[3] The CLOUD Act is a culmination of these earlier bills. In principle, U.S. data and communications companies must provide data stored to a customer or subscriber on any server they own and operate when requested by arrest warrant, but make available mechanisms for companies or courts to reject or challenge it if they believe the request violates the data protection rights of the foreign country, in which the data is stored.