The Clarifying Lawful Overseas Use of Data Act or CLOUD Act (H.R. 4943) was signed into law on March 23, 2018.
The law became necessary because the previous legislation in the Stored Communications Act (SCA) of 1986 was written before the advent of cloud computing, and it was unclear whether the US Government could demand that American companies turn over data that was stored on foreign servers.
The law provides a framework for the United States to enter into bilateral agreements with other countries in relation to how data can be demanded/shared, but it also provides additional rules in absence of the bilateral agreements (none of which exist at this time).
Under the CLOUD Act, can a US company be compelled by US courts to turn over data about a foreign (non-US) person if that data is stored on a foreign (non-US) server owned by the US company?
For example, Amazon is a US company and they have an AWS Region in Canada. Since the data is stored in Canada, the CLOUD Act governs how US courts may demand access to that data.
A Canadian company probably should not store personal (e.g. healthcare) information about their clients on a server where it would be vulnerable to foreign courts without the approval of Canadian courts.
Therefore, this question has a significant effect on whether Canadian companies can use US-owned cloud services even if the data is held in Canada.
My vague understanding is that the Cloud Act permits the US Government to demand cooperation from US companies with data overseas belonging to "US persons", with the possible exception that the US company has options to respond if this would violate the laws of the country where the data is stored.
But what if the foreign data belongs to a non-US person? In that case, I am hoping that this would only be permitted according to the rules of one of the as yet unwritten reciprocal agreements with the foreign government.