Legal professional secrecy, known in civil-law systems as secret professionnel or Anwaltsgeheimnis, is a foundational privilege that protects the candour between client and counsel. It is also a privilege that US surveillance law treats as irrelevant. When a European law firm or in-house legal department stores case files, legal opinions, or privileged communications inside cloud infrastructure operated by a US-incorporated provider, it places that privilege inside the jurisdictional reach of statutes that carry no carve-out for attorney-client confidentiality.
Why US-Controlled Cloud Is Structurally Incompatible with Legal Professional Secrecy
The structural problem is not a theoretical risk of future legislation: it is the current statutory text of two operative US laws.
CLOUD Act Section 2703, enacted in 2018, authorises US law enforcement to compel any US-incorporated electronic communications service provider to disclose the contents of stored communications held anywhere in the world. The physical location of the server is legally immaterial. Microsoft, Google and Amazon are US persons under the Act. A production order issued under Section 2703 reaches a client memorandum stored on an Azure server in the Netherlands just as readily as one stored in Virginia.
FISA Section 702, reauthorised most recently in 2024, permits the US intelligence community to compel US-based providers to grant ongoing access to communications of non-US persons located outside the United States. Unlike a Section 2703 order, a FISA 702 directive is served without judicial involvement beyond the Foreign Intelligence Surveillance Court, and its existence is classified. A law firm targeted under Section 702 will never receive notification.
The Office of the Director of National Intelligence reported in its 2023 Annual Statistical Transparency Report that the US government submitted between 60,000 and 70,000 FISA Section 702 targets in the 2022 certification period. These are not individual requests but authorised target categories, each potentially encompassing large volumes of communications across many accounts.
Microsoft’s own transparency reporting is equally instructive. According to the Microsoft Digital Defense Report 2023, Microsoft received 2,748 government legal demands globally in the first half of 2023 alone, with 86% accompanied by non-disclosure orders that prevented the company from informing the affected customer. A law firm whose client files were subject to such a demand would not know to take remedial action.
Bar Association Rules: What BRAO, RIN and BGFA Actually Require
Each major European bar regime imposes affirmative obligations on attorneys, not merely prohibitions, and those obligations must be satisfied before any cloud deployment of client data can be considered compliant.
Germany: BRAO Section 43e
The 2022 amendment that introduced Section 43e into the Bundesrechtsanwaltsordnung (BRAO) was explicitly intended to address cloud outsourcing. It permits attorneys to engage processors for client data only when confidentiality is guaranteed at a level functionally equivalent to in-house handling. The Bundesrechtsanwaltskammer (BRAK) has made clear in its published guidance that this assessment must include an analysis of whether the processor or its parent entity is subject to foreign laws that could override the confidentiality obligation. A German attorney relying on a US-controlled cloud provider cannot complete that analysis favourably, because the answer is known in advance: Section 2703 and Section 702 do override it.
France: RIN Article 2 and the Conseil National des Barreaux
The French Règlement Intérieur National (RIN) imposes a duty of confidentiality described as absolute and perpetual. The Conseil National des Barreaux has addressed cloud storage in guidance noting that hosting with providers subject to non-EU government access laws requires technical measures that render the data inaccessible to the provider. This is not satisfied by contractual assurances from the provider: it requires architectural controls, specifically client-managed encryption keys that the provider cannot access under any instruction from a third-party authority.
Switzerland: BGFA and Swiss Law as the Baseline
The Swiss Federal Act on the Legal Profession (BGFA) aligns professional secrecy with the criminal law protection in Article 321 of the Swiss Penal Code, which makes unauthorised disclosure a criminal offence. Switzerland does not have a statute equivalent to the CLOUD Act. A Swiss-incorporated cloud provider has no statutory obligation to disclose data to a foreign government absent a formal mutual legal assistance treaty request processed through Swiss judicial channels, which includes a Swiss court assessment of whether the request is compatible with Swiss public policy. This is a substantive procedural filter, not a bureaucratic formality.
| Jurisdiction | Governing rule | Cloud outsourcing condition | US-controlled cloud compliant? | Swiss sovereign hosting compliant? |
|---|---|---|---|---|
| Germany | BRAO Section 43e | No foreign law override of confidentiality | No | Yes, with client-managed keys |
| France | RIN Article 2 / CNB guidance | Provider must be technically unable to access data | No | Yes, with zero-knowledge architecture |
| Switzerland | BGFA / StGB Article 321 | Criminal sanction for disclosure; MLAT filter applies | No | Yes, natively |
The EU e-Evidence Regulation: A New Pressure Vector from 2026
Regulation (EU) 2023/1543, commonly referred to as the e-Evidence Regulation, introduces European Production Orders (EPOs) that allow a judicial authority in one EU member state to compel a service provider established in another member state to produce electronic evidence within ten days, or eight hours in urgent cases. The Regulation applies from 18 August 2026.
Law firms and in-house legal departments that hold client communications as data controllers or processors fall within the definition of addressable service providers. The Regulation contains limited grounds to contest an EPO on grounds of privilege, but the mechanism is untested and the burden to invoke it rests with the provider receiving the order, not with the law firm whose data is at stake. Routing data through Swiss infrastructure provides meaningful insulation: Switzerland is not an EU member state and is not bound by the e-Evidence Regulation. An EPO cannot be served directly on a Swiss-domiciled provider. The requesting authority must proceed through the bilateral judicial cooperation framework between Switzerland and the relevant EU member state, which reintroduces the procedural filter described above.
Technical Controls That Make the Privilege Assertion Credible
Asserting that professional secrecy has not been compromised in a multi-jurisdictional investigation requires more than a contractual declaration. It requires an architecture that makes provider-level access technically impossible to perform silently.
The three non-negotiable controls are: first, end-to-end encryption with keys generated, stored and rotated by the law firm itself, not by the cloud provider or a provider-affiliated key management service; second, storage in a jurisdiction-isolated environment operated by a provider incorporated and domiciled outside any country with extraterritorial surveillance laws comparable to the CLOUD Act; and third, immutable, tamper-evident access logs maintained by the law firm independently of the hosting provider, so that any access event, authorised or not, is permanently recorded and attributable.
A Nextcloud-based document management environment deployed on Swiss infrastructure satisfies all three conditions when configured correctly. Files can be encrypted at rest using keys held in a hardware security module under the law firm’s sole control. The Swiss provider stores only ciphertext. Access metadata is written to append-only logs that can be cryptographically sealed at configurable intervals. For in-house legal departments subject to EU Anti-Money Laundering Directive (AMLD6) obligations, the same audit log architecture that protects privilege also generates the transaction and communication records required for AML compliance, provided the log schema captures the identity, timestamp, document reference and action type for every privileged file interaction.
Structuring Chain-of-Custody for Privileged Materials Under AMLD6
The sixth Anti-Money Laundering Directive (AMLD6) extended predicate offences and tightened record-keeping obligations for legal professionals in regulated sectors. The apparent tension between privilege and AML audit obligations is resolved architecturally rather than legally: privileged content remains encrypted and inaccessible to third parties, while the structural metadata of every access event, including who opened which file when, is preserved in a separate, unencrypted audit layer that can be produced in response to a supervisory authority’s request without disclosing the underlying content.
This separation of content from access metadata is the design principle that allows a law firm to maintain chain-of-custody integrity for privileged materials while demonstrating to a financial intelligence unit or bar disciplinary body that its document management system operates with full accountability. The IBM Cost of a Data Breach Report 2023 placed the average total cost of a breach at USD 4.45 million globally, with regulated industries recording higher figures. For a law firm, the reputational cost of a privilege breach is additional and not captured in that figure.
The revised Swiss Federal Act on Data Protection (FADP), in force from 1 September 2023, brings Switzerland into functional alignment with GDPR requirements on data subject rights, breach notification and purpose limitation. A European law firm selecting a Swiss-hosted sovereign workspace can therefore satisfy both GDPR adequacy standards and the extraterritorial isolation requirement in a single infrastructure decision, provided the hosting contract is governed by Swiss law and excludes any US-parent-company ownership in the provider’s corporate structure.
FAQ
Can a US cloud provider be compelled to hand over a European law firm’s client files under the CLOUD Act even if the files are stored on servers inside the EU?
Yes. CLOUD Act Section 2703 production orders bind US-incorporated providers regardless of where the data physically resides. Microsoft, Google and Amazon are US persons under the Act, so servers in Frankfurt or Amsterdam do not insulate the data from a US government demand.
Does using end-to-end encryption on a US-controlled cloud service protect attorney-client privilege?
Only if the law firm holds all encryption keys independently of the provider. Most commercial offerings allow the provider to access keys under compulsion. If the provider controls key escrow, a CLOUD Act order or FISA 702 directive can reach both the ciphertext and the key, defeating the protection entirely.
How does the EU e-Evidence Regulation 2023/1543 differ from existing mutual legal assistance requests, and does it create new risks for law firms?
The Regulation, applicable from 2026, allows judicial authorities in one EU member state to issue European Production Orders directly to service providers in another member state, bypassing MLAT timelines. Law firms acting as data holders face legally binding disclosure obligations within ten days, with no automatic privilege carve-out. Sovereign routing through Switzerland reintroduces bilateral judicial cooperation requirements that slow and filter such requests.
What does the German BRAO specifically require regarding cloud storage of client files?
Section 43e BRAO, inserted by the Act to Modernise the Law of Attorneys in 2022, permits outsourcing of client data to processors only when confidentiality is contractually and technically guaranteed at a level equivalent to in-house storage. The BRAK has clarified that this includes an assessment of whether the processor is subject to foreign government access laws that could override the confidentiality obligation.
Does Swiss hosting automatically satisfy GDPR and EU bar association professional secrecy rules for a German or French law firm?
Not automatically, but it provides a strong and auditable foundation. Switzerland holds EU adequacy status under GDPR and the revised FADP aligns with GDPR standards. For professional secrecy under BRAO or the French RIN, the decisive factors are client-managed key management that excludes the Swiss provider from accessing plaintext, contractual jurisdiction clauses, and immutable audit logs demonstrating no third-party access. Swiss law contains no extraterritorial access provisions comparable to the CLOUD Act.