CLOUD Act

The CLOUD Act is a US law from the year 2018. The abbreviation stands for “Clarifying Lawful Overseas Use of Data Act,” meaning roughly: a law clarifying the lawful use of data abroad. It regulates when US investigative authorities may access data stored at American companies. The decisive point: it does not matter where the computers holding the data are physically located. What matters solely is whether the company falls under American jurisdiction. A US corporation must therefore also hand over data from servers in Frankfurt or Dublin if an American court orders it to do so.

The conflict between US access and European data protection

In the European Union, the General Data Protection Regulation, or GDPR, applies. It only permits companies, within narrow limits, to pass personal data on to authorities outside the EU. Yet the CLOUD Act demands exactly that. This puts a provider in a bind: if it complies with the US law, it may be violating European law. If it complies with European law, it makes itself liable to prosecution in the US.

For authorities, hospitals, and companies in Europe, this is a tangible problem. A German municipal administration that stores citizen data in an American cloud cannot reliably guarantee that no one else can access it. For this reason, some data protection authorities reject the use of certain US services in schools and government offices. The dispute over this has been going on for years and has not been conclusively resolved.

A common misconception is: if the data is stored in a German data center, the CLOUD Act does not apply. This is not correct. The location of the server plays no role, as long as the operator is a US company or its subsidiary.

How an order under the CLOUD Act proceeds

At the start there is a concrete investigative proceeding in the US, usually concerning serious crimes. The authority applies to a court for an order against the provider. Once the order is issued, the company must supply the requested data. This can include emails, chat histories, files, or connection data.

The law provides a right to object. The provider can argue before a US court that the disclosure would violate the law of another state. Whether the court follows this argument is at its discretion. In practice, companies rarely make use of this right, because proceedings are expensive and lengthy.

In addition, the CLOUD Act permits so-called executive agreements. These are intergovernmental agreements in which two countries grant each other mutual data access. The United Kingdom and Australia have concluded such agreements with the US. With the EU as a whole, there is so far none.

Where the CLOUD Act shows up in AI services and cloud contracts

Almost all major AI services run on American infrastructure. Anyone who uses ChatGPT or integrates a language model into their own software via a programming interface sends their inputs to US providers. As a result, this data traffic also falls, in principle, within the scope of the CLOUD Act. Companies that have confidential documents analyzed by an AI must factor this in.

In the business press, you’ll usually encounter the term in connection with the keyword “digital sovereignty.” This refers to Europe’s desire to be less dependent on American technology. Projects such as European cloud offerings or AI models from the EU are often justified precisely on these grounds. Public sector tenders, too, now frequently contain corresponding conditions.

In response, US corporations offer so-called sovereign clouds. Here, a European partner operates the data centers, while the US provider supplies only the technology. Whether this truly excludes access is legally disputed. Anyone reading the term in the news should therefore look closely at who ultimately has control over the keys and the servers.