Cloud data: Microsoft torn between European law and U.S. law

Ordered to deliver data hosted in Europe, Microsoft is caught between two fires: the European law and the U.S. law. The editor seems to be in a legal limbo.

 

As part of a qualified criminal investigation, the U.S. Justice began by asking Microsoft to deliver data from one or several mails. Problem: these data are stored in one of its European data centers, and therefore not on American soil.

 

In the United States, the Patriot Act should solve this problem and force Microsoft to cooperate wisely. However, to settle in Europe, Microsoft must also meet the definition of a legal framework for the provision of cloud computing services prepared by the G29 (Group of European data protection authorities, which is part CNIL).

 

In the case involving Microsoft, a rebound took place last week a federal judge in New York, James C. Francis, made an important decision: it requires U.S. companies to provide data even if they are hosted outside the United States. The criminal nature of the investigation justifies his eyes such a measure.

 

Alerted, the G29 leaned repeatedly on Contracts for Microsoft. "European data protection authorities united in the G29 have found that the documents were in line with EU requirements defined in these terms," wrote the G29. He further explains that "only recognizes that Microsoft has taken enough precautions to guide its contractual international data flows, in accordance with Article 26 of Directive 95/46/EC."

 

He recalled "all the cloud providers that offer their services to customers subject to European law, it is their duty to ensure compliance with their contractual arrangements with the EU requirements in protection of data, taking due account of the opinion 05/2012 G29 on cloud computing. "