United States. Surveillance / law enforcement access. Act

CLOUD ActClarifying Lawful Overseas Use of Data Act (CLOUD Act)

In force

Partly verified

Medium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.

§1Summary

Synopsis

Confirms that US providers must produce data within their possession, custody or control in response to US legal process regardless of where it is stored. It also authorises executive agreements letting qualifying foreign governments request data directly from US providers.

Key themes

extraterritorial data access
possession custody or control
comity challenges
executive agreements

Unique features

Lets providers move to quash where disclosure would breach a qualifying foreign government's law; a frequent issue in EU transfer impact assessments.

SaaS relevance

Any US-headquartered SaaS (or one with US control over data) can be compelled to produce customer data stored abroad.

§2Obligations

Extraterritorial: Yes
Breach notification: None
DPO: No
Cross-border transfers: Executive agreements with UK, Australia
Maximum penalty: Contempt sanctions for non-compliance with legal process

§3Dates

Key dates

Adopted 23 March 2018
In force 23 March 2018
US-UK Data Access Agreement in force 2022-10-03; US-Australia agreement in force 2024-01-31.

§4Text and authority

Text

Authoritative text justice.gov

Authority

US Department of Justice

§6Sources and verification

Sources consulted

justice.gov

Verification

Medium confidence.