The Microsoft-Ireland Case is Moot

We covered this before here and here.

But the high-profile case of United States v. Microsoft Corporation is now over. The question was whether the government could force Microsoft to turn over data that it stored on servers in other countries. The problem was that federal law didn’t allow the government to do that, or at least it wasn’t clear. So Microsoft challenged the government. It lost in the trial court, won on appeal, and landed before the U.S. Supreme Court last fall.

The Supreme Court heard the case in February, but in March, the new federal spending bill changed everything. It included a law called the CLOUD Act, which stands for Clarifying Lawful Overseas Use of Data.

Under the new law, companies like Microsoft must produce data in their possession, custody, or control even if it’s located outside the United States. They may object if they reasonably believe that a target is not from the U.S. and that, by producing the data, they will break the laws of a “qualifying foreign government.” That means a government with which the U.S. has agreed to grant reciprocal access to such data for use in criminal cases. But there are no agreements yet. To get there, a foreign government must, among other things, not target U.S. persons, and it must be committed to due process, data privacy, free speech, and other civil rights and liberties.

Within a week of the new law, the U.S. moved to dismiss the case as moot.

A few days later, Microsoft agreed. For the full text of the CLOUD Act, see here, and scroll all the way down to page 866. For the company’s detailed statement on the new law, see here.

And so the trilogy is complete.