CLOUD Act stirs tension between privacy advocates and big tech

Congress has come under fire for passing the controversial CLOUD Act as part of the omnibus spending bill, rather than through traditional methods, with review and open hearings.

The aim of the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) was to allow the president to enter into agreements with foreign governments to facilitate information and data sharing across international borders in law enforcement investigations. The CLOUD Act has been controversial, because although it would put in place a standardized process for sharing communication data across borders, some say it lacks oversight and infringes on user privacy.

The CLOUD Act (H.R. 4943) had wider support from big tech companies. Apple, Facebook, Google, Microsoft and Oath all signed a letter in February urging Congress to pass the CLOUD Act, because they saw it as a way to "create a concrete path for the U.S. government to enter into modern bilateral agreements with other nations that better protect customers."

"The legislation would require baseline privacy, human rights and rule of law standards in order for a country to enter into an agreement. That will ensure customers and data holders are protected by their own laws and that those laws are meaningful. The legislation would further allow law enforcement to investigate cross-border crime and terrorism in a way that avoids international legal conflicts," the companies wrote in the letter. "The CLOUD Act encourages diplomatic dialogue, but also gives the technology sector two distinct statutory rights to protect consumers and resolve conflicts of law if they do arise. The legislation provides mechanisms to notify foreign governments when a legal request implicates their residents, and to initiate a direct legal challenge when necessary."

However, privacy advocates -- including the American Civil Liberties Union (ACLU), Electronic Frontier Foundation (EFF) and Amnesty International -- have widely panned the CLOUD Act for lacking oversight and due process.

The EFF and ACLU have charged that the CLOUD Act is unconstitutional, and it would allow foreign governments to wiretap U.S. citizens without complying with U.S. law and give the president the power to enter into agreements without congressional approval.

Jennifer Daskal, associate professor of law at American University Washington College of Law, and Peter Swire, chair of law and ethics at the Georgia Tech Scheller College of Business, said this view of the CLOUD Act was not accurate. Daskal and Swire wrote on the Lawfare blog that the CLOUD Act would make the process of sharing data on non-U.S. citizens easier and would allow the "U.S. government to review what foreign governments do with data once it is turned over."

"If the foreign government wants to request the data of a U.S. citizen or resident, it still needs to employ the Mutual Legal Assistance (MLA) system. The bill sets forth a long list of privacy and human rights criteria as to the contours of those requests," Daskal and Swire wrote. They added that governments naturally seek to sidestep the MLA system, and the inevitable result will be data localization laws forcing storage in those countries.