On July 14, 2016, a US appellate court held that Microsoft could not be compelled to produce customer emails stored on servers located in Ireland. In a ruling heralded as a victory for privacy rights, the court held that warrants or subpoenas issued under the Stored Communications Act (SCA) have no extraterritorial application and thus cannot compel the production of data stored outside the US.

In re A Warrant to Search a Certain E-Mail Account Controlled & Maintained by Microsoft Corp. Microsoft Corp. v. United States, No. 14-2985, 2016 U.S. App. LEXIS 12926 (2d Cir. 2016), the Second Circuit Court of Appeals (2nd Circuit) overturned a district court order that required Microsoft to comply with a warrant issued under the SCA. The case has been of keen interest to the U.S. technology industry and media in light of the potential implications of the decision to their overseas businesses, as well as concerns that foreign governments would emulate the US long-arm jurisdiction. Apple, Amazon, the Electronic Frontier Foundation, CNN and The Washington Post were signatories to amicus briefs filed in the case. Microsoft's position was also supported by the Irish Government.

The SCA is part of the Electronic Communications Privacy Act (ECPA). Enacted in 1986, the ECPA "updated the Federal Wiretap Act of 1968, which addressed interception of conversations using `hard' telephone lines, but did not apply to interception of computer and other digital and electronic communications." Microsoft, a US corporation, operates a free public e-mail service that is currently branded as "Outlook.com." On December 4, 2013, the US District Court for the Southern District of New York issued a warrant to Microsoft at the request of the US government. The warrant demanded that Microsoft produce the contents of a specific "outlook.com" e-mail account. After determining that the account contents were located at its Dublin Datacenter, Microsoft moved to quash the warrant. That motion was denied by a District Court Magistrate Judge, who concluded that "Microsoft was obligated to produce the customer's content, wherever it might be stored." The Magistrate's decision was affirmed by the Chief Judge of the District Court.

On appeal, the 2nd Circuit reversed the District Court's denial of Microsoft's Motion. The court ruled that "Congress did not intend the SCA's warrant provisions to apply extraterritorially," and that the "SCA does not authorize a US court to issue and enforce an SCA warrant against a USbased service provider for the contents of a customer's electronic communications stored on servers located outside the United States."

Therefore, the warrant could not lawfully be used to compel Microsoft to produce to the government the contents of the account stored exclusively in Ireland. The 2nd Circuit also noted that the focus of these provisions was the protection of a user's privacy interests.

The 2nd Circuit considered that the interests of international comity had to be taken into account and that the government could have relied on procedures under the Mutual Legal Assistance Treaty (MLAT) between the US and Ireland.

"Our conclusion today [] serves the interests of comity that, as the MLAT process reflects, ordinarily govern the conduct of crossboundary criminal investigations ... [and] we find it difficult to dismiss [comity] interests out of hand on the theory that the foreign sovereign's interests are unaffected when a United States judge issues an order requiring a service provider to `collect' from servers located overseas and `import' into the United States data, possibly belonging to a foreign citizen, simply because the service provider has a base of operations within the United States."

Although the decision of the three-judge panel was unanimous, Judge Lynch's concurring opinion took the view that "the dispute here is not about privacy, but the international reach of American law," and he urged the US Congress to take action to clarify the extraterritorial reach of the SCA and update the 1986 statute to reflect the reality of the internet.