ECLA Newsletter, June 2018

A legislative amendment in March 2018 has brought an end to Microsoft’s years of resistance against the U.S. government’s demand to access data stored abroad. The corresponding lawsuit before the U.S. Supreme Court was dropped in April. Microsoft may have won on paper, but the U.S. authorities have already obtained a new search warrant.

United States vs. Microsoft 

In 2013, a New York federal district court ordered Microsoft to turn over a customer’s emails. The company submitted the data that had been stored in the U.S., but refused to hand over emails stored on servers in Ireland on grounds that Irish courts would have competency over that data.

In 2017, the U.S. government turned to the Supreme Court and last February, the hearing took place. Microsoft again challenged the U.S. authorities’ practice of allowing private data from other countries to be released.

New law creates new legal basis

As it turns out, the Supreme Court (SCOUTS) never got a chance to issue a ruling. In the midst of the debate, U.S. President Donald Trump signed a law on March 23 that provides security authorities with extensive opportunities to access user data. The Clarifying Lawful Overseas Use of Data Act (CLOUD) complements the existing Stored Communications Act (SCA) and requires American internet companies to provide access to user data to U.S. security authorities no matter where the data is physically stored.

ECLA’s brief of amicus curiae

At the beginning of this year, ECLA filed a brief of amicus curiae with the Supreme Court in this case in support of the respondent. The position of the United States created direct conflict with EU data protection regulations that explicitly prohibit the very transfer the U.S. government sought. It was ECLA’s intention to officially show support for the company’s concerns, as privacy policies are in need of further reform and new legislation and new international agreements are required. With the passage of the CLOUD Act, Congress has taken a first step in this direction.

With the new law, Congress has established more precise rules on how collaborations between U.S. law enforcement agencies and foreign partners – and thus access to data located on servers outside their own territory – should be handled. Microsoft supported the legislation, which also provides a way to facilitate foreign law enforcement agencies’ access to data held inside the U.S. via bilateral agreements

New search warrant

The U.S. government withdrew its original request for a search warrant in 2013 and obtained a new search warrant for the same Microsoft data in March. This already falls under the new rules of the CLOUD Act. The company has apparently waived any objection to the new search warrant. The emails stored in Ireland will now end up with the U.S. authorities after all.

As a result of the Supreme Court’s current ruling, all lower courts’ decisions, including a Microsoft conviction for contempt of court, are overturned. The case was officially closed.