從美國雲法案談數位時代域外取證立法與衍生爭議

Legal Study on Cross-Border Access to Electronic Data for Law Enforcement and the Impact of U.S. CLOUD Act

資訊通訊技術日新月異及數位經濟快速發展下，人類生活已與網路密不可分，大量湧現的電子資料更成為網路犯罪在內等網路衍生爭端解決上不可或缺之事物。在資料全球流通趨勢下，各國無不存在域外電子資料的獲取需求，惟資訊儲存模式的改變及司法互助協定等固有機制存在的問題，使得域外電子資料持續存在取得不易之情形。2016年微軟愛爾蘭案突顯出美國聯邦儲存通訊記錄法令狀適用範圍是否及於本國業者域外電子資料之爭議，而在此一基礎上制定的2018年雲法案除明確系爭電子資料的獲取依據，亦授權聯邦政府與其他國家締結行政協議以利相互直接存取儲存於對方境內的電子資料。由於現時掌握多數電子資料的跨國網路服務提供者大抵為美國公司，雲法案相關設計著實突顯美國作為網路大國的強勢地位。然雲法案亦非全然無失，除學者間提出之批評意見，本文發現此一新興域外取證立法與歐盟通用資料保護規則也存在衝突之虞，而其他國家亦可能選擇制定資料在地化立法作為對抗手段。在域外電子資料取證難題未有良方下，包括司法互助協定及網路犯罪公約咸湧現改革討論，相關倡議係將齊一各界意見抑或更加複雜化域外電子資料獲取問題，則有持續觀察之必要。

"The borderless nature of the internet has enabled the development of the digital economy and revolutionary technical innovations, but it also brings lots of issues such as cybercrime. Technological evolutions and the digitalization of people’s lives constitute a tremendous challenge for law enforcement and legal authorities as they need to access evidence located on servers or cloud computing data centers that are often based abroad. Law enforcement agencies investigating multi-country crimes are often bound by the geographic limits of their jurisdictions and must rely on Mutual Legal Assistance Treaty (MLAT) to request and obtain the information they need. Due to the limits of existingMLATs, it is necessary to seek appropriate mechanisms to solve the problem of extraterritorial electronic data access. The Microsoft Ireland case presented the question whether a U.S. warrant issued pursuant to the 1986 Stored Communications Act (SCA), reach electronic data that are controlled by U.S.-based companies but stored on data centers located outside the United States. The U.S. Court of Appeals for the Second Circuit, reversing the district court, held that theSCA did not require electronic communication service and remote computing service providers to produce email content stored outside the U.S. The passage of the CLOUD Act in 2018 brings an end to the four-year legal battle and the new law explains two parts: (i) U.S. access to data located outside the United States; and (ii) foreign Government access to data held by U.S. companies within the United States. The CLOUD Act represents an effort by the U.S. Government to set an new standard via domestic regulation, while the Act provides clarity as to the permissible reach of the U.S. Government, it raises issues of potential conflicts with the laws of other countries. Many details of how the Cloud Act will work in practice remain to be seen."