Update in the case of United States of America v. Microsoft Corporation

In the midst of the current privacy debate, on March 23, US President Donald Trump has signed a law that provides security authorities with extensive opportunities to access user data. The Clarity Lawful Overseas Use of Data Act (CLOUD) complements the existing Stored Communications Act (SCA) and requires American Internet companies to provide access to user data to US security authorities even when stored outside of the United States.

Citing this new law, the Justice Department asked the Supreme Court on March 30 to moot the case of United States of America (petitioner) v. Microsoft Corporation (respondent). In this case, Microsoft refused to provide the user data stored in Ireland to the US security authorities. The judges of the Supreme Court were now confronted with a law that explicitly allows, which should be judicially decided. Legislation actually anticipated the verdict.

In the beginning of this year ECLA filed a brief of amicus curiae with the Supreme Court in this case in support of respondent. The position of the United States created direct conflicts with EU data protection regulations that explicitly prohibit the very transfer the Government seeks and authorize sweeping administrative penalties and private lawsuits for violations of that prohibition. It was our intention to officially show our support with the company’s needs, because we too believe that the privacy policies are in need of further reform and that that we need new legislation and new international agreements. With the passage of the CLOUD Act, Congress has taken a first step in this direction.

With the new law, Congress has set clearer rules on how collaborations between US law enforcement agencies and foreign partners, and thus access to data residing on servers outside their own territory, should be handled. Microsoft supported the legislation, which also provides a way to facilitate — through bilateral agreements — foreign law enforcement agencies’ access to data held inside the United States.

The original warrant that was basis of the litigation was now withdrawn and the US Department of Justice has already obtained a new search warrant based on the Cloud Act.