU and the U.S. have been engaged in negotiations to find a solution that respects both data protection and law enforcement needs. The EU has proposed entering into negotiations for a new international agreement that would contain strong procedural safeguards and protect fundamental rights while upholding the principle of dual criminality. Alternatively, the EU and U.S. could work to update their existing Mutual Legal Assistance Treaties (MLATs) to recognize and incorporate the US CLOUD Act into these frameworks.

The U.S. government supports the conclusion of a framework agreement with the EU to be followed by bilateral agreements with EU Member States to satisfy US CLOUD Act requirements. However, there are strong divergences between the EU and the U.S. about what the scope and the architecture of this agreement should be.

Conclusion

The US CLOUD Act has significant implications for data protection and privacy in the EU. While it aims to enhance law enforcement capabilities, it also raises important questions about privacy, sovereignty, and international cooperation. As the digital landscape continues to evolve, the impact of the US CLOUD Act will remain a critical area of focus for businesses, governments, and privacy advocates alike. The EU and the U.S. must work together to find a solution that respects both data protection and law enforcement needs, ensuring that the rights of EU citizens are protected while facilitating cross-border data sharing for legitimate purposes.

Written by

LarsGoran Bostrom

The Author of the book Data Ethics – Navigating the Ethical Landscape of Emerging Technologies 

European trends