October 3, 2019

US and UK enter into cross border agreement allowing direct access to tech company data in certain criminal investigations

The United States and the United Kingdom have entered into a Bilateral Data Access Agreement (BDAA) designed to facilitate the collection of electronic evidence from entities in the other country’s jurisdiction.  This BDAA updates and replaces the current Mutual Legal Assistance request process, and is the first bilateral agreement the US has entered into since the March 2018 enactment of the CLOUD Act, which authorizes the US to enter into such agreements with other nations in order to lift barriers to access to electronic data.

The terms of the agreement allow law enforcement in either country to approach tech companies based in the other country directly, subject to independent judicial authorization or oversight.   Certain conditions apply to the use of the BDAA:  the investigations will not target residents of the country from which access is requested; disclosures made pursuant to the agreement will be consistent with local data protection laws; and the parties have undertaken to obtain permission from one another before prosecutions touching upon the other country’s “essential interest—specifically, death penalty prosecutions by the United States and UK cases implicating freedom of speech.”

The agreement will enter into force in approximately six months, following a review period in Congress and the UK Parliament.

DOJ press release