How the CLOUD Act gives the US access to foreign data

If your cloud provider is based in the US, a valid US court order can compel that company to retrieve your company’s data on servers anywhere in the world. Companies including Google, Microsoft, and Amazon are vulnerable to this intrusion, made possible by the CLOUD Act, a 2018 law that gives American law enforcement officials global tentacles. It’s especially a problem for EU businesses. If your US provider hands over your emails or files, that could constitute a violation of the GDPR for leaking personal data, which can impose penalties of up to €20 million or 4% of global annual revenue, whichever is higher. That’s the reality that American companies obscure when they say “GDPR-compliant” and “European sovereign cloud” in their marketing. A US provider’s EU data center is still run by a company under US jurisdiction. For your business, this means that procurement decisions carry a compliance liability you may not have priced in. For your customers, it means the personal data they entrusted to you may end up in a legal process they have no say in (and may never even learn about). Here’s a plain explanation of the CLOUD Act, why this invasive legislation matters for businesses,…