A US federal appeals court has ruled in favor of Microsoft in a major privacy case related to whether the government can demand access to data stored on servers outside the country.
The decision reverses a court order from 2014 requesting that the computing giant hand over emails stored in Ireland for use in a drugs case.
Judge Susan Carney of the US Court of Appeals for the Second Circuit in New York ruled that the Stored Communications Act only applies to data stored in the US.
Microsoft had argued that if the government got its way in the case, it could open the floodgates for foreign agents to raid its offices in jurisdictions all over the world and demand access to US citizens’ data.
"The decision is important for three reasons,” said Microsoft president and chief legal officer, Brad Smith. “It ensures that people’s privacy rights are protected by the laws of their own countries; it helps ensure that the legal protections of the physical world apply in the digital domain; and it paves the way for better solutions to address both privacy and law enforcement needs.”
Microsoft had been supported in its legal fight by a host of Silicon Valley rivals and others, with amicus briefs filed by 28 tech and media companies, 23 trade associations and advocacy groups, 35 leading computer scientists and even the Irish government.
Smith called for changes to the law both domestically and in terms of new international treaties to avoid such problems in the future.
Omer Tene, VP of research and education at the International Association of Privacy Professionals (IAPP), welcomed the ruling as a “resounding affirmation of the endurance of privacy in an age marked by constant data transfers in the cloud, Internet of Things and big data applications.”
“The Court held that even in the cloud, data physically resides on servers in a specific geography, and that government cannot compel a service provider to reach over national borders to deliver data at the expense of customer privacy,” he added.
Guy Marson, co-founder of data science company Profusion, argued that the court’s ruling was in line with the European Commission’s views on privacy, but warned that an appeal from the US government is a certainty.
“If the case is overturned yet again, the resulting shockwaves across the tech industry will set the sector back several years,” he added. “Any future rulings will especially affect cloud providers, calling into question the security of cloud computing platforms. It will also place the already embattled Privacy Shield on rocky ground.”