US Cloud Act Risks That European Companies Can't Ignore

The Clarifying Lawful Overseas Use of Data (CLOUD) Act, enacted in 2018, remains one of the most significant yet underappreciated risks for European organisations using US-headquartered cloud services.

What the CLOUD Act Does

The CLOUD Act authorises US law enforcement to compel US-based technology companies to provide requested data, regardless of where that data is physically stored. This means:

• Data stored on AWS servers in Frankfurt can be requested by US authorities
• Microsoft 365 data in EU data centres is not protected from US access
• Google Cloud's EU regions do not provide jurisdictional immunity

The Conflict with GDPR

This creates a direct legal conflict. GDPR prohibits data transfers to jurisdictions without adequate data protection (which the US lacks, per Schrems II). The CLOUD Act requires US companies to comply with data requests regardless of location. European organisations using US cloud services are caught in this impossible legal contradiction.

Real-World Implications

While US authorities may not routinely exercise CLOUD Act powers for commercial data, the risk is structural:

• Legal uncertainty: No contractual guarantee can override a US court order
• National security exceptions: Broad categories of requests fall under national security
• Subsidiary reach: US parent companies can compel EU subsidiaries to cooperate
• No notification requirement: Companies may be prohibited from informing affected parties

Mitigation Strategies

Short-term

• Encrypt data with keys you control (not the cloud provider)
• Conduct Transfer Impact Assessments for all US-connected services
• Document your risk assessment for regulatory defence

Long-term

• Migrate to EU-owned and operated cloud infrastructure
• Choose SaaS providers with no US parent company or investment ties
• Adopt zero-knowledge encryption where possible

The Only True Solution

Technical and contractual measures can reduce risk, but cannot eliminate it. The only complete mitigation is to use services that fall entirely outside US jurisdictional reach: EU-owned, EU-operated, with no US parent company or legal nexus.