No refuge from US Patriot Act

Stuart Corner
Friday, 27 January 2012 09:15

"Patriotism," said Oscar Wilde, "is the last refuge of the scoundrel," but it seems there may be no refuge for personal or corporate data from the reach of the US Patriot Act: even when the data are held in Australia.

The Patriot Act was rushed into law in the US in the wake of the 9/11 attacks and, according to Connie Carnabuci, a partner in global law firm Freshfields Bruckhaus Deringer, its provisions give US authorities the ability to pass orders to compel disclosure of non-US data stored outside the US if they can establish sufficient connection to the US.

This, she says, has serious implications for the data security and privacy of any Australian organisation - business or government, even if its data is stored in Australia.

"We don't have a clear answer [as to what constitutes sufficient connection to the US] and giving meaning to those words is at the heart of the issue," Carnabuci said. Furthermore she said the Act was being over zealously applied in situations that went well beyond protecting the US against terrorism.

She stressed that, in these circumstances it should be a part of the due diligence of any organisation contracting with a service provider for hosting or processing of its data to establish whether there was any nexus with the US.

"The US courts have also been particularly aggressive in compelling production of non-US data even where it violates local laws in the country where the data is located," she said. "This is particularly important for US companies looking to engage a service provider."

The 'sufficient connection' test has yet to be applied in Australia or challenged in an Australian court but Carnabuci said some grounds were already clear. "One is that you have a US company with subsidiaries outside the US such as US company that sets up a subsidiary in Australia to provide cloud computing services to Australian companies. A second might be that you have a non-US company that sets up a US subsidiary to do business in the US.

CONTINUED