Europe Has Its Own CLOUD Act Now
It's called the e-Evidence Regulation, and it starts next Tuesday.
My Medium friends can read this over on Medium.
From August 18, a prosecutor in one EU country can order your data from a company in another EU country. Directly. In a lot of cases without a judge in the second country looking at it first.
Ten days to hand it over. Eight hours if they call it an emergency.
That's called the e-Evidence Regulation, passed in 2023. And it's huge… and completely flying under the radar right now.
Ten days
Two new instruments are key. A European Production Order, which makes a provider hand over data. And a European Preservation Order, which makes them freeze it so it's still there when the first one arrives.
The data comes in categories, and the bar rises with them. Subscriber data (who is behind this account) is an easy one. Traffic and content data need a criminal offense that carries a maximum sentence of at least three years in the issuing country, or one from a short list: terrorism, child sexual abuse, payment fraud, some cybercrime.
If a provider doesn't play along, the penalty is up to 2% of total worldwide annual turnover. Late and partial answers count too.
And companies outside the EU are not out of reach. If you offer your service to people in the Union, you have to name an establishment or a legal representative inside it, and that representative is the address these orders go to. Banks and other financial services are the one big carve-out.
So, every country is a potential target here.
Ten days for replacing a process that averaged about ten months before. Wow.
Mutual legal assistance between two European countries could take the better part of a year, and half of it was paperwork moving between ministries. For an investigation, that's basically a failure from the start.
Same shape
The reason so many European governments started moving off American cloud services was one sentence in a French parliamentary hearing. Microsoft could not guarantee that data on French servers would never go to US authorities. Because of the CLOUD Act, an American law that reaches American companies wherever their servers happen to stand.
That answer turned digital sovereignty from a policy preference into a security question, at least for procurement departments. I've written about it more than once.
The two laws are not the same thing, and I don't want to pretend they are. An e-Evidence order comes from a judicial authority, not an agency. There are grounds to refuse: immunities and privileges, a manifest breach of fundamental rights, a conflict with the law of a third country. There are legal remedies for the person affected, at least on paper.
But the shape is the same. An authority in one country reaches data held in another, and the second country's courts are not necessarily part of the decision.
The question was never only which country the servers sit in. It's which authorities can reach them.
Scope
Telcos and hyperscalers are the obvious targets. The definition goes further: electronic communications services, domain name and IP services, and other information society services that either let users talk to each other or store data for them.
Read that slowly and you land on the places most of us publish. A newsletter platform stores your posts and your subscriber list, and lets people comment. A hosting company keeps your site. A forum does both.
I don't know which legal representatives the platforms I use have designated, and I couldn't find it published anywhere. Maybe that's coming next week. Maybe it's already in a filing.
One thing I got a bit wrong before (in hindsight now). I wrote about kSuite as the Swiss answer to Google Workspace, and part of the argument was that Swiss hosting sits outside the CLOUD Act. That's still true. It doesn't sit outside this one, though, if the provider offers services in the EU. Different law, different door.
The catch… there always is one
There is a notification mechanism, and it was supposed to be the safeguard. A second authority sees the order and can object before rights get run over.
It got thinner in negotiation, apparently. Preservation orders don't trigger it at all. Neither do production orders for subscriber and traffic data when they're used to identify a user, which is more or less the exact move you make when you want to know who a journalist has been talking to. EDRi has been saying this since 2021. It's coming though.
Some things are unclear, still. Not every EU judiciary is in the same state, and some are under Article 7 proceedings for exactly that reason. An order from one of them lands with the same ten day deadline as an order from anywhere else.
The professions this bites first are: Journalists and their sources. Lawyers and their clients. Doctors. Whether an immunity applies is a question somebody has to notice, and the notification may not reach anybody in a position to notice it. Fast enough.
And none of this replaces the CLOUD Act. It's still there. European data now has two doors instead of one.
To be fair
The European Investigation Order runs on a 120 day deadline, mutual legal assistance on nothing you could plan around, and evidence that sits on a server in a neighboring country was often just gone by the time the request cleared.
Prosecutors have been asking for this for a decade. The three year threshold is a limit that holds. So is keeping content data behind a higher bar than subscriber data, and the refusal grounds are more than most cross-border regimes come with.
You can think the old process was unusable and still think this version gave away too much. Both things fit.
The Bottom Line
I've spent a fair bit of the last two years writing that Europe should run its own infrastructure, and I still think that. Nothing here changes it.
But the worry underneath those articles is not the flag on the company. It is how few steps stand between an authority and my data, and how little I'd hear about it.
From Tuesday, there are fewer steps inside Europe too.
Is a European prosecutor better than an American one? Don't know. Maybe.. Is that what we meant by sovereignty? I highly doubt it...
If you're not already, follow me on Medium.