CLOUD Act (2018)
A US law of March 2018 that lets US authorities compel a provider subject to their jurisdiction to produce the data it controls, wherever that data is stored.
Hosting data in Europe does not take it out of US law if the host is a US company or its subsidiary: what counts is control of the data, not where it is stored. The statute ended the dispute opened when a major software company refused to hand over emails stored in Ireland, and it allows bilateral data-access agreements between states. For a European company, it creates a legal and political risk that server location alone does not solve, and that can conflict with the GDPR. That risk underlies sovereign cloud qualifications, such as SecNumCloud in France, which require immunity from extraterritorial laws, and the cyber underwriter meets it in questions about the hosting chain.
The CLOUD Act was signed into law on March 23, 2018; on April 17, 2018, the US Supreme Court declared moot the case United States v. Microsoft, which concerned emails stored in Dublin. The data-access agreement between the United Kingdom and the United States, concluded on that basis, entered into force on October 3, 2022.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.