ABSTRACT
In this paper, we analyse the conflict between US government production orders, on the one hand, and European data protection law, on the other. This conflict arises because US law enforcement and intelligence agencies can compel cloud providers subject to US jurisdiction to disclose customer data despite the risk that such a disclosure may place the provider in breach of the GDPR in several respects. The potential breaches include the requirement that a processor shall only process personal data on the controller’s instructions; the requirement of a lawful basis; and the principle of purpose limitation. In addition, such a disclosure might breach security requirements or involve unlawful international data transfers. We argue that these issues are not resolved by the EU-US Data Privacy Framework. Given the uncertainties, we call for a comprehensive EU-US agreement to provide a legal basis for cross-border government access.
Michels, Johan David and Millard, Christopher and Walden, Ian and Wuermeling, Ulrich, Beyond Schrems: The Unresolved Tensions between US Government Access and the GDPR (May 19, 2025).
Leave a Reply