Schrems II and the CLOUD Act: which law reaches your data.
Under the US CLOUD Act, a US court can order a provider under US law to hand over data it controls, wherever that data is stored.
18 May 2026
The Schrems II ruling (Case C-311/18) invalidated the EU-US Privacy Shield framework because US surveillance law could reach the personal data of Europeans once it was transferred, without limits or remedies the Court found equivalent to EU law. The Court wrote:
“Section 702 of the FISA does not indicate any limitations on the power it confers to implement surveillance programmes for the purposes of foreign intelligence or the existence of guarantees for non-US persons potentially targeted by those programmes.”
In July 2023 the European Commission adopted a new adequacy decision, the Data Privacy Framework between the EU and the US. On 3 September 2025 the EU General Court dismissed a challenge to it in Latombe v Commission, and that ruling has been appealed to the Court of Justice.
The CJEU was applying European data-protection law to one cross-border arrangement, and the same question can be asked of any two countries. The US CLOUD Act of 2018 raises a parallel question. Under it, a provider of electronic communication or remote computing services that is subject to US jurisdiction must, when served with a US warrant or order, produce data in its possession, custody or control, “regardless of whether such communication, record, or other information is located within or outside of the United States” (18 U.S.C. §2713). The law applying to the vendor and the law applying to the data location can be different, and counsel needs to evaluate which is which.
France’s national cybersecurity agency, ANSSI, codified the same distinction in its SecNumCloud requirements: section 19.6, « Protection vis-à-vis du droit extra-européen », makes independence from legal regimes outside the EU a binding criterion for qualified cloud providers.
What Mandate does
Mandate Systems Inc. is a Canadian company. It checks each message before it reaches an AI vendor, so a message your rules refuse never reaches that vendor.
Sources
-
CJEU Case C-311/18: Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems
Full judgment, 16 July 2020. Court of Justice of the European Union.
-
ANSSI SecNumCloud requirements, version 3.2
French national cybersecurity agency. Section 19.6, « Protection vis-à-vis du droit extra-européen », is a binding criterion for qualified cloud providers.
-
Clarifying Lawful Overseas Use of Data Act (CLOUD Act), 18 U.S.C. §2713
The statute’s text, with the words quoted above.
-
Case C-703/25 P: the appeal against the General Court’s judgment in Latombe v Commission
Official Journal notice of the appeal brought on 31 October 2025 against the judgment of 3 September 2025 in Case T-553/23, which dismissed the challenge to the 2023 adequacy decision.
More reading notes
-
CB Financial Services 2026: an SEC filing over customer data put into an AI app the bank had not approved
19 October 2026CB Financial Services told the SEC that customer names, Social Security numbers and dates of birth were handled with an AI application the bank had not authorized.
-
EY 2026: 47% say their AI governance process was skipped for urgent deployments
18 October 202698% of the 202 US senior AI executives EY surveyed say their company has formal AI governance policies in place, and 47% say the process was skipped for urgent deployments.
-
OWASP 2026: misuse of an AI agent’s identity and access is a top threat
9 June 2026The OWASP security project lists misuse of an agent’s identity and access among the ten highest-impact threats to AI agents, and recommends each agent get its own identity.
-
NTT DATA 2026: what the companies furthest ahead with AI prioritize in governance
9 June 2026Of the companies furthest ahead with AI in NTT DATA’s survey of 2,567 executives, 59.4% named data privacy or sovereignty across countries a top governance concern, against 49.6% of those furthest behind.
-
University of Queensland and MIT 2026: which sectors are most exposed to AI risk
8 June 2026A panel of 272 experts judged information, finance and national security the sectors most exposed to AI risk, and the authors write that the standards and enforcement AI needs are still forming or missing.
-
IBM 2026: 18% of Canadian organizations say they have systems to govern AI across everyday operations
8 May 2026In an IBM Institute for Business Value study, 18% of Canadian organizations said they have systems to coordinate and govern AI across everyday operations.
-
United States v. Heppner: documents a defendant made with an AI tool, not at a lawyer’s direction, were not privileged
30 April 2026A US federal court found that documents a defendant made with an AI tool, not at a lawyer’s direction, were not privileged.
A free AI acceptable use policy template, written for Canadian privacy law and ready for your lawyer to adapt wherever you operate. Get the template