EDPB-EDPS assessment of the US CLOUD Act (2019)¶
Reference
Citation: European Data Protection Board and European Data Protection Supervisor. "EDPB-EDPS Joint Response to the LIBE Committee on the impact of the US Cloud Act on the European legal framework for personal data protection", with annex "Initial legal assessment of the impact of the US CLOUD Act on the EU legal framework for the protection of personal data", July 2019. Type: regulatory legal assessment. Link: edpb.europa.eu.
What it is¶
The EU data protection authorities' legal assessment of the US Clarifying Lawful Overseas Use of Data Act (2018), which lets US law enforcement compel a provider under US jurisdiction to disclose data "regardless of whether such communication, record, or other information is located within or outside of the United States" (annex, p. 1). The assessment holds that such an order is not by itself a lawful ground for disclosure under the GDPR: "A request from a foreign authority does not in itself constitute a legal ground for transfer" (annex, p. 2). Under Article 48 GDPR a foreign order can be recognised only "if based on an international agreement such as a mutual legal assistance treaty" (annex, p. 2). Absent such an agreement, disclosure would need a legal basis under Article 6 and a derogation under Article 49, and the assessment finds those available only in narrow cases (annex, pp. 3-6). Providers under US jurisdiction that hold data of EU data subjects therefore face a conflict of laws.
Role in the record¶
- Context for the BP11 governance tab: where an agent's model provider is under US jurisdiction, storage location in the EU does not remove the provider's exposure to US legal process. The record cites this as a constraint on provider choice for personal and confidential research data. The wider debate about digital sovereignty is outside the record's scope, and the record takes no position on it.
- Limits: the assessment predates the EU-US Data Privacy Framework (2023) and the General Court's Latombe judgment upholding it (Case T-553/23, 3 September 2025, under appeal as C-703/25 P). Those instruments concern commercial transfers, not law-enforcement access, so the Article 48 analysis stands; the editor should check for later EDPB statements.
Atom-level for/against detail and quotes are in the provenance data (assets/provenance.yml), keyed by practice atom.