What does the CLOUD Act do?

• A. It prohibits federal authorities from obtaining data.
• B. It amends the Stored Communications Act to allow federal authorities to compel U.S. tech companies to provide subpoenaed data, including data stored overseas, for national security or drug trafficking enforcement.
• C. It creates a privacy framework restricting cross-border data flows.
• D. It requires tech companies to delete data after 90 days.

Answer: (B)

The main idea this question tests is how the CLOUD Act changes access to data held by U.S. tech companies, especially when that data is stored overseas. The act updates the legal framework so federal authorities can compel providers to turn over subpoenaed data under the Stored Communications Act, and it explicitly includes data that’s stored outside the United States. It’s driven by national security and criminal enforcement needs, such as drug trafficking cases, and it also creates a path for international cooperation through executive agreements with other countries to streamline cross-border data access.

That’s why the correct statement is that the CLOUD Act amends the Stored Communications Act to allow federal authorities to compel U.S. tech companies to provide subpoenaed data, including data stored overseas, for national security or drug trafficking enforcement. The other options don’t fit: the act does not prohibit data access, it does not establish a privacy framework that restricts cross-border data flows, and it does not impose a 90-day deletion rule.