World Association of Newspapers and News Publishers

US government not allowed to access emails stored outside the country, court rules

World News Publishing Focus

World News Publishing Focus
Your Guide to the Changing Media Landscape

US government not allowed to access emails stored outside the country, court rules

According to the US Second Circuit Court of Appeal’s ruling in July 2016, the US government cannot pursue a warrant under the Stored Communication Act (SCA) in order to ask a US-based company to produce communications, such as emails, when they are physically stored outside the territorial boundaries of the US.

The Court seems to have applied the traditional and well-established legal principle of presumption against extraterritoriality, according to which US laws do not apply beyond the national territory unless otherwise specified by the Congress. Microsoft’s data in question was also stored in Dublin and therefore fell under the jurisdiction of another sovereign nation. The court considered it irrelevant that the the plaintiff was an American company and that data were accessed from a US workstation. 

This decision reassures those US companies that provide stored communication services on a global basis. The Court’s decision does not specify how the SCA provisions apply when the data stored abroad relates to US citizens or residents, Lexology notes.

The right to privacy seems to have won this round since under the ruling private companies’ data remains safe from any government’s order of compliance, according to David Williams

Brad Smith, chief legal officer of Microsoft, declared that: “What we saw when we really looked at all the search warrants that we were getting in the United States was that a distressingly high number had secrecy orders that literally last forever. So over 18 months we’ve received over 2,000 of these orders with these perpetual secrecy orders. And that struck us as disproportionate to the issues at hand, and the need for secrecy. We definitely appreciate that there are cases where there is a need for secrecy. I think we can question whether secrecy needs to last forever.” the Irish Times reports. 

The approach adopted by the US Court in this case seems to have departed from the European approach to the extraterritorial application of data protection. In the EU legislation, the physical location where data is stored is irrelevant. EU law is applied when the data controller is based in the EU or, in the case of a non-EU company, has an establishment in the EU. The new Data Privacy Regulation, approved in May 2016 and entering into force in 2018, has broaden the scope of application of the EU data protection law also when the processing activities are related to the offering of goods and services to data subject in the EU or to the monitoring of their behaviour. 

The US government is likely to appeal the ruling to the US Supreme Court. Nevertheless, the US Congress is currently working on a new bill intended to solve the issue of unclear legislation in the case data is stored outside the US.

UPDATE 24.1.2017: The US appeals court refused to reconsider its decision, letting the July ruling stand, Reuters reported.


Ilaria Fevola


2016-10-28 15:14

Author information

The news publishing industry is experiencing transformation at an ever-growing pace, with new policy issues arising as the landscape changes.

We will be examining policy discussions that will define the news publishing environment of the future, the key topics being internet governance, privacy and copyright. Click here to learn more about our work.

WAN-IFRA Media Policy team and experts.

© 2020 WAN-IFRA - World Association of News Publishers

Footer Navigation