How does the CLOUD Act apply for non-US persons' data stored on US-owned servers outside the USA?

Question

The Clarifying Lawful Overseas Use of Data Act or CLOUD Act (H.R. 4943) was signed into law on March 23, 2018.

The law became necessary because the previous legislation in the Stored Communications Act (SCA) of 1986 was written before the advent of cloud computing, and it was unclear whether the US Government could demand that American companies turn over data that was stored on foreign servers.

The law provides a framework for the United States to enter into bilateral agreements with other countries in relation to how data can be demanded/shared, but it also provides additional rules in absence of the bilateral agreements (none of which exist at this time).

Under the CLOUD Act, can a US company be compelled by US courts to turn over data about a foreign (non-US) person if that data is stored on a foreign (non-US) server owned by the US company?

For example, Amazon is a US company and they have an AWS Region in Canada. Since the data is stored in Canada, the CLOUD Act governs how US courts may demand access to that data.

A Canadian company probably should not store personal (e.g. healthcare) information about their clients on a server where it would be vulnerable to foreign courts without the approval of Canadian courts.

Therefore, this question has a significant effect on whether Canadian companies can use US-owned cloud services even if the data is held in Canada.

My vague understanding is that the Cloud Act permits the US Government to demand cooperation from US companies with data overseas belonging to "US persons", with the possible exception that the US company has options to respond if this would violate the laws of the country where the data is stored.

But what if the foreign data belongs to a non-US person? In that case, I am hoping that this would only be permitted according to the rules of one of the as yet unwritten reciprocal agreements with the foreign government.

Answer 1

The full text of the Act can be found here:

https://www.congress.gov/bill/115th-congress/house-bill/4943/text

After reading a few times, this is my analysis. I am not a lawyer.

There are basically 2 parts to the act. 1) Rules for US companies (companies already under US jurisdiction) providing data services whether or not the data is stored on foreign servers, and 2) A framework for the US to enter bilateral agreements with other countries in relation to data disclosure in other situations (eg: the US demanding data from a non-US company in relation to a US-person, and vice versa).

Part 2 is irrelevant at this time because no such agreements exist.

Part 1 is “§ 2713. Required preservation and disclosure of communications and records”

And it includes:

** A provider of electronic communication service to the public or remote computing service, that is being required to disclose pursuant to legal process issued under this section the contents of a wire or electronic communication of a subscriber or customer, may file a motion to modify or quash the legal process where the provider reasonably believes— “(i) that the customer or subscriber is not a United States person and does not reside in the United States; and “(ii) that the required disclosure would create a material risk that the provider would violate the laws of a qualifying foreign government. **

Which seems like good news for the situation described in the question, except that…

1. in response to this motion, the court must take into account a variety of other details “as appropriate”, including “the importance to the investigation of the information required to be disclosed;” balanced against others such as “the interests of the qualifying foreign government in preventing any prohibited disclosure;” (there are a total of 8 considerations listed); and

2. it only applies to a “qualifying foreign government”, which is defined as one that has entered into an agreement… none yet exist! That means that until there is an agreement with Canada, Canadians storing data on US-owned servers, wherever they are located, have no protection and a warrant for the data would stand.

In summary, it would seem that we may eventually have meaningful protections here but 1) Each country needs to enter into an agreement with the United States in order for their people to benefit from any of these protections, and 2) there still seems to be ways around it, which may impact whether a bilateral agreement can even be possible.