Report – Transatlantic Data Flows: More Needed to Protect Human Rights

In a bid to preserve trans-Atlantic data flows, President Biden issued an Executive Order (EO) on October 7 seeking to satisfy the requirements that the Court of Justice of the European Union (CJEU) established when it determined that the Privacy Shield agreement between the U.S. and EU was inadequate. The EO limits intelligence surveillance directed abroad to 12 categories of purposes which, though broad, may be narrower than the purposes for which such surveillance could be engaged in before. Further, the EO, and an accompanying regulation from the Department of Justice (DOJ), establish a Data Protection Review Court (DPRC) to which persons from designated countries who allege they have been the subject of improper or unlawful surveillance may bring claims for redress.  

While the EO marks a significant step forward, it does not conform in several respects to the requirements the CJEU has established, leaving continuing doubts about the extent to which the rights of non-U.S. persons abroad are being protected. In particular, absent further restrictions, the breadth of the permissible purposes of surveillance under the EO may not meet the proportionality standard that surveillance should be limited to what is strictly necessary. In addition, the DPRC, while vested with substantial powers, is not a judicial entity independent from the Executive Branch, but rather is established as part of the DOJ. Indeed, while recognizing that “all persons should be treated with dignity and respect” and that they have “legitimate privacy interests,” the Executive Order never crosses the critical line of acknowledging that non-U.S. persons abroad have privacy and data protection rights that the U.S. must honor. 

Ultimately, whether the CJEU upholds a challenge to the expected adequacy decision may turn on the extent to which the CJEU gives a margin of appreciation to the surveillance regime the U.S. has put into place, given the political and legal realities in the U.S. with regard to how far the authorities could go. 

We explain here how the U.S. could supplement the EO to better protect human rights of people subjected to surveillance directed abroad, and establish a legal regime more likely to receive a positive judgment from the CJEU. We recommend that:

• The Privacy and Civil Liberties Oversight Board (PCLOB) report on the extent to which the EO narrows actual surveillance activities that preceded it;
• Intelligence agencies clarify how they will interpret the EO requirements with respect to necessity and proportionality, disclose restrictions they intend to place on bulk and targeted collection, and disclose the procedures they will use for authorizing and implementing intelligence surveillance directed abroad;
• Congress considers narrowing the scope of permissible surveillance, requiring that surveillance targets be parties to communications collected in targeted intelligence surveillance, granting the DPRC subpoena power, granting complainants the right to appeal to federal court, and addressing the state secrets privilege;
• The Department of Justice permit the people the DPRC selects to advocate for a complainant’s interests to communicate confidentially with the complainant; and
• The Administration reconsiders the policy of permitting bulk collection.

Read the full report here.