I've been following a case the Department of Justice brought against Microsoft for about a year and a half now. The issue? The DoJ subpoenaed Microsoft for customer email data. The catch was the email data was stored in a data center in Ireland, so Microsoft said no.
Initially one would think that this is easy --the data is in Ireland, so it is subject to Irish data governance laws, right? It's an issue of data sovereignty -- that data treatment is governed by the laws of the country in which it is located. But a district court judge ruled in July 2014 - two full years ago - that because the data was managed and controlled from the good old USA, and could be retrieved by someone here, that it is indeed subject to US law - it is a matter of where it is managed from, not stored.
This ruling stirred up a firestorm, and many tech companies, like Apple and AT&T, (the ACLU even jumped in), filed briefs in support of Microsoft's position.
Imagine -- Microsoft was in a no-win situation. No matter how it responded it was breaking a law in one of the two countries. The company was even found in contempt because it did not turn over data when ordered to.
Privacy, the Internet and Cloud Computing
But on July 14, the federal appeals court unanimously overturned the original decision. It ruled that data stored in Ireland is "beyond the reach of domestic search warrants issued under the stored communications act, a 1986 federal law."
That's good news -- but the entire case just illustrates how far behind we are when it comes to dealing with privacy and the Internet. It's not just this case - last year the European safe harbor agreement, which dictated how privacy protection standards were to be enforced in order to transfer personal data of European citizens to the US, was nullified, again showing how laws have not kept up with technology.
Privacy and security are not my domain of expertise - I'll leave that to Jon Oltsik and Doug Cahill to discuss. But the legal landscape certainly impacts the cloud world where I live, from hybrid cloud solutions to file sync and share. The uncertainty of the legal landscape causes issues when it comes to where companies are comfortable storing their data. And if the courts had ruled against Microsoft, there probably isn't a single company outside of the USA that would do business with a US-based cloud services provider. Thankfully, that didn't happen.
Terri McClure is a senior analyst at ESG, an integrated IT research, analyst, strategy and validation firm. Read more ESG blogs here.
