I’m glad to see that Microsoft and other tech giants are fighting the US from seizing data in the cloud.

If Microsoft were to comply with the US government’s hybrid warrant-subpoena for data stored on Australian soil, they will be in breach of the Australian privacy act of 1988 and APP 8.

Interestingly, if they were to comply with this for data on a South African citizen, regardless of where the data is stored, they may be in breach of the South African POPI act section 72.

References:

Extract from the APP 8 from the Privacy Amendment (Enhancing Privacy Protection) Act 2012

8.1  Before an APP entity discloses personal information about an individual to a person (the overseas recipient):

(a)    who is not in Australia or an external Territory; and

(b)   who is not the entity or the individual;

the entity must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the Australian Privacy Principles (other than Australian Privacy Principle 1) in relation to the information.

Note: In certain circumstances, an act done, or a practice engaged in, by the overseas recipient is taken, under section 16C, to have been done, or engaged in, by the APP entity and to be a breach of the Australian Privacy Principles.

…

16C  Acts and practices of overseas recipients of personal information

(1)  This section applies if:

(2)  The act done, or the practice engaged in, by the overseas recipient is taken, for the purposes of this Act:

(a)  to have been done, or engaged in, by the APP entity; and

(b)  to be a breach of those Australian Privacy Principles by the APP entity.

 Extract from the Australian Privacy Act 1988:

  (6A.4)  An act or practice does not breach an Australian Privacy Principle if:

(a)    the act is done, or the practice is engaged in, outside Australia and the external Territories; and

(b)   the act or practice is required by an applicable law of a foreign country.

South African POPI Act 2013 pdf...