Following a New York federal judge’s ruling last year that a warrant issued under the Electronic Communications Privacy Act (ECPA) could reach private content stored in data centers outside of the United States, Microsoft has asked the U.S. Court of Appeals for the Second Circuit to limit the warrant request and reach of the ECPA only to data stored domestically. The outcome of the appeal, which may ultimately head to the U.S. Supreme Court, could have lasting implications for the cloud-computing industry.

The case originated with a request from the government to retrieve records from an account on Microsoft’s Web-based email system. Microsoft turned over address book information and other records stored in U.S. data centers but refused to retrieve email stored offshore in Ireland. Microsoft requested that the government comply with the processes set forth in the U.S.-Ireland Mutual Legal Assistance Treaty (MLAT), but a magistrate judge determined that the ECPA “does not implicate principles of extraterritoriality.” The judge further found that the MLAT process would be too “burdensome and uncertain” for Congress to have intended that the government use it. The magistrate ordered Microsoft to turn over all requested data, even data stored overseas.

After a circuit court judge affirmed the magistrate’s decision, European Union officials voiced their concerns regarding the ruling’s effect on international privacy regulations and the reach of the U.S. government into foreign affairs. In its appeal, Microsoft highlighted this issue. “To avoid international discord,” Microsoft stated in its brief in the current appeal, “courts presume that federal statutes do not apply extraterritorially unless Congress expresses a clear intent for them to do so. Congress, however, gave no indication in ECPA that it intended to authorize federal and local police to commandeer service providers to execute searches and seizures of private emails located in foreign countries.”

As the case sits before the Second Circuit, numerous leading cloud providers have filed amicus briefs that side with Microsoft, and Microsoft has asked Congress to clarify its intentions with respect to overseas data centers. Meanwhile, companies that use cloud services should watch this case because its outcome could affect data-storage plans. If Microsoft loses its appeal, companies subject to jurisdiction in the United States that store data overseas could be compelled to turn over that data regardless of the privacy laws and regulations in place in the country where the data centers are located, and companies that use cloud services would have to reassess their obligations under domestic and international privacy schemes. We will continue to provide updates on this case.