Background

On 3 October 2019, the United States and United Kingdom announced that they had concluded an agreement that will facilitate the transfer of data in criminal investigations by communications providers between the two jurisdictions without the need to negotiate the often cumbersome and slow mutual legal assistance treaty (MLAT) process.[1] The text of the agreement was released on 7 October 2019.  The agreement should increase the speed and efficiency of investigations into allegations of serious crime and allow communications providers the ability to cooperate with international law enforcement investigations without fear of breaching national laws on data protection.

In March 2018, the United States passed the Clarifying Lawful Overseas Use of Data Act (the CLOUD Act), which was intended to allow US authorities to make requests for information about US persons directly to communications providers located abroad (read our article on the CLOUD act here).[2] It was passed in response to what has become known as the “Microsoft Ireland” problem: Microsoft was requested by the US authorities to provide email communications about a US person, but the email communications were held on a server in Ireland. Microsoft argued that the US warrant could not require access to data held overseas as a matter of US law, and also noted that if the US warrant could require   such access, there was the potential for conflict with European law on data protection. The US authorities could potentially have obtained the data through the MLAT process, but this would have been a considerably longer procedure than having Microsoft provide it directly in response to a US warrant.

The solution alighted upon by the US Government was the CLOUD Act, which explicitly permits the US Government to seek data pursuant to a US warrant no matter where in the world it is located. To address the potential conflict of laws issue raised by Microsoft and other communications providers, the CLOUD Act also provided authority for the US Government to enter into agreements with foreign governments for the reciprocal provision of access to electronic evidence directly by communications providers. It was widely reported at the time that the United Kingdom Government was keen to be the first jurisdiction to enter into such an agreement, and so it has transpired.

In order to permit such an agreement to be made legally, the United Kingdom passed the Crime (Overseas Production Orders) Act 2019 (the OPO Act) in February 2019. The OPO Act creates the framework in UK law that allows reciprocal agreements for the obtaining of evidence in criminal investigations, without the use of the MLAT procedure, possible.

What does the agreement do?

The agreement provides for US authorities to issue warrants for the provision of evidence to communications providers in the United Kingdom, and for it to be permissible for the communications provider to deliver that evidence directly to the US authorities. Similarly, it allows the UK courts to make orders for the provision of evidence from US communications providers directly.

There are a number of interesting features of the agreement.  In particular, the agreement contains a commitment from both countries to obtain permission from the other before using data obtained in prosecutions “relating to a Party’s essential interest – specifically, death penalty prosecutions by the United States and UK cases implicating freedom of speech.” The requirement that there be permission sought from the United Kingdom before evidence is used in death penalty cases is a specific requirement of any international agreements concluded pursuant to the OPO Act because of the differing stance on capital punishment between the two countries.[3]  

In addition, it is a requirement that the US must, when requesting information from the UK about someone who is reasonably believed to be outside of the US, notify the third country government where the person is believed to be located.  The same is true when the UK is requesting information about someone located in a third country.  There is an exception to this procedure if such a notification would be detrimental to the investigation, operational or national security, or human rights.  This is an important concession to the interests of other countries and their residents’ rights.

Next steps

The US Attorney General is required to submit the agreement to the Senate and House Judiciary Committees, the Senate Committee on Foreign Relations and the House Committee on Foreign Affairs. Unless Congress enacts a joint resolution of disapproval as provided for in the CLOUD Act, the agreement will become effective from a US perspective 180 days later.

In the United Kingdom, the Home Secretary will be required to produce regulations (a form of secondary legislation that can be made by the Executive) to designate the agreement as a “relevant international agreement” for the purposes of section 52 of the Investigatory Powers Act 2016. This is the enactment that permits communications providers to intercept communications at the request of a foreign authority. Once that has occurred, the agreement will be effective as a matter of UK law once it is also effective in the United States.

What are the implications for telecommunications providers?

Communications providers in the United States and the United Kingdom will, once the agreement comes into force on both sides of the Atlantic, begin receiving some requests for evidence directly from the authorities that require it, rather than via the MLAT process. There may be some teething difficulties whilst providers become accustomed to the form of request that is issued by US and UK authorities respectively. There may also be an initial uptick in requests, as authorities seek to have requests that have already been made through the MLAT procedure, but have not yet been fulfilled, completed via the new CLOUD Act/OPO Act procedure.

Will there be other agreements?

In September 2019, the United States and the European Union met to begin discussions concerning a similar CLOUD Act agreement.[4] Such an agreement may take longer to negotiate than the US-UK agreement, because of the probable differences of opinion between some of the remaining 27 Member States of the European Union.[5] In addition, on 7 October 2019, the US Department of Justice announced that it is in negotiations with the Australian Government to conclude a CLOUD Act Agreement.[6]  There is clearly political will in a number of jurisdictions to come to an agreement with the United States and promote continued cooperation in the investigation of cross-border crime.