The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US law that has far-reaching implications for international data protection. It becomes particularly critical when sensitive data is involved – such as video recordings from body-cams, also known as body cameras, used by police or security authorities.
Would you like to use a body camera in the security industry? Let us advise you! ## What is the CLOUD Act? Passed in 2018, the CLOUD Act requires US companies to grant investigative authorities access to stored data upon request – even if that data is stored outside the US. This also applies to data stored on servers in Europe, provided it is managed by a US provider such as Microsoft, Amazon or Google. ## Body cameras in focus Body cameras provide sensitive image and sound recordings when used by the police, public order offices and private security services. This data often contains personal information – faces, conversations, locations. If these recordings are stored in the cloud, the question arises: Who has access to it? ## CLOUD Act vs. GDPR Two legal worlds collide here: under certain conditions, the CLOUD Act allows US authorities access to data stored in the cloud – even if this contradicts the European General Data Protection Regulation (GDPR). For operators of body-cam solutions, this means a conflict between security, functionality and data protection.
What are the challenges? ### Risks for body-cam users: If a security authority links its body cameras to a cloud solution from a US provider, the data could theoretically be requested by US authorities. This poses significant risks:
- Loss of data sovereignty: Data belonging to European citizens could be processed outside the EU without their knowledge. * Legal uncertainty: Companies and authorities run the risk of violating the GDPR. * Loss of trust: The use of body cameras is intended to build trust, not destroy it.
How can organisations respond? * Prefer European cloud providers: The risk can be minimised by choosing providers with headquarters and data centres in the EU. * Encryption: End-to-end encryption can make access by third parties more difficult.
- Transparent data protection policies: Clear communication builds trust among the individuals concerned. The CLOUD Act is a significant factor in the tension between international law and European data protection. Especially when using body-cams or body cameras, security authorities and companies should carefully consider where and how the data is stored. This is the only way to combine data protection, transparency and legal certainty.
Would you like to use a body camera in the security industry? Let us advise you! To our guide for the GDPR-compliant use of body cameras