Attorney General Jeff Sessions and EU Justice Commissioner Věra Jourová have met twice over the last two weeks, signaling momentum towards a new EU-U.S. solution for the sharing of electronic evidence. These meetings occurred in the wake of proposed regulations on the sharing of electronic evidence in the EU, and the passage of the Clarifying Lawful Overseas Use of Data Act (the CLOUD Act) in the United States. The CLOUD Act, passed as a rider to the omnibus spending bill in March 2018, clarifies that warrants and subpoenas issued under the Stored Communication Act can reach data stored overseas and provides a streamlined process for foreign governments to obtain data stored in the United States.
Although the CLOUD Act establishes the government’s right to obtain data stored abroad under U.S. law, electronic communication or storage providers could have conflicting obligations under the laws of other countries. The CLOUD Act partially addresses this conflict by creating a process by which a recipient of legal process under the SCA can challenge it. But this challenge process is limited. Providers can only challenge the legal process due to conflicting obligations under another the law of a foreign government if (a) the subscriber whose information is sought is not a U.S. person or resident and (b) the foreign government has entered into an “Executive Agreement,” as defined by the CLOUD Act.
Executive Agreements under the CLOUD Act are agreements between the United States and a foreign government that allow each party reciprocal rights of access to data. An Executive Agreement would allow a foreign government to issue an order for electronic evidence to a provider subject to U.S. jurisdiction where the order is (a) issued in compliance with the domestic law of that country; (b) founded on reasonable justification; (c) related to the investigation of a serious crime; and (d) targets a non-U.S. person.
The Executive Agreement framework marks a substantial departure from prior practice, which required use of the Mutual Legal Assistance Treaty (MLAT) process to obtain data located in a foreign country. Where a foreign country seeks data stored in the U.S., the MLAT procedure requires an order to be issued by a United States magistrate judge. The Executive Agreement eliminates this ex-ante judicial check on foreign demands for data. As of May 24th, negotiations with foreign governments over Executive Agreements had not yet begun, although the Department of Justice has indicated that several foreign governments have expressed interest.
As domestic and foreign laws are updated to account for the trend of data becoming increasingly untethered to geographic location, greater international harmonization is necessary. Without harmonization, providers can face circumstances where the law of one country requires disclosure that the law of another prohibits. The CLOUD Act takes a step towards harmonization by creating the challenge process, but it presupposes that countries will enter into Executive Agreements under its terms. EU Justice Commissioner Věra Jourová has already been critical of this aspect of the CLOUD Act, tweeting that it “narrows the room for the potential compatible solution between EU-US.” Should countries find the CLOUD Act’s requirements for Executive Agreements untenable, the CLOUD Act’s legacy may be as an obstacle to rather than a tool for international electronic communication or storage providers.