CLOUD Act, FISA 702 and other US laws

Module 1: Why a European cloud? · Reading time: 12 minutes

Learning objective: After this lesson, you can explain which US laws give access to data held by American companies, why this applies even when the data is stored in Europe, and what the state of affairs is in November 2026.

Key concepts: CLOUD Act, 18 U.S.C. 2713, "possession, custody, or control", provider of an electronic communication service, FISA Section 702, FISA court (FISC), certification, Executive Order 12333, gag order, criminal law versus intelligence work

Why US laws concern European servers

In lesson 1.1 you saw that a company falls under the law of the country where it is established. For most large cloud services, that country is the United States. Two US laws come up in every discussion about the European cloud: the CLOUD Act and Section 702 of FISA. They have a different purpose and work differently, so it's worth keeping them apart.

This is an explanation, not legal advice. US legislation and its interpretation change; the situation described in this lesson is as of November 2026.

The CLOUD Act: investigating crime

CLOUD Act stands for Clarifying Lawful Overseas Use of Data Act. The law was passed on 23 March 2018, as part of a large budget bill. It was triggered by a court case between Microsoft and the US government: the FBI wanted the email of a suspect that was stored on a server in Ireland, and Microsoft refused because the data was located outside the US. Before the Supreme Court could rule, Congress created the CLOUD Act, and that settled the matter.

The core is a single sentence, now found as 18 U.S.C. 2713. In plain words: a provider of an electronic communication service or a remote computing service must preserve or hand over data that is in its "possession, custody, or control", regardless of whether that data is located within or outside the United States.

What does that mean in practice?

• It concerns criminal investigations. The government must have an order from a judge, such as a warrant, just as it would for data held within the US.
• It concerns data the company has in its power. If your mail is held by a European subsidiary, but the American parent company can access it, the parent company can be required to act.
• The provider can object if handing over the data conflicts with another country's law, but only in certain cases (mainly for countries with which the US has a special treaty, such as the United Kingdom and Australia). There is not yet a general treaty between the EU and the US covering this kind of evidence.
• The customer isn't always told. A judge can impose a gag order on the provider, so that it isn't allowed to warn you.

On the other hand, the GDPR (Art. 48) states that a foreign judgment or order to hand over data is only recognised if there is a treaty, such as a mutual legal assistance treaty. An American provider can therefore end up caught between two laws. That is exactly the problem: as a customer, you cannot choose which law wins.

A telling moment: in June 2025, an inquiry committee of the French Senate asked the legal director of Microsoft France whether he could guarantee, under oath, that data belonging to French citizens would never be handed over to American authorities without France's consent. His answer: "No, I cannot guarantee that." He added that the company challenges unjustified requests and that, in practice, such a request had not yet occurred. Both parts of that answer matter: the risk is small, but it exists, and the company cannot rule it out.

FISA Section 702: intelligence on foreigners

FISA is the Foreign Intelligence Surveillance Act. Section 702 was added in 2008. Its purpose is not criminal investigation, but the gathering of foreign intelligence. That is the big difference with the CLOUD Act:

Under Section 702, US agencies can require providers of electronic communication services to cooperate in collecting the communications of foreign "targets". For a European, US law offers little protection here: the constitutional protection against unreasonable search (the Fourth Amendment) mainly applies to Americans. This programme played a central role in the Schrems II ruling by the Court of Justice of the European Union (CJEU) (lesson 1.4).

State of affairs, November 2026

Section 702 must be repeatedly renewed by Congress. In April 2024, the RISAA law extended it by two years, until April 2026. In April 2026, a long-term renewal did not succeed; two short extensions followed instead. On 12 June 2026, the law expired, for the first time since 2008. According to reports, collection continues in practice, because the FISA court had already approved the annual certifications in March 2026; these run until roughly March 2027. Congress continues discussing a new renewal during the lame-duck period starting 9 November 2026.

For your decision, this means: whether or not the law has temporarily lapsed, the underlying problem doesn't go away. It is likely that a new renewal will follow, and the powers may return in a different form.

Executive Order 12333: without a judge

Alongside these laws, there is Executive Order 12333 from 1981, a presidential directive on intelligence work. This covers things such as tapping internet cables and collecting data outside the US, without any judge involved and without requiring a company to cooperate. For data that is encrypted in transit, this is less of a problem; for data held by an American company, the CLOUD Act and Section 702 are the relevant routes.

How big is the risk really?

Let's be honest: for most small organisations, it is unlikely that US agencies are specifically interested in their mail. Still, there are reasons to take it seriously:

• You wouldn't know. Gag orders may mean you never find out.
• You are not the only one affected. Your mail contains data belonging to customers, suppliers and staff. You must protect their data (lesson 1.2).
• Some data is sensitive. A law firm, a GP, a journalist or a school faces a different balance than a bakery.
• The rules can change without you having any say in it.

Bakkerij De Korrel has little to fear from an intelligence agency. But Sanne realises that her mailbox also contains her staff's sick-leave notifications. That is health data, and she needs to handle it with extra care.

In practice: what this looks like with a provider

A European provider without an American parent company and without American sub-processors does not fall under the CLOUD Act and is not a "provider" within the meaning of Section 702. It can still be required to cooperate with European police and justice authorities, but then under European and national law, with a European judge providing oversight. At WebOké, the Nextcloud guide states that your files do not go to American cloud companies. With other providers, look for a list of sub-processors and for the legal owner (lesson 2.1).

Summary

• The CLOUD Act (2018) requires American providers to hand over data in their power under a criminal order, even if it is stored abroad.
• FISA Section 702 gives US agencies access to the communications of non-Americans outside the US, for intelligence purposes, without an order per individual.
• Section 702 expired on 12 June 2026, but according to reports collection continues based on certifications from March 2026; a new renewal is under discussion.
• A server in Europe doesn't protect you if the company behind it falls under American law.
• The risk is small for most organisations, but it cannot be ruled out or checked.

Quiz

Exercise

Exercise E1.3: Which jurisdiction does your service fall under? Choose your most important cloud service. Find out which company signs the contract with you (stated in the terms), where it is established, and who the ultimate parent company is. Answer: can the CLOUD Act apply to this service, and why?

Further reading

The steps in these articles apply to WebOké's services; with other providers, the process is similar.

• Nextcloud manual 15.13: Frequently asked questions about security and privacy
• 18 U.S.C. 2713, Required preservation and disclosure of communications and records (Cornell LII): https://www.law.cornell.edu/uscode/text/18/2713
• FISA Section 702 (50 U.S.C. 1881a) and the CRS report "FISA Section 702 and the 2024 Reforming Intelligence and Securing America Act" (congress.gov, R48592)
• Regulation (EU) 2016/679 (GDPR), Article 48 (foreign orders to disclose data)