What the CLOUD Act means for your data

The CLOUD Act is the law most often cited in discussions of US law and data stored in Europe. It covers fewer situations than many assume, but it reaches data wherever it is held.

What the law says

The CLOUD Act was passed in March 2018 as part of a wider spending bill. It added a provision to the US Stored Communications Act, 18 U.S.C. § 2713, which requires a provider of electronic communication or remote computing services to preserve and disclose content and records in its possession, custody or control. That applies whether the data is located inside or outside the United States.

The law followed a dispute over email that a US provider stored on a server in Ireland. The provider argued that a US warrant did not extend that far. The case reached the US Supreme Court, which dismissed it once the new law was in place.

The law is used in criminal investigations and requires an order under US criminal procedure, such as a warrant reviewed by a judge. Since 2018 the test has been control over the data, and location no longer decides the matter. That makes the law an example of extraterritorial law, meaning rules that reach beyond a country’s borders. Many countries have such rules, the EU among them.

When two laws meet

A provider can ask for an order to be modified or quashed if disclosure would conflict with another country’s law. That route is open to countries that have concluded a specific agreement with the United States on the matter. We have found no such agreement with the EU or Sweden.

Within the EU, the GDPR applies. Under Article 48, a decision from a court or authority outside the EU may be recognised only if it is based on an international agreement, such as a mutual legal assistance treaty. In 2019 the European Data Protection Board and the European Data Protection Supervisor concluded that disclosing personal data solely on the basis of a CLOUD Act order generally lacks a legal basis under the GDPR.

A provider subject to both may therefore have to weigh them against each other. Providers often scrutinise such requests and can challenge those that are not well founded. Responsibility for the data still rests with you. If you are the controller and use a data processor, you must be able to show that the processing is lawful.

Questions for the supplier

The law turns on ownership and control, so that is where the questions start. Who owns the supplier, and is there a parent company in the United States? Ask the supplier, too, which sub-suppliers can reach the data and where they are based, how a request from a foreign authority is handled, whether you will be informed and what the contract says.

The AI component deserves its own question. A prompt to an AI service often includes passages from your documents. If it is passed to a service run by a US company, the same reasoning applies to that data, even if the rest of the system runs in Sweden.

The answers show where the line falls between data that can sit in a standard cloud service and data that needs a setup in which the question never arises. The rules on third-country transfers and the GDPR questions for AI suppliers are closely linked. Intelligence laws are covered next, in FISA 702 and what intelligence laws mean for the cloud.

How it works in iSearch

iSearch can run on your premises, with the whole chain in your own environment and no public AI services. The data then exists only with you.

iSearch can also be hosted by us. The hosting runs in Sweden, by a Swedish company with no US owners and no US-owned sub-suppliers for the hosting. Every customer gets a separate environment. Hosted by us, iSearch can run entirely without public AI services, with the language model in the Swedish hosting.

If you choose to use public AI services, the reasoning above applies to the data sent there. Whether to use them is your decision. Read more about on-premises or cloud or book a walkthrough.