The CLOUD Act resolves the central issue in United States v. Microsoft — U.S. law enforcement agencies now have explicit legal authority to obtain electronic data from U.S. cloud and communication companies regardless of where the company stores the data.

The Act includes provisions that allow U.S. cloud companies to challenge such efforts when their customer is not a U.S. citizen or resident and the disclosure would violate the law of “qualifying” countries, but the availability and efficacy of these protections are uncertain.

The CLOUD Act also proposes a legal framework for expeditious international data-sharing using executive agreements and an elaborate certification process by which countries can become “qualifying foreign governments” (QFGs). Countries that do pursue and obtain QFG status will provide greater privacy protection for their citizens and residents when their information is sought by U.S. law enforcement and will be entitled to obtain electronic data from U.S. tech companies without prior approval or oversight of the U.S. government...