On February 6, 2018, a bipartisan group of senators introduced the Clarifying Lawful Overseas Use of Data (“CLOUD”) Act of 2018, which would give law enforcement faster access to internationally stored data.

The bill, S. 2383, attempts to address gaps left by other laws regarding cross-border data access, specifically the confusion about which country should be able to obtain information from data stored on foreign soil. For domestic law enforcement officials, the existing Stored Communications Act (“SCA”) is not clear about whether the United States can force American companies to turn over data that is held on foreign servers. In  U.S. v. Microsoft, for example, the Supreme Court will address the issue of whether a warrant issued under the SCA can compel Microsoft to turn over electronic communications that it stores in an Irish data center; oral arguments for this case are scheduled for February 26, 2018. Likewise, for foreign law enforcement officials, the SCA has been interpreted to prevent American companies from producing data in response to foreign officials’ requests.

The CLOUD Act aims to strike a compromise and to facilitate information sharing by ensuring that law enforcement agencies in the United States and abroad have necessary access to data to prosecute crimes. For U.S. officials, the bill would amend the SCA to clarify that a warrant, subpoena, or court order issued to a provider to disclose data applies to all data “within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.” (Section 2713; emphasis added). This means that if an American company chooses to store its data offshore, it must still comply with U.S. law enforcement requests for that data.

S. 2383 does contain some exceptions to this requirement. For example, a company can challenge the government’s request for data stored abroad if it believes that the customer or subscriber is not a U.S. person, and the disclosure would cause the provider to violate the laws of a qualifying foreign government.

For some foreign governments, the bill provides access to data stored with U.S. companies, but only those governments that qualify for an executive agreement with the United States. The president can enter into such an agreement with a country only if the Attorney General and the Secretary of State determine that, among other things, the foreign country has appropriate protections for privacy and civil liberties, and that the country has adopted minimization procedures regarding information concerning U.S. persons.

Several industry associations have already praised the CLOUD Act, stating that it establishes a “clear mechanism for U.S. law enforcement to seek some data stored abroad, while also providing a balanced legislative framework that permits requests from foreign investigators whose countries remove conflicts of law, raise privacy standards, and respect human rights.”