--- title: What the US CLOUD Act  means for “Extrinsic” Managed Service Providers and Cloud Environments in The Caribbean description: Learn how the introduction of the USA's CLOUD Act has implications for extrinsic providers in the Caribbean & LATAM and how it affects your organisation. image: https://info.cloudcarib.com/hubfs/Data%20Sovereignty%20and%20Security.png --- [![Cloud Carib](https://info.cloudcarib.com/hubfs/Cloud%20Carib%202018%20Template/cloud-carib-logo-white.svg)](https://www.cloudcarib.com/) +1 800 390 2806 [Client Portal](https://www.cloudcarib.com/support/)[Contact us](https://www.cloudcarib.com/contact-us) Menu - [About us](https://www.cloudcarib.com/about-us/why-cloudcarib/) - [Services](https://www.cloudcarib.com/services/) - [Data Centre Services](https://www.cloudcarib.com/services/data-centre-services/cloud-facilities/) - [Cloud Facilities](https://www.cloudcarib.com/services/data-centre-services/cloud-facilities/) - [Virtual Data Centre](https://www.cloudcarib.com/services/data-centre-services/virtual-data-centre/) - [Managed Services](https://www.cloudcarib.com/services/data-centre-services/managed-services/) - [Network Services](https://www.cloudcarib.com/services/data-centre-services/network-services/) - [Managed Backups](https://www.cloudcarib.com/services/data-centre-services/managed-backups/) - [Professional Services](https://www.cloudcarib.com/services/data-centre-services/professional-services/) - [Security & Business Continuity](https://www.cloudcarib.com/services/security-business-continuity/managed-security/) - [Managed Security](https://www.cloudcarib.com/services/security-business-continuity/managed-security/) - [Intrusion Detection and Prevention](https://www.cloudcarib.com/services/security-business-continuity/intrusion-detection-and-prevention/) - [Disaster Recovery](https://www.cloudcarib.com/services/security-business-continuity/disaster-recovery/) - [Mobility & Productivity](https://www.cloudcarib.com/services/mobility-productivity/enterprise-mobility-management/) - [Unified Communications](https://www.cloudcarib.com/services/mobility-productivity/unified-communications/) - [Voice Services](https://www.cloudcarib.com/services/mobility-productivity/voice-services/) - [Carib365](https://www.cloudcarib.com/services/mobility-productivity/carib365/) - [Enterprise Mobility Management](https://www.cloudcarib.com/services/mobility-productivity/enterprise-mobility-management/) - [Solutions](https://www.cloudcarib.com/solutions/) - [Resources](https://www.cloudcarib.com/resources/news-centre) - [News centre](https://www.cloudcarib.com/resources/news-centre/) - Blog - [Whitepapers](https://www.cloudcarib.com/resources/whitepapers/) - [Case studies](https://www.cloudcarib.com/resources/case-studies/) - [Tools](https://www.cloudcarib.com/resources/tools/) - [Partners](https://www.cloudcarib.com/partners/) - [Our Partner Network](https://www.cloudcarib.com/partners/) - [Become A Partner](https://www.cloudcarib.com/partners/become-a-partner/) - [Refer A Client](https://www.cloudcarib.com/partners/refer-a-client/) Blog ** # What the US CLOUD Act  means for “Extrinsic” Managed Service Providers and Cloud Environments in The Caribbean ** ![USA CLOUD Act-Caribbean](https://info.cloudcarib.com/hs-fs/hubfs/Data%20Sovereignty%20and%20Security.png?width=1024&name=Data%20Sovereignty%20and%20Security.png) In March 2018, the US government passed legislation **[referred to as the CLOUD Act](http://docs.house.gov/billsthisweek/20180319/BILLS-115SAHR1625-RCP115-66.pdf)**  (Clarifying Lawful Overseas Use of Data), permitting United States law enforcement the ability to access data of any US citizen or US company hosted by USA based corporations, regardless of the jurisdiction the data resides in.   In May of 2018, the European Union (EU) passed the **[General Data](https://info.cloudcarib.com/blog/how-the-gdpr-will-affect-organisations-in-the-caribbean)****[Protection Regulation](https://info.cloudcarib.com/blog/how-the-gdpr-will-affect-organisations-in-the-caribbean)** which defines how EU citizen data should be handled both within the EU and abroad. It places a significant legal burden on “processors” and “controllers” of information, regardless of whether they operate within the EU or not.   Both sets of legislation, for different reasons, have far-reaching international impacts on the ICT business domain. However, they also present opportunities in the ICT business domain, particularly in the commercial cloud sector. The following is the first of two articles that are designed to provide an overview of both the USA CLOUD Act and the EU GDPR and how they can be "used" to grow the commercial cloud sector in the Caribbean. This first article focuses on the USA CLOUD Act.  ## Defining the CLOUD Act  The CLOUD Act is primarily concerned with getting access to data for US law enforcement purposes. It owes its origins to a legal case between the US government and the Microsoft corporation concerning the right of the US government, under the existing Stored Communications Act, to access information stored in the Microsoft cloud physically located in another jurisdiction, often referred to as **[the Microsoft Ireland case](https://blogs.microsoft.com/datalaw/initiative/legal-cases/microsofts-search-warrant-case/)**. The US authorities believed they had the right to access the information although it was physically stored in another jurisdiction. Microsoft challenged whether the existing USA laws had extra-territorial jurisdiction over the data. The legal battle went all the way to the USA supreme court. However, before the USA supreme court could rule on the case, the CLOUD Act was adopted by the US Congress and signed into law by American president Trump.  This effectively “mooted” the court case. **[Both the US government and Microsoft](https://www.supremecourt.gov/DocketPDF/17/17-2/42149/20180403145952967_180401%20for%20E-Filing.pdf)** agreed to have the case terminated at the supreme court, as both parties were satisfied that the CLOUD Act clarified the data access issue which had initiated the case in the first place.   ## The Central Aims of the CLOUD Act are to:  - allow US government authorities with access to information stored on servers operated by US-based corporations, regardless of where these servers are located (i.e. in other jurisdictions)  - provide safeguards to allow corporations the opportunity to challenge requests for information and,  - provide a mechanism for foreign governments to access information stored in the USA.  With this last point, the mechanism effectively states that the US authorities have to approve the qualification of countries who wish to get access to information stored in the USA.   This legislation co-exists with the USA Patriot, Freedom and FISA Acts, which all have clandestine elements incorporated that essentially allow US authorities to access non-USA subject information via US companies and companies operating subsidiaries in the USA, regardless of where the information is stored. Sufficing to say that if you are a US company providing international cloud services, you are subject to the CLOUD, The Patriot, Freedom and FISA Acts, making it extremely difficult, if not impossible, to say “no” to providing information to US authorities when they come knocking on the door.  Each of these major pieces of legislation offer opportunities to extrinsic managed cloud service providers and countries, such as CARICOM countries, to develop a thriving cloud services sector.  ## Where to Host Your Data: Opportunities Under the CLOUD Act   The CLOUD Act enables extrinsic managed cloud services providers (eMCSP), who are not subject to US regulation, the opportunity to truly provide data privacy for organizations residing outside of the USA. In regions such as CARICOM, it offers an opportunity for small and medium-sized eMCSPs to step up and differentiate themselves from the larger players, such as AWS, Google, or Microsoft. Regardless of where these large global players locate their cloud infrastructure or host their data, they are subject to USA legislation.  If a hosting provider has no affiliation to the US, they are not obligated to grant the US government access to data, and their only obligation is to maintain compliance with the jurisdiction of where the data is resident. Maintaining a jurisdictional understanding of data residency is now more imperative than ever before.  At the time of writing, no countries have entered into CLOUD Act agreements with the USA and only US-based hosting companies increase liability and risk for data.   The CLOUD act also presents the opportunity for more cloud and managed service providers to operate in the Caribbean and Latin America. As our CEO Scott MacKenzie mentioned in an article for **[Nearshore Americas](http://www.nearshoreamericas.com/cloud-act-impacts-and-realities-that-nearshore-stakeholders-need-to-know/)**, “One of the reasons \[Cloud Carib operates in\] this region is because the Caribbean has been trusted with people’s money for 50 years. Now, the new valuable commodity is data, so we are pushing to make it the trusted region for data, an opportunity that it is mature enough to handle.”  After all, if there are alternatives that meet the service level sophistication required, why host your data in a US-based data center or with a US-based hosting provider?  If data privacy is considered a high priority for your organization why not reduce exposure by leveraging the cloud computing services of an extrinsic provider who can guarantee your data will not traverse across borders or be susceptible to the US surveillance legislation such as the FISA, Freedom and CLOUD act?  In[** Part Two**](https://info.cloudcarib.com/blog/part-two-what-the-eu-gdpr-means-for-extrinsic-managed-service-providers-and-cloud-environments-in-the-caribbean) of the series in which we discuss Europe's GDPR and how it in turn affects the region. To stay informed subscribe to our blog, and be the first to know when Part Two is released.    [![New Call-to-action](https://no-cache.hubspot.com/cta/default/546812/904b337e-c66e-4c19-8d18-0bb85f5368dd.png)](https://cta-redirect.hubspot.com/cta/redirect/546812/904b337e-c66e-4c19-8d18-0bb85f5368dd)     ### Posts by Topic - [Cloud Computing 36](https://info.cloudcarib.com/blog/topic/cloud-computing) - [Disaster Recovery 33](https://info.cloudcarib.com/blog/topic/disaster-recovery) - [data security 32](https://info.cloudcarib.com/blog/topic/data-security) - [Cyber Security 28](https://info.cloudcarib.com/blog/topic/cyber-security) - [Caribbean 19](https://info.cloudcarib.com/blog/topic/caribbean) - [Government 20](https://info.cloudcarib.com/blog/topic/government) - [Public Sector 19](https://info.cloudcarib.com/blog/topic/public-sector) - [Cloud Security 16](https://info.cloudcarib.com/blog/topic/cloud-security) - [Data Backup 15](https://info.cloudcarib.com/blog/topic/data-backup) - [Cloud Solutions for Legal Firms 15](https://info.cloudcarib.com/blog/topic/cloud-solutions-for-legal-firms) - [Data Sovereignty 15](https://info.cloudcarib.com/blog/topic/data-sovereignty) - [Business Continuity 14](https://info.cloudcarib.com/blog/topic/business-continuity) - [Cloud Computing for Financial Institutions 14](https://info.cloudcarib.com/blog/topic/cloud-computing-for-financial-institutions) - [Security 11](https://info.cloudcarib.com/blog/topic/security) - [Managed Cloud Services 10](https://info.cloudcarib.com/blog/topic/managed-cloud-services) - [Cloud Services 9](https://info.cloudcarib.com/blog/topic/cloud-services) - [Choosing a Cloud Service Provider 8](https://info.cloudcarib.com/blog/topic/choosing-a-cloud-service-provider) - [Hurricane Season Preparation 7](https://info.cloudcarib.com/blog/topic/hurricane-season-preparation) - [Hybrid Cloud Computing 6](https://info.cloudcarib.com/blog/topic/hybrid-cloud-computing) - [Compliance 5](https://info.cloudcarib.com/blog/topic/compliance) - [Data Economy 5](https://info.cloudcarib.com/blog/topic/data-economy) - [Small Business 5](https://info.cloudcarib.com/blog/topic/small-business) - [Business Agility 4](https://info.cloudcarib.com/blog/topic/business-agility) - [COVID-19 4](https://info.cloudcarib.com/blog/topic/covid-19) - [Cloud Computing for CEOs 4](https://info.cloudcarib.com/blog/topic/cloud-computing-for-ceos) - [Multi-Factor Authentication 4](https://info.cloudcarib.com/blog/topic/multi-factor-authentication) - [Containerization 3](https://info.cloudcarib.com/blog/topic/containerization) - [Containers 3](https://info.cloudcarib.com/blog/topic/containers) - [GDPR 2](https://info.cloudcarib.com/blog/topic/gdpr) - [MFA 2](https://info.cloudcarib.com/blog/topic/mfa) - [Data Breach 1](https://info.cloudcarib.com/blog/topic/data-breach) - [Healthcare Industry 1](https://info.cloudcarib.com/blog/topic/healthcare-industry) - [SOC2 1](https://info.cloudcarib.com/blog/topic/soc2) Show more #### Get in touch with an expert, find your nearest office location, or send us a note about your next project. [Get in touch](https://www.cloudcarib.com/contact-us/) ## Recent posts From our privately owned equipment in Nassau, and through strategic global partnerships. [View all posts](https://info.cloudcarib.com/blog/all) [![USA CLOUD Act-Caribbean](https://assets.bwbx.io/images/users/iqjWHBFdfxIU/iVkwvb.BrCKs/v0/-1x-1.webp)](https://info.cloudcarib.com/blog/backups-arent-recovery-plan) [Disaster Recovery](https://info.cloudcarib.com/blog/topic/disaster-recovery) ### [The Continuity Gap: Why Backups Aren't a Recovery Plan](https://info.cloudcarib.com/blog/backups-arent-recovery-plan) [![USA CLOUD Act-Caribbean](https://info.cloudcarib.com/hs-fs/hubfs/All%20Hands/Backup%20And%20Running/Pegasus.png?width=370&height=245&name=Pegasus.png)](https://info.cloudcarib.com/blog/from-eurostack-to-caribstack) [Government](https://info.cloudcarib.com/blog/topic/government) ### [From EuroStack to CaribStack: How the Caribbean Can Build Digital Sovereignty](https://info.cloudcarib.com/blog/from-eurostack-to-caribstack) [![USA CLOUD Act-Caribbean](https://info.cloudcarib.com/hs-fs/hubfs/The-Storm-Proof-State-How-the-Bahamas-Built-a-Sovereign-Cloud-Against-the-Odds.webp?width=370&height=245&name=The-Storm-Proof-State-How-the-Bahamas-Built-a-Sovereign-Cloud-Against-the-Odds.webp)](https://info.cloudcarib.com/blog/the-storm-proof-state-how-the-bahamas-built-a-sovereign-cloud-against-the-odds) [Government](https://info.cloudcarib.com/blog/topic/government) ### [The Storm-Proof State: How the Bahamas Built a Sovereign Cloud Against the Odds](https://info.cloudcarib.com/blog/the-storm-proof-state-how-the-bahamas-built-a-sovereign-cloud-against-the-odds) #### Sign up for our newsletter and get great content delivered straight to your inbox. Cloud Carib - [About us](https://www.cloudcarib.com/about-us/why-cloudcarib/) - [Services](https://www.cloudcarib.com/services/) - [Solutions](https://www.cloudcarib.com/solutions/) - [Resources](https://www.cloudcarib.com/resources/news-centre) - [Partners](https://www.cloudcarib.com/partners/) - [Contact Us](https://www.cloudcarib.com/contact-us/) Data centre services [Facilities](https://www.cloudcarib.com/services/data-centre-services/cloud-facilities/) [Virtual Data Centre](https://www.cloudcarib.com/services/data-centre-services/virtual-data-centre/) [Managed Services](https://www.cloudcarib.com/services/data-centre-services/managed-services/) [Network Services](https://www.cloudcarib.com/services/data-centre-services/network-services/) [Managed Backups](https://www.cloudcarib.com/services/data-centre-services/managed-backups/) [Professional Services](https://www.cloudcarib.com/services/data-centre-services/professional-services/) Security & Business Continuity [Managed Security](https://www.cloudcarib.com/services/security-business-continuity/managed-security/) [Intrusion Detection and Prevention](https://www.cloudcarib.com/services/security-business-continuity/intrusion-detection-and-prevention/) [Disaster Recovery](https://www.cloudcarib.com/services/security-business-continuity/disaster-recovery/) Mobility & Productivity [Unified Communications](https://www.cloudcarib.com/services/mobility-productivity/unified-communications/) [Voice Services](https://www.cloudcarib.com/services/mobility-productivity/voice-services/) [Carib365](https://www.cloudcarib.com/services/mobility-productivity/carib365/) [Enterprise Mobility Management](https://www.cloudcarib.com/services/mobility-productivity/enterprise-mobility-management/) © 2018 Cloud Carib | Designed and Developed by [okto.](https://www.oktodigital.com/) Facebook Twitter LinkedIn