EU–US Data Privacy Framework: A First Legal Assessment

Abstract

The purpose of this contribution is to briefly present the content of the EU–US Data Privacy Framework recently adopted by the European Commission and then to assess whether it meets the expectations expressed by the Court of Justice of the European Union in its Schrems II judgment and related case law.

European data protection law requires that the protections provided for in the European Union (EU) follow the personal data of citizens wherever those data go, and it is the responsibility of the data controller to ensure that this is the case in accordance with the mechanisms and modalities provided for this purpose in the General Data Protection Regulation (GDPR). ¹ After a thorough examination of its legislation and international commitments, the European Commission may find by means of an “adequacy decision” ² that a third country ensures an adequate level of protection for data subjects established in the Union; in particular, they must have enforceable rights and effective remedy, complemented by appropriate safeguards ensuring a level of protection that, if not identical, is at least substantially equivalent to that provided by EU law. In the absence of such an adequacy decision, the transfer of data to this third country can only take place if the “exporter” of these data established in the Union provides appropriate safeguards ³ or, failing that, under the other conditions provided for in the GDPR. ⁴

Until 2020, transfers from the EU to the USA were covered by the Commission’s 2016 partial adequacy decision, the so-called “Privacy Shield”. ⁵ However, this adequacy decision was annulled by the Court of Justice of the European Union (CJEU) ⁶ following a complaint lodged by Maximilian Schrems with the Irish Supervisory Authority seeking to prohibit the transfers of his personal data from Facebook Ireland to servers belonging to Facebook, Inc., located in the USA. ⁷ The Irish authority initiated proceedings before the High Court to ask the latter to submit a preliminary ruling request to the CJEU on, among other things, the validity of the “Privacy Shield” decision. Following this reference for a preliminary ruling, the Commission’s “Privacy Shield” adequacy decision was annulled by the CJEU on 16 July 2022 (“Schrems II judgment”). The Court found that, contrary to the Commission’s assertion in its decision, the limitations on data protection arising from the US domestic regulations “are not circumscribed in a way that satisfies requirements that are essentially equivalent to those required under EU law …”, ⁸ and that the judicial protection mechanism provided for in the “Privacy Shield”, in this case a mediation mechanism, did not provide “… any cause of action before a body which offers the persons whose data is transferred to the United States guarantees essentially equivalent to those required by Article 47 of the Charter”. ⁹

This decision goes against the European Data Strategy, in addition to putting at risk an economic relationship estimated to be valued at approximately 7 billion euros. ¹⁰ The Commission therefore launched a drive to address the criticisms levelled by the CJEU.

The first steps towards a new adequacy decision were taken in March 2022 with an agreement in principle between the European Commission and the USA. ¹¹

On 7 October 2022, the White House adopted Executive Order 14086 “Enhancing safeguards for United States signals intelligence activities” (hereinafter “EO 14086”), ¹² which is intended to provide additional safeguards and guarantees regarding the limitations on the protection of European citizens’ data arising from the intelligence activities of US intelligence agencies. In addition to this decision, on 14 October 2022, the US Department of Justice adopted the regulation creating the Data Protection Review Court (DPRC). Finally, the previous EU–US Data Privacy Framework (DPF) was updated.

On 13 December 2022, the European Commission launched the process of adopting a new adequacy decision for the DPF, which will promote transatlantic data flows and address the concerns raised by the CJEU in its 2020 Schrems II judgment. ¹³

On 28 February 2023, the European Data Protection Board (EDPB) adopted Opinion 05/2023 on the draft implementing decision. ¹⁴ The EDPB’s assessment raised some concerns regarding the rights of data subjects, the newly created DPRC’s independence in practice and the lack of clarity surrounding some aspects of EO 14086. However, in contrast to the European Parliament, the EDPB’s assessment does not seem to consider that the DPF “per se” fails to provide the essential safeguards to ensure that interference with the right to privacy and the protection of personal data by surveillance measures when personal data are transferred does not go beyond what is necessary and proportionate in a democratic society, ¹⁵ and thus it called on the Commission to closely monitor the implementation of the DPF in practice.

On 11 May 2023, the European Parliament adopted a resolution on the adequacy of the protection afforded by the DPF. ¹⁶ The European Parliament concluded that the “EU–US Data Privacy Framework fails to create essential equivalence in the level of protection”, ¹⁷ and it called on the Commission not to adopt the adequacy decision in that state.

On 10 July 2023, the European Commission formally adopted the draft decision unchanged. ¹⁸

The purpose of this contribution is to briefly present the content of the DPF recently adopted by the European Commission (Section I) and then to assess whether it meets the expectations expressed by the CJEU in its Schrems II judgment and related case law (Section II). ¹⁹ Section III concludes.

I. Essential elements of the DPF

The DPF adequacy decision takes the form of a Commission implementing act. As mentioned previously, it has been subject to a non-binding opinion of the European Data Protection Supervisor (EDPS)/EDPB, before then being adopted according to the principles and rules of the “comitology” review procedure. ²⁰

At least three key elements of the DPF merit analysis, which will be discussed in the following subsections.

1. Mechanism for certification and adherence to the principles of the DPF

It should be made clear from the outset that this is a partial adequacy decision, in the sense that it is not intended to cover the processing of personal data by all US organisations and operators, but only those that voluntarily adhere to the DPF principles as issued by the US Department of Commerce (DoC) and complete the self-certification process. ²¹ This certification attests to compliance with seven core principles and sixteen additional principles. This is essentially a correlation of the principles listed in Chapter II of the GDPR and related articles, from which the rights of data subjects and the obligations of operators flow. These basic principles are those of notice, choice, accountability for onward transfer, security, data integrity and purpose limitation, data access and recourse, liability and effective enforcement of regulation. The additional principles deal with specific subjects, such as data relating to human resources or exceptions relating to journalism. ²²

To be eligible for certification, operators must also be subject to the investigative and remedial powers of the US Federal Trade Commission (FTC) or Department of Transportation (DoT). Oversight of the certification scheme is provided by the US DoC, which may require certified operators to re-certify on an annual basis. The FTC or the DoT, as the case may be, performs the functions of the Control Authority ²³ with regard to the handling of complaints by data subjects, the powers of investigation and the imposition of remedies or sanctions in cases where the amiable dispute resolution or arbitration mechanisms provided for in the DPF would not have sufficed. ²⁴

2. Additional safeguards and guarantees regarding the limitations on the data protection of European citizens arising from the intelligence activities of US intelligence agencies

This second element of the DPF is the US government’s response to the first requirement of the Schrems II judgment, ²⁵ in particular the criticism that had been expressed by the CJEU regarding Presidential Policy Directive 28 (PPD-28) adopted under the Obama administration ²⁶ that it did not sufficiently regulate the limitations on data protection for Europeans. President Biden’s EO 14086 replaces PPD-28, which is partially revoked. ²⁷ It should be noted that, like the previous order, the current one does not contain a definition of the intelligence activities that fall within its scope.

Section 2 of the order lists twelve legitimate objectives that intelligence activities may pursue and four prohibited objectives, the latter relating to the protection of freedom of expression, of the press and of legitimate privacy interests, the right of access to legal counsel or ethnic, racial, gender, sex or religious discrimination. It should also be noted that a status distinct from these prohibited objectives is granted to the collection of information or business secrets of foreign companies to provide a competitive advantage to US companies. Indeed, while it is expressly characterised as a “non-legitimate objective”, it is not defined as a prohibited one. The order even states that it can be a legitimate objective when it is “to protect the national security of the United States or of its allies and partners”, a generic term if ever there was one. ²⁸

The order introduces the principles of “necessity”, “proportionality” and the “oversight” of intelligence activities, assessed against pre-approved intelligence priorities (which represent classified information, yet much of which can be deduced from publicly available reports). The factors for assessing these principles are not exhaustively defined, but the order particularly mentions the nature of the pursued objective, the impacts of the measures on third parties, their duration, the sensitivity of the data to be collected and the safeguards afforded to the information collected. The order also reinforces the application of these principles in the case of mass surveillance, which is subject to additional safeguards. ²⁹

It should be noted, however, that while this order establishes guidelines and principles to be respected in intelligence activities, it in no way modifies existing intelligence legislation, in particular the Foreign Intelligence Surveillance Act (FISA) and its Section 702, which allows, under certain conditions, targeted surveillance of non-US citizens abroad. ³⁰

3. Creation of a two-layer redress mechanism

The aim here is to meet the second requirement of the Schrems II judgment, which affirmed the need for “… cause of action before a body which offers the persons whose data is transferred to the United States guarantees essentially equivalent to those required by Article 47 of the Charter”. ³¹ This third element of the DPF therefore establishes a dual administrative body, but a priori without the possibility of a judicial remedy as such.

The complaint is first reviewed by the Civil Liberties Protection Officer (CLPO), who is appointed by and reports to the Director of National Intelligence. This decision may subsequently be appealed administratively and reviewed by the newly created Data Protection Review Court, which is composed of judges from outside the administration appointed by the US Attorney General. ³²

The system is limited to “qualifying complaints” transmitted by public authorities of a “qualifying state”. With regard to the latter term, the order provides that, in addition to a state, it may correspond to “a regional economic integration organization” (the EU comes to mind, of course), and that this designation is awarded by the US Attorney General, taking into account several criteria, including the fact that this designation “advances the national interests of the United States”. ³³ In addition, the CLPO’s response neither confirms nor denies that the complainant has been subjected to US intelligence activities, and it will be limited to stating (1) that no violation has been found or, conversely, that the CLPO has requested the implementation of appropriate measures (without specifying which violation), (2) that the complainant may appeal to the Data Protection Review Court and (3) that, if necessary, a special attorney will be chosen by the court to represent the complainant’s interests. The grounds for the CLPO’s decision remain classified in any event. ³⁴

II. Towards a Schrems III?

While the self-certification mechanism does not pose any particular problem, as it is a simple update of the pre-existing system from the previous Privacy Shield, which had not raised any major criticisms from the CJEU in the Schrems II judgment, this is not the case with points (2) and (3) that we mentioned. Although these represent real steps from the USA towards our system of fundamental rights, legal questions nevertheless remain.

1. Are the additional safeguards provided by EO 14086 sufficient?

With respect to the second key element of the DPF, regarding the additional safeguards provided by EO 14086, the first issue that arises is the choice of instrument: it is an administrative act with binding effect for the various departments of the federal administration, which therefore includes the intelligence services. While it can be amended by the President without Congressional intervention, logically it cannot amend other laws concerning intelligence activities, such as FISA and its Article 702, which authorises the targeted surveillance of non-US citizens abroad.

The compatibility of the text with the EU Charter of Fundamental Rights is questionable in two respects. First is whether the interpretation of the principles of “necessity” and “proportionality” set out in EO 14086 is in a manner compatible with Articles 7 and 52 of the Charter (and Article 8 of the European Convention on Human Rights; ECHR). Furthermore, the Charter provides that any limitation on the exercise of fundamental rights must be provided for by law ³⁵ (ie “the legal basis which permits the interference with those rights must itself define the scope of the limitation on the exercise of the right concerned” ³⁶ ). Here, the legal basis (eg FISA) remains unchanged.

To fully and unambiguously comply with this requirement, it would most likely have been necessary to amend the problematic sections of FISA by law to add a definition of the “scope of the limitation on the exercise of the right concerned” with respect to, for example, the targeted surveillance of non-US citizens abroad. ³⁷

However, the term “law” should not be interpreted in its formal sense; it could include, for example, regulatory measures, ³⁸ provided that the rule is “legally binding under domestic law”. ³⁹

The Court in Schrems II found that Article 702 of FISA did not, on its own, satisfy the proportionality requirement of Article 52(1) of the Charter because it did not set “any limits on the powers it granted” ⁴⁰ and because the previous PPD-28 did not set out “clear and precise rules on the scope of the measure and minimum safeguards”. ⁴¹ In addition, the previous PPD-28 did not provide data subjects with “actionable” rights before the courts against the US authorities. ⁴²

The remedies that the DPF implements and the consequences of non-compliance by intelligence agencies with the guidelines it sets should be made clearer. The Commission’s decision mentions the existence of the Foreign Intelligence Surveillance Court (FISC), whose decisions can be appealed to the Foreign Intelligence Surveillance Court of Review (FISCR). These courts deal with requests for surveillance warrants from US intelligence services. However, the guarantees offered by this system are questionable: historically, the FISC has refused only twelve warrant applications out of the 33,942 it has received since its creation in 1978, and the first appeal to the FISCR of such a rejection only occurred in 2002, twenty-four years later. In view of the lack of enthusiasm displayed by the FISC, but also of its case law, ⁴³ the CJEU is unlikely to be convinced by this system. Moreover, the extreme lack of transparency of these courts and their procedures makes it almost impossible to independently assess their effectiveness today. ⁴⁴

2. Between the issues of the independence of the DPRC and the lack of judicial review, how robust is the DPF’s two-layer redress mechanism?

The third key element of the new DPF is the creation of a two-layer redress mechanism. ⁴⁵ The question here is whether the absence of a judicial remedy can be regarded as prohibitive by the CJEU, or whether an administrative remedy can be regarded by the CJEU as offering guarantees “substantially equivalent” to those of the EU under Article 47 of the Charter. In other words, the question is whether the DPRC fulfils the criteria of independence and impartiality required by Article 47 of the Charter.

As to whether the right to an effective remedy – as defined in Article 47 of the Charter (and Articles 6 and 13 of the ECHR) – can be satisfied by an administrative body, the CJEU in Schrems II first stated that “… data subjects must have the possibility of bringing legal action before an independent and impartial court …”. ⁴⁶ Later, however, in recital 197, the Court recognises that effective judicial protection can also be ensured by a “body” offering guarantees substantially equivalent to those of the EU under Article 47 of the Charter. In addition, the European Court of Human Rights (ECtHR) ⁴⁷ has often accepted that various specialised, non-judicial bodies can be regarded as courts in the European sense of the term. ⁴⁸ Moreover, what seem to be important for the ECtHR in relation to Article 13 ECHR ⁴⁹ are “the powers and procedural guarantees an authority possesses” rather than the judicial nature of the authority. ⁵⁰

On the issue of independence, the CJEU had pointed out in Schrems II, with regard to the mediation system proposed in the Privacy Shield, that there was “nothing in that decision to indicate that the dismissal or revocation of the appointment of the Ombudsperson is accompanied by any particular guarantees, which is such as to undermine the Ombudsman’s independence from the executive …”. ⁵¹ EO 14086 mentions that the newly created DPRC acts independently and also lists the conditions for the dismissal of judges; the latter do not report to the Attorney General and are not subject to their supervision or hierarchical relationship. ⁵² As for their impartiality, EO 14086 specifies that “judges” may not combine the function of DPRC judge with other duties, including within the state administration, among other guarantees. This was also noted by the EDPB in his opinion, which emphasised and approved this strong reinforcement of the DPRC’s independence guarantees, albeit with some reservations. ⁵³ Finally, there is the question of the effective powers of the DPRC as recalled by the ECtHR in the aforementioned Klass judgment. ⁵⁴ EO 14086 indicates that the decisions taken by the CLPO and the DPRC have “binding effect” and are intended to “fully redress” any identified violation; moreover, the decisions of the DPRC must be reasoned. ⁵⁵ The new mechanism thus displays several important improvements and considers the ruling of the CJEU. Nevertheless, we believe that these guarantees will not be sufficient to meet the expectation of paragraph 195 of the Schrems II case. One of the reasons for this is that the appointment procedure remains exclusively in the hands of the executive, since the “judge” is appointed by “the Attorney General, in consultation with the Secretary of Commerce, the Director, and the PCLOB [US Privacy and Civil Liberties Oversight Board]”, ⁵⁶ and this can legitimately cast doubt on its true independence from the executive. ⁵⁷ In the EU, the protection of personal data is a fundamental right, and the guarantees surrounding this issue (including Article 47 of the Charter, among others) must be in line with the importance given to it in law. If we add to this the fact that EO 14086 does not define the intelligence activities that fall within its scope and that the “decree” instrument does not offer a sufficient level of legal certainty due to its non-legislative nature, it is reasonable to suggest that the new system will not pass through the review that the CJEU will likely be carrying out unscathed. However, additional limits and safeguards, as described above, have been agreed upon, and it is not entirely out of the question that these could be considered sufficiently clear and precise so as to meet the “substantially equivalent” requirements ensuring, at least formally, an adequate level of protection within the meaning of Article 45 of the GDPR. In this case, the redress mechanism needs to demonstrate in practice that it offers EU data subjects guarantees essentially equivalent to those required by Article 47 of the Charter. It is therefore essential for the Commission to monitor these developments on an ongoing basis and – if necessary – repeal, amend or suspend the decision in accordance with Article 45(4) and (5) of the GDPR.

III. Conclusion

It is always difficult to predict the rulings of the CJEU. However, in our view, the new mechanism only partially complies with the case law of the Court of Justice. Progress has clearly been made, although several “stumbling blocks” – identified in Section II of this article – remain, and it seems unlikely that European judges will validate a system that does not guarantee the high standards of protection for fundamental rights. ⁵⁸

In parallel with this legal analysis of the situation, one must bear in mind two other dimensions: the political and economic dimensions of the question. Irrespective of the CJEU’s understanding of this legal debate, the underlying political question remains: is it realistic to ask for more effort from the USA? There is a fundamental conceptual difference between the two systems, with, on the one hand, the American “privacy” system, stemming from the Fourth Amendment, with a highly sectorialised data protection legislation based on consumer protection, ⁵⁹ and, on the other hand, the European fundamental rights system, with specific norms in primary and secondary law and a right to personal data protection that is distinct and autonomous from the protection of privacy, even though it is often used jointly. ⁶⁰ Moreover, the economic stakes are high for European companies because, in the absence of an adequacy decision, the GDPR places the responsibility for ensuring that the legal system and practices of the third country in question effectively meet the level of protection required in the EU from the data exporter. ⁶¹ This promotes real legal uncertainty and very significant additional costs, especially for medium-sized companies, for example, to put in place standard contractual clauses or other measures ⁶² to organise such a transfer in order to meet EU requirements in the absence of an agreement.

The EU is a Union based on the rule of law and on shared values, yet it is also a pragmatic construction. Nevertheless, this agreement clearly presents it with a dilemma: which of the economic, legal or political dimensions will be privileged?