The United States and the United Kingdom entered into the world’s first ever Clarifying Lawful Overseas Use of Data Act (CLOUD Act) agreement on October 3, 2019 (the Agreement). The Agreement, which will enter into force later this year after review by lawmakers in both countries, allows each country’s law enforcement agencies to demand, with proper authorization, electronic data regarding serious crime (defined in Article 1 of the Agreement as an offense punishable by a maximum term of imprisonment of at least three years) directly from technology companies based in the other country.
The Agreement allows for more efficient investigations relating to serious crimes such as terrorism, transnational organized crime, and cybercrime, by allowing timely access to electronic data of crimes committed in one country that are stored in the other country. The Mutual Legal Assistance (MLA) request process in effect prior to the Agreement, through which central governments approve requests for electronic data from law enforcement agencies, could take up to two years. Under the terms of the Agreement, after receiving proper court authorization, law enforcement agencies may submit requests directly to technology companies based in the other country to access electronic data.
However, there are many complexities under the Agreement, including limitations on the use and transfer of any data obtained pursuant to an order subject to the Agreement. A key limitation is that a recipient of data under the Agreement must treat the data in accordance with the recipient’s domestic law, including its privacy and freedom of information laws. The Agreement does not compel the technology company to remove encryption, nor does it compel a technology company to comply with an order. Any actions taken in the event of noncompliance are governed by the legislation of the country making the request.
Further, each country also committed to obtain the permission of the other country before using data in a manner that could be contrary to the essential interests of the other country. In the case of the United States, the essential interest is any data that may be introduced as evidence in the prosecution’s case in the United Kingdom in a manner that raises freedom of speech concerns for the United States. In the case of the United Kingdom, the essential interest is any data that may be introduced as evidence in the prosecution’s case in the United States for an offense for which the death penalty is sought.
The Agreement will enter into force following a six-month Congressional review period mandated by the CLOUD Act and the related review by the UK Parliament. For more information on the CLOUD Act, please see our previous post and go to the resources available on the US Department of Justice website.