Defining the Scope of “Possession, Custody, or Control” for Privacy Issues and the CLOUD Act


With a growing number of US companies storing their electronic data across country lines, US law enforcement agencies are left with the difficult task of trying to access electronic evidence stored outside of their physical jurisdictions.

In response, Congress passed the Clarifying Lawful Overseas Use of Data Act (Cloud Act) in 2018 to provide the US government with the power to order the production of electronic evidence that is stored outside of the US if it is within a US company’s “possession, custody, or control.”

However, the Cloud Act does not define what constitutes the “possession, custody, or control” of electronic evidence, raising concerns about the scope of US authority under the Act. Through their examination of existing domestic and international jurisprudence interpreting these terms in other legal contexts, Hemmings, Srinivasan, and Swire outline the key factors courts should balance in analyzing this pivotal phrase.

By Justin Hemmings

Justin Hemmings is a research faculty member at the Georgia Tech Scheller College of Business.

By Sreenidhi Srinivasan

Sreenidhi Srinivasan is z Senior Associate at Ikigai Law, a law firm based in New Delhi, India.

By Peter Swire

Peter Swire is the Elizabeth and Tommy Chair of Law and Ethics, in the Georgia Tech Scheller College of Business and Senior Counsel, Alston & Bird LLP.

Leave a comment

Your email address will not be published. Required fields are marked *