Bipartisan Group Introduces CLOUD Act in House

WASHINGTON—Rep. Doug Collins (R-Ga.) is joined by a bipartisan group of lawmakers in introducing the Clarifying Lawful Overseas Use of Data (CLOUD) Act today. The CLOUD Act would better balance the interests of cloud users while incentivizing bilateral agreements for law enforcement to fight crime.

Collins and Rep. Hakeem Jeffries (D-N.Y.) sponsored the legislation in the House, and cosponsors include Reps. Suzan DelBene (D-Wash.), Darrell Issa (R-Calif.), Tom Marino (R-Pa.) and John Rutherford (R-Fla.).

“The digital age demands our vigilance in protecting the privacy and the safety of American citizens. The CLOUD Act paves the way for the U.S. to forge bilateral agreements establishing frameworks for fighting crime and terrorism and for guarding information stored electronically. It’s encouraging to see both bodies of Congress and both sides of the aisle join the Justice Department and tech community in supporting a wise, balanced approach to information storage in the 21st century,” said Collins.

“The CLOUD Act paves the way for the United States to enter modern bilateral agreements for effective investigations of cross-border crime and terrorism—without international legal conflicts—and ensures that customers and data holders are protected by their own nation’s privacy laws. Representative Doug Collins, Senators Orrin Hatch and Chris Coons, the Department of Justice, and our industry partners should all be thanked for their hard work and leadership in this regard,” said Jeffries.

“Updating our laws to reflect the way the world works in the 21st century has been one of my top priorities in Congress. I’ve supported a number of different proposals to reform our electronic privacy laws and will continue to push for those, including the CLOUD Act. This bill guarantees that users of technology have confidence that their privacy rights will be protected by due process while simultaneously ensuring law enforcement agencies have necessary access to information through a clear, legal framework to keep us safe,” DelBene said.

“As technology has made tremendous leaps and bounds forward, our digital privacy laws unfortunately have stayed frozen in time. Today, the growth of cloud computing, online storage, and other services are increasingly taking American data to servers and other facilities all across the world. This often creates conflict between different legal systems that can undermine consumer privacy and generate uncertainty as to when law enforcement may or may not access certain information on those servers. This bill updates digital privacy rights to strike an important balance that safeguards consumer privacy and establishes a clear framework to ensure requests for information comply with the law,” said Issa.

“The CLOUD Act represents compromise between industry stakeholders, the Department of Justice, and consumer groups. This legislation will resolve the uncertainty surrounding law enforcement access to data stored abroad, ensuring they can have timely access while protecting the privacy of consumers. I look forward to working with my House and Senate colleagues to ensure swift passage of the CLOUD Act,” said Marino.

“During my 40 years in law enforcement, quality intelligence often made the difference in stopping crimes and bringing justice to victims. As our world’s information systems grow in complexity, it is essential we fix our outdated laws to ensure law enforcement agencies can access the critical information they need. This bill will update our data laws to protect citizens’ privacy rights and allow law enforcement to properly access data in today’s modern world. I thank my colleagues on both sides of the aisle for their hard work and commitment to keeping our world safe,” said Rutherford.

Sens. Orrin Hatch (R-Utah) and Chris Coons (D-Del.) led the introduction of the CLOUD Act in the Senate today.

“The CLOUD Act is landmark legislation that addresses an increasingly pressing problem,” said Hatch. “In today’s world of email and cloud computing, where data is stored across the globe, law enforcement and tech companies find themselves encumbered by conflicting data disclosure and privacy laws. We need a commonsense framework to help law enforcement obtain critical information to solve crimes while at the same time enabling email and cloud computing providers to comply with countries’ differing privacy regimes. The CLOUD Act creates such a framework and will also help set a precedent for our allies as they deal with this problem too.”

“In a globalized world, we need clear rules governing access to data stored abroad,” said Coons. “I am encouraged that the legal framework included in today’s bill is supported by law enforcement and the tech community. I am proud to join Sens. Hatch, Whitehouse, and Graham in advancing legislation that protects data across borders and encourages fair treatment by our international partners.”

Clarifying Lawful Overseas Use of Data Act of 2018 Pillars:

• Bilateral Agreements: The CLOUD Act enables the United States to enter into formal agreements with other nations to set clear standards for cross-border investigative requests for digital evidence. The CLOUD Act further identifies a series of statutory requirements that these agreements must satisfy, including privacy and security protections.

• Extraterritoriality of U.S. Warrants and International Comity: The CLOUD Act amends U.S. law to make clear that U.S. warrants and other legal process issued for data held by communications providers reach data stored anywhere in the world. The reach of U.S. warrants and legal process, however, would be limited by international comity. The CLOUD Act would give providers, for the first time, a statutory right to challenge legal process based on international comity concerns.

• Transparency: When a communications provider receives a request from U.S. law enforcement related to a national or resident of a country that has entered into a bilateral agreement with the United States, the provider will be permitted to notify that government of the existence of the request. This will allow the foreign government to assess compliance with the terms of the bilateral agreement and enable it to intervene diplomatically if it believes the request is inappropriate.

• Reciprocity: The CLOUD Act would also require participating countries to remove legal restrictions that prevent compliance with data requests from U.S. law enforcement. To qualify for the statutory benefits of the legislation (removal of the U.S. blocking statute, a right for providers to object based on international comity and a right for providers to notify the government of the existence of requests), a foreign government must provide reciprocal rights and benefits to U.S. law enforcement and communications providers.