Involved parties: U.S. laws include FISA 702 (reauthorized via 2024 Reforming Intelligence and Securing America Act, RISAA, expanding "electronic communication service provider" to cover cloud/data centers) and 2018 CLOUD Act (enabling warrants for data worldwide from U.S.-controlled firms); agencies like FBI, CIA, DOJ, and ODNI (reporting 35% rise in U.S. person queries in 2025); companies such as AWS, Azure, Google, CrowdStrike, Microsoft; EU bodies (EDPB, CJEU via Schrems II); critics like Sen. Ron Wyden, EFF, Brennan Center; proposed reforms like SAFE Act.[2][3][4][5][7][11]
Context and timeline: FISA 702 (2008) enables warrantless surveillance of non-U.S. persons abroad, sweeping in U.S. data; RISAA (April 2024) reauthorized it to April 2026, broadened ECSP definition for cloud era; CLOUD Act (2018) mandates U.S. providers disclose data globally, conflicting with GDPR (no MLAT basis, SCCs insufficient); German white paper (April 2025) flagged EU risks; ODNI 2024 report (May 2025) showed query spikes from cyber threats.[1][2][5][6][7][8]
Newsworthy now: With FISA 702 sunsetting April 2026, reauthorization fights resume early 2025, urging corporate privacy shifts (TIAs, EU providers for sensitive data, vendor diligence amid AI/cloud growth); rising FBI queries, EU fines threats, and no hyperscaler fixes amplify urgency for strategies beyond data residency.[3][5][6][7][11]