The U.S. Takes a Huge Next Step Towards GDPR Adequacy

Oct 10, 2022 by Rebecca Knight, CIPP/E, CIPP/US, Counsel, Policy, Privacy Initiatives, BBB National Programs

On October 7, 2022, President Biden signed the Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities (EO), providing the legal basis for a new transatlantic data flow mechanism that will enable the $7.1 trillion economic relationship between the EU and U.S. to continue thriving. The new mechanism, EU-U.S. Data Privacy Framework (DPF), was agreed upon, in principle, by President Biden and European Commission President von der Leyen in March 2022.   

BBB National Programs commended the Executive Order as a positive step in support of the more than 5,000 businesses that rely on Privacy Shield for the transfer of personal data from the EU to the U.S.   

If we break down what it said, the majority of the EO is focused on signals intelligence. The National Security Agency defines signals intelligence (SIGINT) as the collection of “foreign intelligence from communications and information systems,” which in turn, is provided “to customers across the U.S. government, such as senior civilian and military officials.” The information collected is intended to protect U.S. troops, support allies, combat terrorism, fight crime, and assist with diplomatic negotiations. The information itself is collected through a variety of means including foreign communications, radar, and other electronic systems.  

U.S. surveillance programs and activities based on SIGINT served as the Court of Justice of the European Union’s (CJEU) rationale for invalidating the previous EU-U.S. Privacy Shield framework in Schrems II, a decision issued in July 2020.  

In Schrems II, the CJEU reasoned that U.S. surveillance program activities were not limited to what is “strictly necessary” and resulted in “disproportionate interference” with the rights afforded EU citizens under the GDPR. Additionally, the CJEU reasoned there was no redress mechanism for EU subjects against U.S. authorities administering these programs. The EO is a direct response to the CJEU’s concerns.  

To address these concerns, the EO outlines the following safeguards:  

  1. Necessity and proportionate requirement: SIGINT activities should only be used after determining they are reasonable under the circumstances to achieve a legitimate objective and must not disproportionately impact the privacy or civil liberties of an individual.
  2. Legitimate objectives: SIGINT may be used to achieve one of twelve objectives targeting foreign governments, foreign organizations, or foreign individuals.
    • Protecting the national security of the U.S., allies, or partners.
    • Identifying and monitoring terrorist organizations. 
    • Determining global security threats.
    • Protecting against foreign militaries. 
    • Protecting against terrorism.
    • Protecting against intelligence activities. 
    • Protecting against weapons of mass destruction. 
    • Protecting against cybersecurity threats.
    • Protecting against threats to U.S., ally, or partner personnel. 
    • Protecting against transnational criminal threats. 
    • Protecting the integrity of elections and political processes, government property, and U.S. infrastructure. 
    • Advancing the collection or operational capabilities or activities to further one of the legitimate objectives above. 
  3. Oversight mechanisms: SIGINT activities will be subjected to rigorous oversight processes both internally (by the respective intelligence agencies) and externally (by the Privacy and Civil Liberties Oversight Board).  
  4. Redress system: Individuals claiming their personal information was improperly collected through U.S. SIGINT activities may seek redress through a multi-layer mechanism. The first layer is an investigation by the Civil Liberties Protection Officer (CLPO) in the Office of the Director of National Intelligence to determine whether any safeguards or laws were violated. The second layer is a Data Protection Review Court that provides an independent and binding review of the CLPO’s determination. 

 

While this is a huge step towards adequacy under the GDPR, the process has just begun. The EO will serve as the legal basis for the European Commission to make a new adequacy decision. Based on previous adequacy decisions, and if all goes to plan, the DPF will likely take effect by March 2023.  

To learn more about how we got here, and what is expected over the next few months during the EU’s adequacy decision process, read The Next Phase of Privacy Shield. And follow along as we continue to assess this Executive Order and its implications on the Privacy Shield program or sign up to receive our additional insights moving forward from the Privacy Initiatives newsletter. 

If you need support or have questions specific to your Privacy Shield status, please reach out so we can discuss your situation at GlobalPrivacy@bbbnp.org.  

Suggested Articles

Blog

Injunction Junction: NetChoice v. Bonta and Securing the Future of Teen Online Privacy and Safety

While the AADC injunction is not the final word on the constitutionality of California’s approach to regulating online harms, the injunction—and the reasoning that underlies the district court’s decision—raises important questions and creates an entry point to establish a robust minimum bar of protections for teens.
Read more
Blog

Developing Principles and Protocols for Recruiting and Hiring with AI

Employing AI in the recruiting and hiring process voluntarily, under the auspices of independent industry self-regulation, is often far preferable to being forced to do so under a regime of top-down government regulation.
Read more
Blog

A Not-So-Sweet Sixteen? Teen Online Privacy and Safety Faces New Policy Dilemmas

Pop culture powerhouse Barbie teaches us that corporations can have a long-lasting impact on children and teens, and the FTC seems to agree, adopting an aggressive stance on children’s and teen privacy in the last few months. We break down what this means for companies in looking to engage a child or teen audience.
Read more
Blog

Spilling the Tea on AI Accountability: An Analysis of NTIA Stakeholder Comments

The NTIA recently issued a request for comment to gather stakeholder feedback on AI accountability measures and policies to assist in the crafting of a report on AI accountability policy and the AI assurance regime. Nearly 200 organizations responded and we pulled a diverse, representative sample of the responses to summarize stakeholder feedback on this important question.
Read more