The Clarifying Lawful Overseas Use of Data Act (Cloud Act) has been recently passed in the United-States and significantly changes the legal landscape regarding the access of personal data abroad. It namely grants the government access personal data stored abroad (§2713 of the Cloud Act). Its enactment is a turning point in the United-States v. Microsoft case (Case 14‐2985) which started in 2014.
What is the Microsoft case?
The Microsoft case was brought under the Stored Communications Act (SCA, 18 U.S. Code §§ 2701 et. seq.) and more specially regarding the federal government’s power to require the disclosure by a provider of electronic communication services of the contents of a wire or electronic communication.
The Department of Justice requested that the company hand over all emails regarding a drug-trafficking case. Microsoft refused to do so for emails stored on servers abroad in Dublin (Ireland) arguing that the SCA did not have an extraterritorial scope. The case is now in front of the United-States Supreme Court (USSC). The latter has been hearing arguments since last February.
During these hearings, Microsoft argued that the USSC should postpone its decision until the Cloud Act was enacted. Now that it has, what are the next steps?
How will the Cloud Act impact the Microsoft case?
The Cloud Act namely expands the United-States government’s power to access data held overseas (§2713 of the Cloud Act). As a result of this new section, the Department of Justice has filed a motion with the USSC to vacate the judgment of the Court of Appeals (in favour of Microsoft) and remand the case with directions to dismiss as moot.
The motion argues that the Cloud Act gave the United-States a new warrant and that Microsoft’s sole objection, that the prior warrant was impermissibly extraterritorial, no longer applies. The case has thus become moot.
Update: the USSC decided to vacate the case on April 17th, 2018 on the grounds the Government obtained a new warrant under §2703 following the modifications brought by the Cloud Act. Further, the parties agree that the new warrant has replaced the original warrant. The case was thus moot seeing as no live dispute remained between the parties.
The main question the USSC had to answer was whether the Cloud Act is retroactive. To determine whether this is the case, court must namely consider whether the new provision attaches new legal consequences to events completed before its enactment (Landgraf v. USI Film Prods., 511 U.S. 244, 265 ,1994).
On the one hand, if the USSC had deemed that the Cloud Act was not retroactive, the Department of Justice would have had to withdraw its motion and the Microsoft case would have been decided on its merits. On the other hand, and as the USSC has considered, if the Court considered the Cloud Act to have a retroactive effect, Microsoft would have had to handover the emails stored in servers Ireland.