The Cloud and Filing Cabinets Should Have the Same Privacy Rights (Perspective)

Editor’s Note: This column is written by the top lawyer of Delta Air Lines.

The U.S. government has been seizing vast swaths of private customer data stored in “the cloud” at an alarming rate. Even more disturbing is the fact that in many cases, the government imposes gag orders that prevent people and businesses from knowing that their private information has been commandeered. The government does all of this under the auspices of the Electronic Communications Privacy Act (“ECPA”), a law that was enacted in the 1980s, long before cloud computing became commonplace.

The safety and privacy of the 180 million customers who choose to travel with us each year is paramount to Delta. It is incomprehensible to us that the government has the ability to secretly demand private information about anyone it investigates, so long as that information is stored remotely.

According to a civil complaint filed by Microsoft against the government in federal court, the U.S. government issued more than 5,600 demands to Microsoft over an 18-month period, seeking access to customer information hosted in the cloud. More than 2,500 of those demands came with court-issued secrecy orders that prevented Microsoft from alerting its customers that their information — including personal communications, business records and confidential documents — was being given to the government. Microsoft’s lawsuit challenges this abuse with a simple premise: citizens and businesses that store information on remote data centers are entitled to the same degree of privacy and freedom from unlawful seizure as those who store such information in filing cabinets or personal computers.

The privacy implications for U.S. citizens and businesses could be dire if Microsoft is not successful in its effort to block these government seizures.

For example, Delta has started to take advantage of cloud technology to develop new ways to connect with customers and deliver innovative products. While Delta does everything we can to protect the private information of all our customers, there is nothing we can do if served with an ECPA demand. Under the current law, the government can require Delta to provide all information on a given customer regardless of its relevance to the investigation, and bar Delta from notifying the customer that their information has been shared. Credit card numbers, health-related notes, travel information, e-mail addresses — all are potential targets for the government.

Likewise apparently any company information stored on the cloud can be accessed by the government during an investigation. We recognize that nearly every large company is subject to government investigation at some point, but that shouldn’t mean that proprietary and attorney-client privileged information should be in the hands of the U.S. government. Protecting the privileged communications between businesspeople and their attorneys is vital to promoting compliance with the law. As the Supreme Court aptly stated in Swidler v. Berlin, 524 U.S. 399, 403 (1998), confidentiality encourages clients to make “full and frank” disclosures to their attorneys, who can then provide candid and effective advice. If company employees believed that e-mail conversations with their lawyers were not confidential, there would be a chilling effect on candid confidential communications. The government’s overreaching undermines one of the oldest privileges recognized under the law.

Innovation would suffer, too. As companies feel more risk than benefit about using cloud technology due to privacy concerns, the programs and technologies that require the cloud environment will be slow to market, or not make it to market at all.

Americans have privacy rights regardless of where personal information is stored. As we continue to move forward into a data-driven digital society, the cloud deserves the same legal protection as the office or home filing cabinet. Microsoft should be applauded.