banner generic


Information Technology Alert

Microsoft ordered to comply with US warrant regarding data hosted in Ireland

| Published by Craig Subocz, Andrew Chalet

On 31 July 2014, US District Court Judge Loretta A. Preska, in Manhattan, ordered Microsoft to turn over to the US Department of Justice emails stored on a Microsoft-controlled server located in Ireland under a US search warrant.

Microsoft argued that email stored in its cloud is and remains the user’s property.  Microsoft also argued that a warrant issued in the US could not reach beyond the jurisdiction of the US courts to a server located outside the USA. 

In rejecting Microsoft’s argument, Judge Preska held that the servers’ location was irrelevant because Microsoft controls its servers from the USA.  Judge Preska found that: “Congress intended... for ISPs to produce information under their control, albeit stored abroad, to law enforcement in the United States… it is a question of control, not a question of location of that information”.

Microsoft will appeal Judge Preska’s decision, and Judge Preska stayed her orders until the appeal is determined.

Organisations bound by the Australian Privacy Principles (“APPs”) must comply with APP 8 when disclosing personal information about an individual to an overseas recipient.  Except in certain situations, APP 8 requires the disclosing entity to take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information. 

This requirement does not apply if the disclosing party reasonably believes that the recipient is subject to a law that has the effect of protecting information in a way that, overall, is at least substantially similar to the way in which the APPs protect the information and the individual can access mechanisms to enforce the protection of that law. 

It also does not apply when the individual consents to the disclosure, provided that the disclosing entity expressly advises the individual that if he/she consents to the disclosure of information to the overseas recipient, APP 8’s requirement would not apply.

Whether uploading data into the cloud provided by an overseas provider constitutes a “disclosure” under APP 8 depends on numerous factors.  

Organisations planning to use cloud computing should consider the impact of the APPs on its business and weigh up the cost of compliance with APP 8 against the benefits derived from moving systems into the cloud.

For further information about Judge Preska’s decision, the APPs and legal issues regarding the use of cloud computing, please contact Andrew Chalet or Craig Subocz.