Rand Paul requests information on UK demands for US user data

• Sen. Rand Paul is seeking answers about a U.K. order demanding access to all Apple user data globally. The order raises concerns about U.S. user data security.
• Apple chose not to comply with the U.K.’s data request and instead reduced data protection for U.K. users, now taking the matter to court.
• Paul wrote to U.S. Attorney General Pam Bondi, requesting information on any similar orders and raising concerns about the Cloud Act and U.K. statutes potentially compromising U.S. user data privacy.

---

Full Story

Sen. Rand Paul, R-Ky., is looking for answers following an order in the U.K. demanding access to all Apple user data globally, sparking concerns about U.S. user data security. Last month, the U.K. Home Secretary reportedly asked Apple to hand over the data stored in its cloud storage service, but Apple chose not to comply.

Apple instead made a move to reduce the level of data protection for its U.K. users, after being faced with a choice to either weaken security or stop operations in Europe all together due the data being encrypted by default.

Reason reported Apple is now taking the U.K. to court over the order.

In a letter to U.S. Attorney General Pam Bondi this week, Paul, who chairs the Senate Homeland Security and Government Affairs Committee, requested information on any other recent orders.

“This action raises significant questions about the integrity of the U.S. user data in context of the Cloud Act and U.K. statutes,” Paul said.

I'm asking that AG Bondi provide all relevant information about the Cloud Act Agreement between the U.S. and the U.K., which established rules for how both countries handle each other’s data. https://t.co/7kkCcKOHTD

— Rand Paul (@RandPaul) March 20, 2025

What is the Cloud Act?

The Cloud Act, passed in 2018, requires tech companies to provide information about customers to the government when asked, even if that information is stored outside the United States. 

The Department of Justice later entered into a data sharing agreement with the U.K. under the Cloud Act.

When the bill came up for a vote, Paul posted an article on social media supporting the ACLU’s stance which was, “Congress should reject the cloud act because it fails to protect human rights or Americans’ privacy … gives up their constitutional role, and gives far too much power to the attorney general, the secretary of state, the president and foreign governments.”

“Congress should reject the CLOUD Act because it fails to protect human rights or Americans’ privacy…gives up their constitutional role, and gives far too much power to the attorney general, the secretary of state, the president and foreign governments.” https://t.co/pEv4z88lDY

— Rand Paul (@RandPaul) March 22, 2018

In his letter to Bondi, Paul said the U.K.’s demand was “the latest concerning attempt by law enforcement entities to obtain ‘backdoor’ access to private user context under the pretext of national security.”

What is Paul requesting?

Paul asked for unredacted copies of any requests from the U.K. government for information about U.S.-based companies. He also asked for records related to any confidentiality agreements or nondisclosure requirements applicable to a U.S. company.