First CLOUD Act Executive Agreement Certified to Congress
On December 4, 2019, the U.S. Department of Justice officially submitted the U.S./UK CLOUD Act Executive Agreement to Congress. The submission included the Attorney General’s certification that the United Kingdom meets the requirements under 18 U.S.C. § 2523(b) for a qualified foreign government. Under § 2523(d)(2), now that the treaty and certification have been sent to Congress, the Agreement will enter into force on June 1, 2020 unless the Congress passes a joint resolution of disapproval before that time. Nathan Swire’s Lawfare Blog article “Applying the CLOUD Act to the U.S.-U.K. Bilateral Data Access Agreement” details the requirements for an Executive Agreement under the CLOUD Act, as well as Congress’s oversight role for these agreements.
Along with copies of the treaty text and the Attorney General’s certification, the documents delivered to Congress included clarifying letters of understanding between the U.S. Attorney General and the UK Secretary of State for the Home Department, as well as the U.S. Attorney General’s support for the decision to certify the UK as a qualified foreign government. Notably, these supplemental documents include:
- A list of UK criminal laws that implicate free speech concerns that would require explicit approval from the US prior to a data transfer under the Agreement. The U.S. also has the unilateral right to supplement this list under its sole discretion.
- Acknowledgement of human rights concerns raised by experts and civil society groups during the consideration of the UK’s compliance with CLOUD Act requirements.
- A finding that the minimization procedures included in Article 7 of the Agreement satisfy the minimization procedures requirement of the CLOUD Act § 2523(b)(2).
- A section-by-section listing of the authorities supporting the decision to certify the UK. These authorities include international treaties to which the UK is party as well as findings by the U.S. State Department, Bureau of Democracy, Human Rights. The letters also refer to the Labor 2018 Country Report on Human Rights Practices in the UK, and findings by independent oversight officials like the UN High Commissioner for Refugees and the UN Committee against Torture.
While the CLOUD Act gives Congress a 180 day window in which to review the Agreement and the Attorney General’s findings, it will be up to Congress to determine the scope and nature of the review. As stated in the introduction, if Congress does not act, then the Agreement will enter into force on June 1, 2020.