The USA Patriot Act probably ranks alongside Sarbanes-Oxley in terms of recognition and fear of US legislation outside the US. It is widely known that this is the means by which FBI can get access to confidential data and the reason that some UK businesses may be holding back from cloud adoption, preferring an on-premise solution. But are they right to fear the Patriot Act?
The EU data protection regime prevents the transfer of data outside the European Economic Area to a country with inadequate data protection laws or unless the recipient will provide the adequate protection. The European Commission keeps a list of safe countries. Canada and Switzerland are on this list and so is the EU-US negotiated self-regulated Safe Harbor. Most of the large US cloud providers have signed up to the Safe Harbor principles which allow them to transfer data from the EU to the US. The EU Commission is proposing to extend data protection in its proposed new data protection regulation by stating that it applies to EU data held outside the EU.
The USA Patriot Act was passed shortly after the atrocities of 11 September and served to revise and consolidate counter-terrorism laws. This includes sweeping surveillance and search powers without the need for court order. The American Civil Liberties Union has challenged the issue of “National Security Letters” which allows the FBI to collect information and to prevent anyone receiving a letter from publicising it. While they have had some success, the Act remains in force.
Impact outside the US
Keeping data in the EU is not enough. In June 2011, the managing director of Microsoft UK admitted that it would comply with the Patriot Act as its headquarters are based in the US. While it would try to inform its customers before this happens, it would not guarantee this. This means that if you do business with a UK subsidiary of a US-based cloud operator and you specify that English law applies and you choose a UK-based data centre operating under EU data protection laws, the FBI can still get access to your data. While this had already been suspected, this was the first clear affirmation and is true for any US-based cloud provider.
So what can you do?
The UK Information Commissioner has warned of the effect of the Patriot Act but has not really provided substantive guidance as to how to overcome it. Legitimate use of the US Patriot Act for anti-terrorism surveillance is likely to fall within an exemption under the existing and revised EU data protection regimes.
You can keep your data away from US organisations. This means checking your entire supplier chain to make sure that there is no US company involved in the chain and not even a back-up or failover in the US.
UK, EU and Swiss owned and based cloud service providers have used this as an opportunity to promote their cloud services based in EU or Switzerland-based data centres with no US involvement and therefore immunity from the Patriot Act.
There have been some high profile examples of this recently. The Norwegian data protection regulator has warned the public sector about use of Google Apps over fears of the Patriot Act and the Dutch government looks set to exclude US IT providers from government contracts. Also, BAE Systems revealed in December 2011 that it was all set to adopt Microsoft Office 365 but had abandoned it after its lawyers warned about the effects of the Patriot Act.
Of course, it is worth remembering that the US is not the only country with anti-terrorism legislation. For example, the UK has its Anti-terrorism, Crime and Security Act and the Regulation of Investigatory Powers Act. The Telegraph reported on the use of RIPA by councils to tackle dog fouling, the unauthorised sale of pizzas, the abuse of the blue badge scheme for disabled drivers and even to take sound recordings of noisy children.
Although this led to some tightening of these powers, the UK government still has broad powers to intercept communications and gain access to data including where it is protected by encryption or passwords. And don’t forget, the UK government shares intelligence with the US government.
Ultimately, the best way to keep data completely secure is to keep it on-premise solution. But you do have to ask yourself: is it really likely that the US or UK government will want to access your data for anti-terrorism reasons?
Frank Jennings is chair of the code governance board of the Cloud Industry Forum, co-founder of Cloud Industry Legal Forum and partner in law firm DMH Stallard LLP. frank.jennings@dmhstallard.com
