In the United States, a recently approved federal law also raises interesting
questions concerning sovereignty in cyberspace. In 2018, the Clarifying Lawful
Overseas Use of Data Act (hereinafter CLOUD Act) was enacted in order to amend
the SCA. The Cloud Act allows federal law enforcement agencies to issue a warrant
to electronic communications service providers based in the United States in order to
demand the provision of data stored in any server they own and operate, regardless
of whether the data are stored in the United States or on foreign soil. In the event that
these service providers believe that the request violates the laws of the foreign
country where the data are stored, the Cloud Act provides for a mechanism to
facilitate the interaction with the foreign country, through executive agreements, as
an alternative to the usually slow process followed under a mutual assistance, treaty
(hereinafter MLAT). The standard mechanism used in a context of cross-border law
enforcement, in order to request data or aid in data discovery in a foreign country,
consists in resorting to informal mutual legal assistance or to formal MLAT, which
requires the consent, on equal terms, of the countries involved. Under the Cloud Act,
even if the electronic communications service provider considers that the request of
the federal law enforcement agency violates the law of the country where the data is
stored, the alternative mechanisms should consist of those set forth in the United
States’ law.
3.4 Data Protection and Electronic Surveillance for Security
and Defense Purposes
Restrictions to personal data protection for security and defense purposes are one of
the most complex topics in this field. The difficulties in determining the proper
balance between the values at stake have given rise to intensive debate.
The European Union’s legislation does not provide guidance on this subject,
since it falls outside its jurisdiction.
135 It is up to each Member State to enact its
national legislation in this respect, without an obligation to reach harmonization in
the Union. For this reason, national legislation differs also in this part of the globe.
In the Czech Republic, for example, a bill is pending to amend the Act on Military
Intelligence, which, if approved, shall allow the military intelligence to access traffic
data, upon previous authorization from the court.
136
In Portugal, the Security Information Service and the Strategic Defense Information Service may, under determined circumstances, gain access to banking and tax
data, data on communication traffic, locality or other data connected with
communications.
137
135 See the European Union Special Report, Sect. 3.4.
136 See the Czech Republic National Report, Sect. 5.
137 See the Portuguese National Report, Sect. 3.
28
D. Moura Vicente and S. de Vasconcelos Casimiro
questions concerning sovereignty in cyberspace. In 2018, the Clarifying Lawful
Overseas Use of Data Act (hereinafter CLOUD Act) was enacted in order to amend
the SCA. The Cloud Act allows federal law enforcement agencies to issue a warrant
to electronic communications service providers based in the United States in order to
demand the provision of data stored in any server they own and operate, regardless
of whether the data are stored in the United States or on foreign soil. In the event that
these service providers believe that the request violates the laws of the foreign
country where the data are stored, the Cloud Act provides for a mechanism to
facilitate the interaction with the foreign country, through executive agreements, as
an alternative to the usually slow process followed under a mutual assistance, treaty
(hereinafter MLAT). The standard mechanism used in a context of cross-border law
enforcement, in order to request data or aid in data discovery in a foreign country,
consists in resorting to informal mutual legal assistance or to formal MLAT, which
requires the consent, on equal terms, of the countries involved. Under the Cloud Act,
even if the electronic communications service provider considers that the request of
the federal law enforcement agency violates the law of the country where the data is
stored, the alternative mechanisms should consist of those set forth in the United
States’ law.
3.4 Data Protection and Electronic Surveillance for Security
and Defense Purposes
Restrictions to personal data protection for security and defense purposes are one of
the most complex topics in this field. The difficulties in determining the proper
balance between the values at stake have given rise to intensive debate.
The European Union’s legislation does not provide guidance on this subject,
since it falls outside its jurisdiction.
135 It is up to each Member State to enact its
national legislation in this respect, without an obligation to reach harmonization in
the Union. For this reason, national legislation differs also in this part of the globe.
In the Czech Republic, for example, a bill is pending to amend the Act on Military
Intelligence, which, if approved, shall allow the military intelligence to access traffic
data, upon previous authorization from the court.
136
In Portugal, the Security Information Service and the Strategic Defense Information Service may, under determined circumstances, gain access to banking and tax
data, data on communication traffic, locality or other data connected with
communications.
137
135 See the European Union Special Report, Sect. 3.4.
136 See the Czech Republic National Report, Sect. 5.
137 See the Portuguese National Report, Sect. 3.
28
D. Moura Vicente and S. de Vasconcelos Casimiro