The Foreign Intelligence Surveillance Act (FISA) allows the U.S. government open access to electronic information stored by non-US citizens on US-based servers, like a host of cloud services available today. iCloud, Google Drive, Dropbox, and other popular services are all subject to this law, passed in 2008 by the Bush administration and recently re-authorized by the Obama administration for another 5 years.

What this means is that any data stored by non-American citizens on cloud servers here in the US is able to be looked at in entirety by various agencies in the US federal government, including the NSA, FBI, and CIA.

Caspar Bowden, Chief Privacy Adviser to Microsoft Europe for nine years until 2011, told UK-based The Independent: “What this legislation means is that the US has been able to mine any foreign data in US Clouds since 2008, and nobody noticed.”

Several posts, like this one at the Huffington Post, written around the time of the re-authorization of the FISA mention email and overseas phone calls, but do not take notice of cloud-based data.

Sophie in ‘t Veld, a Dutch MEP who serves as vice chair of the European Parliament’s civil liberties committee, told The Independent, “Let’s turn this around and imagine this is not the United States having unlimited access to our data but the government of Mr Putin or the Chinese government – would we still wonder if it’s an urgent issue? Nobody would ask that question.”

While we may imagine that the US won’t use the data for anything nefarious, we just may be too naive. Even worse, however, is the precedent this sets for countries to gather data on non-citizens via commercial services that may in the future be housed in a location other than our country of origin.

In Europe, you cannot give personally identifiable data (names, addresses etc.) to third parties without getting the written permission of the person whose data is being handed over.

However, as Big_D says, it makes it illegal for European businesses to use many services. For example, we use Microsoft 365 for email. Lots of other companies use either MS or Google too, because they offer a great service really not equalled by anyone else. We're all technically breaking the law...

Like Amnesia, I'm not too concerned about the US government reading my emails and looking at my holiday photos. I don't expect them to steal my identity, although of they could with the information available to them. I naively trust that no one working for them will do this.

However, as Big_D says, it makes it illegal for European businesses to use many services. For example, we use Microsoft 365 for email. Lots of other companies use either MS or Google too, because they offer a great service really not equalled by anyone else. We're all technically breaking the law...

I do think that the cloud providers could find that they have legal problems if they were to give company data to the US authorities but how would they know?

How would we ever know...

Same way as usual, we'll only find out when something goes badly wrong...

How would we ever know...

Unless of course they read the email from PayPal confirming my sale of nuclear weapons to Cuba, in which case I might expect a strongly worded letter from them!

MS and Google are two who use the 'safe harbour' getout. As far as I know, it's never been tested in court if that's actually good enough to comply with the EU data protection directives. MS and Google say it is, and their lawyers may believe so but we won't know for certain until its tested. Thats probably only going to happen when there's a serious breach of some sort and someone gets prosecuted and uses it as a defense.

Actually, Microsoft and Google have specifically said, that if they are faced with a Patriot Act request, they will hand over the data. That was in PC Pro and on ZDNet as well, not sure if that was summer 2012 or in 2011.

Even if they store the data on servers in Europe, if they have an office in America, they have to comply with the request and hand over the data on the European servers.

For individuals, it isn't so much of a problem, for businesses though it can be a nightmare.

That said, if you have my phone number on iCloud and I find out that Apple gave your iCloud data to the Feds, I can sue you for releasing my number without my permission.

I can't sue Apple, because they were following American law. Apple are legally not allowed to inform you that they have handed over your data. which means you don't even know you have been opened up to prosecution, until you receive a writ.