Requesting data stored in different countries just became a lot easier in the United States. The landmark data access case between U.S. authorities and Microsoft ended this month. The U.S. Supreme Court dismissed the case without issuing a ruling, arguing that the principal conflict had been resolved by the authorization of the CLOUD Act.
The new law, which was approved by the U.S. Congress as part of its omnibus spending bill in March, requires companies to provide law enforcement with the information it requests even if such information is stored in other countries. Microsoft had argued against this since 2013 when American authorities asked it for user information in order to investigate a drug trafficking case. The company declined to provide all of the information requested, explaining that since the data was stored in a data center in Ireland, U.S. authorities would have to coordinate with their Irish counterparts to obtain the information.
American authorities argued that Microsoft had no right to deny it access to the data since it was a U.S. company. Microsoft disagreed, and the case ended up in court. It has become an important case over the years, highlighting the difficult question of “how and when” law enforcement agencies should be able to access online data.
Under the CLOUD (Clarifying Lawful Overseas Use of Data Act) law, Microsoft will now have to provide the data requested by law enforcement in 2013. Notably, the company publicly supported the law along with tech sector giants like Apple, Facebook, Google and Oath.
The law allows the U.S. government to enter into bilateral data access agreements with other countries. In order to enter into such an agreement, CLOUD requires the country have baseline privacy, human rights and rule of law standards.
In a statement, Microsoft indicated that it was satisfied with the outcome of events:
“We welcome the Supreme Court’s ruling ending our case in light of the CLOUD Act being signed into to law. Our goal has always been a new law and international agreements with strong privacy protections that govern how law enforcement gathers digital evidence across borders. As the governments of the UK and Australia have recognized, the CLOUD Act encourages these types of agreements, and we urge the U.S. government to move quickly to negotiate them.”