The CLOUD Act and the GDPR: what hosting in Ireland does not settle

A supplier tells you your data is hosted in Ireland. Your data protection officer ticks a box, perhaps without much enthusiasm. Everyone moves on.

That box is worth less than it looks, for a reason that is simple and rarely spelled out.

What the CLOUD Act says

The Clarifying Lawful Overseas Use of Data Act, enacted in the United States on 23 March 2018, settled a question American courts had been arguing over: can a US authority compel an American company to hand over data it holds abroad?

The answer is yes. An American supplier must produce the data in its possession, custody or control when it receives a proper order, wherever that data is stored. The US Department of Justice explains it itself in a 2019 white paper.

The address of the server is what used to count. The CLOUD Act made the nationality of the company the thing that counts.

What data residency gives you

"Data residency", the term your suppliers use, means a commitment that your data is stored in a given region. Nothing in the word says which one: the same promise is sold for Oregon. We are talking here about the case where that region is European.

European residency, then, means the data physically sits in European data centres. That reduces latency, satisfies contractual clauses that impose a location, and helps with the GDPR's transfer rules. It also means routine access by the supplier's staff happens from inside the EU.

For a great many organisations that really is enough. If you are a design agency storing project notes, European residency is proportionate to the risk and you can stop reading here.

Where European residency stops being enough

The gap opens when the data is sensitive enough that the question is no longer "where is it?" but "who, in the last resort, can be compelled to produce it?"

A supplier incorporated in the United States answers to American law everywhere it operates. Its Irish subsidiary remains under its control. The GDPR says one thing about disclosure to a foreign authority, the CLOUD Act says another, and the supplier is caught between the two. Which law it must ultimately follow is not a question your contract settles.

That is the tension that brought down the two previous arrangements. Safe Harbour was invalidated in 2015 by the Court of Justice of the European Union (Schrems I, C-362/14), then Privacy Shield in turn on 16 July 2020 (Schrems II, C-311/18). The Court pointed in particular to American surveillance powers under section 702 of FISA and executive order 12333, and to the absence of effective redress for the people concerned.

The Data Privacy Framework, in force since 10 July 2023, is what manages that tension today. "Manages" is the right word: it is the third arrangement in the series, the two before it fell, and a challenge to this one was announced as soon as it was adopted. The European Data Protection Board publishes a FAQ for European businesses.

Treating it as settled for good is an assumption, and the saga looks far from over (in French).

In practice, the simplest way to be legally in order remains to choose European software that hosts the data in a European provider's data centre, or on your own servers. What "European" actually covers, and how to check it, is the subject of a survey of the suppliers.

What this changes in practice

Four cases where the distinction stops being theoretical.

Citizens' records held by a public body. Civil registry, social services, enforcement. The citizen did not choose the supplier and cannot opt out of it.

Tenders and contracts. Commercially sensitive, sometimes legally restricted, with a duty of confidentiality the authority cannot delegate.

Regulated data. Pharmaceutical validations, clinical data, safety inspections, anything a regulator can demand.

Anything touching national security. Critical infrastructure, defence suppliers, energy. There, the question is usually settled for you by somebody else.

If your data falls into none of these categories, European residency is probably proportionate. If it falls into one of them, residency alone does not answer the question your legal team will eventually ask.

The question to put to a supplier

Just one, and it is short.

Under which country's law does your company operate?

Not where the data is. Not who the subprocessor is. But under which law the company operates, meaning the legal entity that holds the keys to the software you bought.

I have asked it often enough to have noticed one thing: when the answer is simple, it fits in a sentence. When it starts getting longer, that is already the answer. Everything else in a supplier questionnaire is detail somewhere along the way.

Writing all of this into a contract, with the subprocessors, the exit, the notification and the change of control, is another trade. We give it a whole episode, clause by clause.

Why this subject matters to us

We may as well say it plainly: this is not a neutral subject for us.

Klaro Cards is built and operated by a Belgian company, in European data centres (Scaleway in France, Hetzner in Germany) or on your own servers where that is a requirement. We answer to Belgian and European law, and there is no American parent company above us to change that.

Which means we pass the question above, and a fair share of our competition does not. You should still put it to us rather than take our word for it, and put it to everyone else as well.

If you are reading this because Jira Data Center is being switched off and your data protection officer has started asking where things will live next, the deadline falls earlier than the announced date and the countdown lays out the dates and the prices.

This article describes a legal landscape; it is not legal advice. For a specific situation, go to somebody qualified to give it.

Sources: the CLOUD Act (Public Law 115-141, 23 March 2018) and the DOJ white paper; CJEU judgments C-362/14 (Safe Harbour, 2015) and C-311/18 (Privacy Shield, 16 July 2020); the EU-U.S. Data Privacy Framework and the EDPB FAQ for European businesses.