The U.S. Takes a Huge Next Step Towards GDPR Adequacy

Oct 10, 2022 by Rebecca Knight, CIPP/E, CIPP/US, Counsel, Policy, Privacy Initiatives, BBB National Programs

On October 7, 2022, President Biden signed the Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities (EO), providing the legal basis for a new transatlantic data flow mechanism that will enable the $7.1 trillion economic relationship between the EU and U.S. to continue thriving. The new mechanism, EU-U.S. Data Privacy Framework (DPF), was agreed upon, in principle, by President Biden and European Commission President von der Leyen in March 2022.   

BBB National Programs commended the Executive Order as a positive step in support of the more than 5,000 businesses that rely on Privacy Shield for the transfer of personal data from the EU to the U.S.   

If we break down what it said, the majority of the EO is focused on signals intelligence. The National Security Agency defines signals intelligence (SIGINT) as the collection of “foreign intelligence from communications and information systems,” which in turn, is provided “to customers across the U.S. government, such as senior civilian and military officials.” The information collected is intended to protect U.S. troops, support allies, combat terrorism, fight crime, and assist with diplomatic negotiations. The information itself is collected through a variety of means including foreign communications, radar, and other electronic systems.  

U.S. surveillance programs and activities based on SIGINT served as the Court of Justice of the European Union’s (CJEU) rationale for invalidating the previous EU-U.S. Privacy Shield framework in Schrems II, a decision issued in July 2020.  

In Schrems II, the CJEU reasoned that U.S. surveillance program activities were not limited to what is “strictly necessary” and resulted in “disproportionate interference” with the rights afforded EU citizens under the GDPR. Additionally, the CJEU reasoned there was no redress mechanism for EU subjects against U.S. authorities administering these programs. The EO is a direct response to the CJEU’s concerns.  

To address these concerns, the EO outlines the following safeguards:  

  1. Necessity and proportionate requirement: SIGINT activities should only be used after determining they are reasonable under the circumstances to achieve a legitimate objective and must not disproportionately impact the privacy or civil liberties of an individual.
  2. Legitimate objectives: SIGINT may be used to achieve one of twelve objectives targeting foreign governments, foreign organizations, or foreign individuals.
    • Protecting the national security of the U.S., allies, or partners.
    • Identifying and monitoring terrorist organizations. 
    • Determining global security threats.
    • Protecting against foreign militaries. 
    • Protecting against terrorism.
    • Protecting against intelligence activities. 
    • Protecting against weapons of mass destruction. 
    • Protecting against cybersecurity threats.
    • Protecting against threats to U.S., ally, or partner personnel. 
    • Protecting against transnational criminal threats. 
    • Protecting the integrity of elections and political processes, government property, and U.S. infrastructure. 
    • Advancing the collection or operational capabilities or activities to further one of the legitimate objectives above. 
  3. Oversight mechanisms: SIGINT activities will be subjected to rigorous oversight processes both internally (by the respective intelligence agencies) and externally (by the Privacy and Civil Liberties Oversight Board).  
  4. Redress system: Individuals claiming their personal information was improperly collected through U.S. SIGINT activities may seek redress through a multi-layer mechanism. The first layer is an investigation by the Civil Liberties Protection Officer (CLPO) in the Office of the Director of National Intelligence to determine whether any safeguards or laws were violated. The second layer is a Data Protection Review Court that provides an independent and binding review of the CLPO’s determination. 

 

While this is a huge step towards adequacy under the GDPR, the process has just begun. The EO will serve as the legal basis for the European Commission to make a new adequacy decision. Based on previous adequacy decisions, and if all goes to plan, the DPF will likely take effect by March 2023.  

To learn more about how we got here, and what is expected over the next few months during the EU’s adequacy decision process, read The Next Phase of Privacy Shield. And follow along as we continue to assess this Executive Order and its implications on the Privacy Shield program or sign up to receive our additional insights moving forward from the Privacy Initiatives newsletter. 

If you need support or have questions specific to your Privacy Shield status, please reach out so we can discuss your situation at GlobalPrivacy@bbbnp.org.  

Suggested Articles

Blog

Old MacDonald Had an Engagement Farm: Lessons Learned from FTC v. NGL

Capturing user engagement is the foundation of internet commerce. And while the incentives to prompt greater engagement are certainly understandable, the recent NGL Labs case from the FTC raises important questions about the ethical and legal ramifications when companies try to artificially generate engagement among their userbase.
Read more
Blog

Independence Day Edition: CBPR Framework Offers “Checks & Balances”

Going, Going, Gone Global, a webinar on the CBPR Global Forum, delved into how privacy impacts businesses’ brand reputation and builds trust with key stakeholders, discussed the purpose of the Global CBPR, and its value to Global Forum members.
Read more
Blog

Industry Self-Regulation: Part of the Solution for Governing Generative AI

The spotlight on generative AI remains bright. The benefits and risks continue to be ever-present in the minds of business and political leaders. No matter the timing or the setting, the creation of transparency, accountability, and collaboration among stakeholders is key to successful industry self-regulation as is the importance of setting standards and best practices.
Read more
Blog

The Demise of “Chevron Deference”: Who Will Fill the Regulatory Gaps?

The Supreme Court's 1984 ruling in Chevron v. NRDC held that courts should defer to federal agencies’ interpretations of ambiguous federal laws so long as those interpretations are reasonable. So given the court’s decision to overturn it, where does that leave companies that want a level playing field and perhaps even to raise the bar, instead of racing to the bottom?
Read more