US and UK Sign Law Enforcement Data Access Agreement

The US and UK have signed a CLOUD Act "executive agreement,” permitting cross-border access, by law enforcement agencies, to personal communications without a warrant.The agreement will enter into force within 180 days if Congress does not pass a resolution of disapproval. To form the agreement, the Attorney General must certify to Congress that the country's domestic law "affords robust substantive and procedural protections for privacy and civil liberties.” Privacy rights organizations in the UK have challenged the adequacy of legal protections for communications data. EPIC has also argued in the European Data Protection Law review that the CLOUD Act fails to include key human rights protections, such as notice, judicial authorization, and transparency EPIC submitted an amicus brief in the related Supreme Court case United States v. Microsoft, pointing to fundamental rights obligations for cross-border access to personal data, and published "Digital Free for All Part Deux: European Commission Proposal on E-Evidence" in Just Security.