Has international data storage become a strategic choice following the Microsoft judgment?

A
US court has recently ruled that Microsoft does not have to allow the US
government access to personal data (in the form of a Microsoft Hotmail user’s
emails) stored on an overseas server. The case is significant because it has
provided US cloud service providers, which have invested heavily in setting up
data centers in the EU, with greater legal certainty regarding access to data
by US authorities. In refusing to hand over the data, Microsoft has publicly
drawn a line in the sand, demonstrating to its European customers that it is
prepared to challenge the US legislature in order to protect EU-based personal
data and prevent its transfer to, or access by, the US government (the only
exception to this perhaps being some cases related to criminal and terrorist
investigations). Since the ruling Microsoft has also boosted its EU data center
capacity by announcing that its first UK cloud computing data centers are up
and running.

What
happened?

Following
an attempt by the US government to access e-mails (in relation to a narcotics
case) from a personal email account held on a server in Ireland under the
Stored Communications Act of 1986 (SCA), the U.S. government obtained a warrant
to gain access to the emails of a Microsoft customer held by Microsoft on a
server in Dublin.

Microsoft
refused to hand over the data, arguing that such a warrant should not apply to
data held outside of the United States. The US government, however, argued that
the physical location of the files was irrelevant, as Microsoft (as a U.S.
company), had full control over them.

Central
to the case was the interpretation of the SCA in the context of international
data storage. The SCA itself is part of the Electronic Communications Privacy
Act (ECPA). The ECPA, being 30 years old, was (unsurprisingly) not drafted in a
way which predicted the concept of data stored across multiple jurisdictions.
One of the key issues considered was whether US law should be applied
internationally. According to the US Supreme Court, this should not take place
unless Congress is clear during its development and enactment that any such law
should apply beyond America’s borders. Microsoft argued that applying US search
warrants outside the United States would set a dangerous precedent, and
generate a “global free-for-all” in the use of such warrants which
would directly conflict with general data privacy principles.

The
second circuit court agreed with Microsoft, holding that the SCA was not
drafted in a way which envisaged searches taking place outside its borders, and
there was no evidence to demonstrate that international application had been
anticipated by Congress in the SCA. It is worth noting, however, that the judge
here also argued strongly that the SCA needs to be updated in order to take
into account developments in relation to the storage of electronic personal
data. It remains to be seen whether the decision will be appealed to the
Supreme Court.

Interestingly,
the case turned on where the data was actually stored – a decision which was
not taken by the Microsoft Hotmail user but by Microsoft itself as part of its
international technology infrastructure (i.e. there was no active decision by
the Hotmail account owner to store data outside of the US). It is also
interesting that the judge noted that there was nothing in the record to
indicate whether the owner of the e-mails being sought by the U.S. government
was a U.S. citizen or resident. By its nature, cloud storage means that the
location of data storage is often largely irrelevant from a consumer
perspective, although in this case the physical location of Microsoft’s server
was pivotal in the decision to uphold its argument. Indeed, the nature of
contemporary data storage means that often different pieces of related data can
be held in multiple jurisdictions, rather than on one server rack in a single
country.

For
now, the case seems to strengthen the position of those technology companies
wishing to store personal data across multiple jurisdictions and offer their
customers relative confidence about the privacy of their information. However,
it does not completely rule out access through other well-established, but more
stringent and specific routes, such as international mutual assistance legal
treaties, which are applicable in limited circumstances.

What
about government access to data?

As
well as providing US cloud service providers, which have their servers outside
of the US, with greater legal certainty regarding the data protection law
compliance of their services offered in the EU, this judgment could pose a
serious question as to the relevance of the levels of data protection in the US
in cases where data is stored on EU servers, as the US government may no longer
have access to data stored on servers outside of the US. Many cloud service
providers (such as Amazon Web Services) now offer users the option to choose
where their data is stored. If the rationale of the judgment is followed and a
user consciously opted to store their data on an EU server, the US government
would no longer have access to that data (as opposed to a situation where data
was held on a US server), potentially creating a way to circumvent US government
data access.

The
bigger picture

This
case also comes at a time when international data transfers and data privacy
rules are under even more scrutiny as a result of the introduction of the EU –
US Privacy Shield, challenges to EC approved Model Clauses for transferring
data to the U.S. and the introduction of the new EU
General Data Protection Regulation (GDPR) in May 2018.

These
recent regulatory changes are generally perceived to be a step in the right
direction for data privacy law, and it may be that the US legislature will face
increasing pressure to update US law (in the form of the SCA) at a time when EU
regulation is undergoing significant overhaul. If this is the case however, the
challenge will be to ensure that any new legislation is flexible enough to
remain relevant as technology continues to evolve at its seemingly exponential
rate. As far as international data storage is concerned, until such change
occurs the debate will continue and we will have to wait and see whether the
Supreme Court will get to have the final say in the matter.