Highly controversial American Clarifying Lawful Overseas Use of Data Act (CLOUD Act), granting police access to personal data, was signed into law today.

The bill was slipped into an omnibus $1.3tn (€1.04tn) spending bill necessary to avoid another government shutdown and was voted by both Houses of Congress without any congressional debate. The law allows US authorities to legally compel service providers to provide data stored on foreign servers under their control. The Cloud Act empowers the US president to force US services providers to deliver content data to a foreign government without the need of going through the procedures of mutual legal assistance treaties.

The law also clearly undermines internet freedoms by circumventing national privacy laws in Europe and elsewhere.

However, the EU itself is working on the plans of Electronic evidence regulation, which pursues the objective of cracking down on cross-border crime by forcing companies to release user’s data directly to law enforcement in case of serious crimes. Like the Cloud Act, Electronic evidence regulation’s scope will likely be extraterritorial. At the same time, however, the EU’s upcoming data protection regulation contains provisions that prevent companies from sharing data with foreign governments unless they’ve secured an international agreement or a mutual legal assistance treaty.