{"id":5250,"date":"2022-10-08T13:38:07","date_gmt":"2022-10-08T13:38:07","guid":{"rendered":"https:\/\/petersantilli.com\/?p=5250"},"modified":"2022-10-08T13:38:10","modified_gmt":"2022-10-08T13:38:10","slug":"president-biden-signs-executive-order-aimed-at-legal-reboot-of-eu-us-data-flows","status":"publish","type":"post","link":"https:\/\/petersantilli.com\/?p=5250","title":{"rendered":"President Biden signs executive order aimed at legal reboot of EU-US data flows"},"content":{"rendered":"

October 8, 2022 at 09:36AM President Biden signs executive order aimed at legal reboot of EU-US data flows<\/strong><\/em><\/p>\n

\n
\n
\n
\n
\n

U.S. president Joe Biden has signed an executive order attached to reupping a flagship data transfer agreement with the European Union \u2014 with the goal of making life easier for businesses that need to export EU user-data to the U.S. for processing.<\/p>\n

The White House announced the development in a statement<\/a> today \u2014 saying that the \u201cExecutive Order on Enhancing Safeguards for United States Signals Intelligence Activities\u201d would \u201cdirect the steps\u201d that the U.S. will take to implement its commitments under the EU-U.S. Data Privacy Framework (EU-U.S. DPF), as the new arrangement is being called.<\/p>\n

The new framework is intended to replace the defunct EU-U.S. Privacy Shield (which was invalidated by the bloc\u2019s top court back in July 2020<\/a>); and its much longer-lived predecessor, Safe Harbor (struck down by the CJEU in October 2015<\/a>, following the 2013 disclosures of U.S. government surveillance programs by NSA whistleblower, Edward Snowden).<\/p>\n

So this is yet another (third time lucky?) attempt to bridge the gap between two very different legal frameworks in order to ensure that EU users\u2019 personal data can keep flowing over the pond.<\/p>\n

Thousands of businesses, large and small, had relied upon earlier EU-U.S. data transfer deals to authorize their data exports \u2014 greasing the pipes of what the White House refers to as a $7.1TR EU-U.S. \u201ceconomic relationship\u201d.<\/p>\n

But for the last two years there\u2019s essentially been no risk-free legal route<\/a>. And there still isn\u2019t.<\/p>\n

Although the EU responded<\/a>\u00a0to Biden signing the EO by saying it will now move to draft an adequacy decision and initiate the adoption process.<\/p>\n

\u2018Safeguards for signals intelligence\u2019<\/h2>\n

The White House press release said president Biden\u2019s executive order beefs up safeguards around U.S. \u201csignals intelligence\u201d (aka digital surveillance conducted by spy agencies) by \u201crequiring that such activities be conducted only in pursuit of defined national security objectives\u201d; by \u201ctak[ing] into consideration the privacy and civil liberties of all persons, regardless of nationality or country of residence; and by being \u201cconducted only when necessary to advance a validated intelligence priority and only to the extent and in a manner proportionate to that priority\u201d.<\/p>\n

The EO also mandates \u201chandling requirements\u201d for personal data picked up via signals intelligence and beefs up enforcement around non-compliance. Elements of the US Intelligence Community will also be required to update their policies and procedures to reflect the \u201cnew privacy and civil liberties safeguards contained in the E.O.\u201d, per the press release.<\/p>\n

Another change is the creation of \u201ca multi-layer\u201d redress mechanism for EU individuals in the EU to obtain \u201cindependent and binding review and redress\u201d on claims that their personal data was gathered in violation of applicable U.S. law.<\/p>\n

This consists of \u2014 in the first layer \u2014 a Civil Liberties Protection Officer (CLPO) in the Office of the Director of National Intelligence who will conduct a preliminary investigation \u201cof qualifying complaints received \u201d to decide whether there has been a violation and, if so, determine appropriate next steps.<\/p>\n

\u201cThe E.O. builds up the existing statutory CLPO functions by establishing that the CLPO\u2019s decision will be binding on the Intelligence Community, subject to the second layer of review, and provides protections to ensure the independence of the CLPO\u2019s investigations and determinations,\u201d the White House writes.<\/p>\n

The second layer entails the EO authorizing and directing the Attorney General to establish a Data Protection Review Court (DPRC) to \u201cprovide independent and binding review of the CLPO\u2019s decisions, upon an application from the individual or an element of the Intelligence Community\u201d.<\/p>\n

Much will hinge on whether this body will be properly judged \u2018court enough\u2019 \u2014 under EU law \u2014 and therefore competent to uphold and defend EU citizens\u2019 rights or not.<\/p>\n

\u201cJudges on the DPRC will be appointed from outside the US Government, have relevant experience in the fields of data privacy and national security, review cases independently, and enjoy protections against removal,\u201d the White House writes. \u201cDecisions of the DPRC regarding whether there was a violation of applicable US law and, if so, what remediation is to be implemented will be binding.<\/p>\n

\u201cTo further enhance the DPRC\u2019s review, the EO.provides for the DPRC to select a special advocate in each case who will advocate regarding the complainant\u2019s interest in the matter and ensure that the DPRC is well-informed of the issues and the law with regard to the matter. The Attorney General today issued accompanying regulations on the establishment of the DPRC.\u201d<\/p>\n

The EO also calls on the (existing) U.S. Privacy and Civil Liberties Oversight Board <\/a>to review the polices and procedures of U.S. spy agencies to ensure consistency with what the order calls for; and conduct an annual review of the redress process, including to check whether intelligence agencies have fully complied with determinations made by the CLPO and the DPRC.<\/p>\n

\u201cThese steps will provide the European Commission with a basis to adopt a new adequacy determination, which will restore an important, accessible, and affordable data transfer mechanism under EU law. It will also provide greater legal certainty for companies using Standard Contractual Clauses and Binding Corporate Rules to transfer EU personal data to the United States,\u201d the White House suggests.<\/p>\n

Responding to the EO being signed, the Commission said it contains \u201csignificant improvements\u201d vs Privacy Shield\u2019s mechanisms.<\/p>\n

\u201cAt that time, individuals could turn to an Ombudsperson, which was part of the US State Department and did not have similar investigatory or binding decision-making powers,\u201d it noted in a press release<\/a>.<\/p>\n

\u201cThe objective of the Commission in these negotiations has been to address the concerns raised by the Court of Justice of the EU in the\u00a0Schrems II<\/em> judgment and provide a durable and reliable legal basis for transatlantic data flows. This is reflected in the safeguards included in the Executive Order, regarding both the substantive limitation on US national security authorities\u2019 access to data (necessity and proportionality) and the establishment of the new redress mechanism,\u201d it added.<\/p>\n

Political agreement on a new EU-U.S. data transfers deal was announced with much high level fanfare, back in March<\/a>.<\/p>\n

EU commissioners had initially suggested the process might be finalized by the end of this year. However things appears to have moved at a\u00a0 slower pace than originally anticipated \u2014 so it now looks unlikely that all the necessary steps will be completed in time for the framework to be adopted before 2023.<\/p>\n

EU review before adoption<\/h2>\n

With Biden\u2019s ink dry on the EO, the baton now passes back to the EU to consider whether the framework passes muster.<\/p>\n

A number of EU institutions will be involved in reviewing the framework, including the European Data Protection Board and representatives of Member States (and the European Parliament), although the final decision is the Commission\u2019s alone.<\/p>\n

And the EU\u2019s executive can \u2014 and often does \u2014 override concerns raised during the review process (hence two strikedowns already despite plenty of objections raised to Privacy Shield prior to its adoption, in the most recent example\u2026 ).<\/p>\n

The EU\u2019s executive and the U.S. administration will both be keen for the new framework to stick and \u2014 ideally \u2014 prove robust enough to see off any legal challenges. But even if it only sticks in the short term (a few years) the prevailing view may be that is \u2018fix\u2019 enough \u2014 as it allows for \u2018business as usual\u2019 for cross-border data flows, getting both sides out of an immediate bind on the legality of trade-related data flows.<\/p>\n

Tech giants, including Facebook and Google, will also be crossing their pinkies that the DPF sticks \u2014 and quickly \u2014 as both have been facing disruption to their businesses and ability to serve customers in the region.<\/p>\n

Facebook narrowly avoided a looming shutdown of its EU-U.S. data flows this summer<\/a> \u2014 after objections were raised to a draft regulatory decision ordering them to be suspended, adding months more to the process (and potentially enough time for it to avoid a shutdown altogether if the EU adopts the DPF). So it\u2019s now a race to see what lands first: The DPF or an order to Facebook to shut off EU-to-U.S. data flows.<\/p>\n

Google has also faced disruption to its customers, following scores of complaints targeting users of Google Analytics which led, in recent months, to a number of EU DPAs to warn against use of the tool in its standard configuration<\/a> \u2014 saying such use breaches the EU\u2019s General Data Protection Regulation and supplementary measures would need to be applied to raise the standard of data protection to the required level.<\/p>\n

Thousands of smaller businesses also need legal certainty around their cross-border data flows, of course. And tech industry associations of all stripes were quick to welcome the signing of the EO \u2014 and urge EU adoption swiftly.<\/p>\n

A statement by one industry group \u2014 calling itself the Reform Government Surveillance coalition<\/a> (whose members include Amazon, Apple, Dropbox, Evernote, Google, Meta, Microsoft, Snap Inc., Twitter, Yahoo (TC\u2019s parent), and Zoom) \u2014 welcomed the signing of the EO and what they dubbed its \u201crobust new privacy protections\u201d. However despite sporting a name with such a reforming-zeal vibe to it, the industry lobby group did not call for more root-and-branch changes to U.S. surveillance practices \u2014 instead offering the flattering line that: \u201cWe recognize and appreciate the effort of the US Government in finalizing its implementation of the Framework.\u201d<\/p>\n

Other responses to the EO\u2019s signing were less fulsomely welcoming.<\/p>\n

BEUC, the European Consumer Organization, warned in a statement that there are still \u201cfundamental differences in the level of privacy and data protection in the US and the EU which remain too large to make up for, despite the additional safeguards the US side is proposing to build in\u201d \u2014 and urged data protection authorities to \u201cscrutinise any new data transfer agreement with rigour\u201d. \u201cNobody wants more legal uncertainty,\u201d it added. \u201cWe need a long-lasting solution to make sure consumers can trust that their data is safe wherever it goes.\u201d<\/p>\n

While Max Schrems, the lawyer and European privacy campaigner whose earlier legal challenges brought down Privacy Shield and Safe Harbor, warned that the agreement looks like a fudge \u2014 suggesting, for example, that both sides have agreed to use some of the same words but have not agreed on what the terms mean, and arguing it would therefore likely come unstuck under legal scrutiny.<\/p>\n

\u201cThe EU and the US now agree on use of the word \u2018proportionate\u2019 but seem to disagree on the meaning of it. In the end, the CJEU\u2019s definition will prevail \u2014 likely killing any EU decision again. The European Commission is again turning a blind eye on US law, to allow continued spying on Europeans,\u201d he said in a reaction statement, adding: \u201cWe will analyze this package in detail, which will take a couple of days. At first sight it seems that the core issues were not solved and it will be back to the CJEU sooner or later.\u201d<\/p>\n

Schrems also pointed to the redress body the EO establishes not being a real court \u2014 which he said could also be a problem.<\/p>\n

\u201cWe have to study the proposal in detail but at first glance, it is clear that this \u2018court\u2019 is simply not a court. The Charter has a clear requirement for \u2018judicial redress\u2019 \u2014 just renaming some complaints body a \u2018court\u2019 does not make it an actual court,\u201d he said. \u201cThe details of the procedure will also be relevant to see if this can satisfy EU law.\u201d<\/p>\n

\u201cIt is amazing that the EU and the US actually agree that wiretapping needs probable cause and judicial approval. However, the US takes the view that foreigners don\u2019t have privacy rights,\u201d Schrems added. \u201cI doubt that the US has a future as the cloud provider of the world, if non-US persons have no rights under their laws. It is contradictory to me that the European Commission is working on a deal that accepts that Europeans are \u2018second class\u2019 citizens and don\u2019t deserve the same privacy rights as US citizens.\u201d<\/p>\n

When\/if the DPF is adopted by the Commission \u2014 most likely next year \u2014 legal challenges remain highly likely since the fundamental clash between U.S. national-security-focused surveillance law and EU fundamental privacy rights still hasn\u2019t gone anywhere.<\/p>\n

Legal experts will certainly be poring over the EO in detail once they get their hands on the text.<\/p>\n

\u201cFrom the FactSheet: It is a solid improvement compared to 2016. But I want to also see the EO [text],\u201d Dr. Gabriela Zanfir-Fortuna, VP for global privacy at the Washington-based thinktank, the Future of Privacy Forum, told TechCrunch \u2014 offering a snap first response.<\/p>\n

She also pointed to a line in the White House release \u2014 in which the U.S. talks about \u201cqualifying states\u201d which it says will be \u201cdesignated under the EO\u201d, meaning that the US will itself decide \u2014 positing that it might be \u201clooking at some form of reciprocity of sorts\u201d in the national security area.<\/p>\n

Edward Machin, a senior lawyer in Ropes & Gray\u2019s data, privacy & cybersecurity practice, also told TechCrunch: \u201cWe\u2019re getting closer to European standards than under previous frameworks, although concerns remain about the long-term viability of an Executive Order. The proportionality and retention requirements look tighter and the older redress mechanism is improved. But it is enough? No one knows right now.\u201d<\/p>\n

Should a fresh cycle of data transfer litigation kick off, it will of course keep European privacy campaigners and data protection lawyers busy for years to come.<\/p>\n

They remain busy enough now, though, as the question of where (and how) EU users\u2019 data is stored remains a worry for businesses exporting it to third countries like the U.S. that lack EU adequacy \u2014 with a real prospect of regulatory enforcement in the meanwhile.<\/p>\n

Further rounds of regulatory whack-a-mole would also be inevitable if this \u2018third time lucky\u2019 framework topples, restarting the data transfer complaint cycle once again. So we can all probably expect to be back in a fresh legal limbo soon enough.<\/p>\n

This report was updated with additional comment.\u00a0<\/em><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

via TechCrunch<\/p>\n","protected":false},"excerpt":{"rendered":"

October 8, 2022 at 09:36AM President Biden signs executive order aimed at legal reboot of EU-US data flows U.S. president Joe Biden has signed an executive order attached to reupping a flagship data transfer agreement with the European Union \u2014 with the goal of making life easier for businesses that need to export EU user-data […]<\/p>\n","protected":false},"author":1,"featured_media":5253,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[8,225],"tags":[103],"class_list":["post-5250","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-featured-stories","category-technocracy","tag-sbn"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/petersantilli.com\/wp-content\/uploads\/2022\/10\/B3-Napolitano1_c0-87-1800-1136_s1770x1032.jpg?fit=1770%2C1032&ssl=1",1770,1032,false],"thumbnail":["https:\/\/i0.wp.com\/petersantilli.com\/wp-content\/uploads\/2022\/10\/B3-Napolitano1_c0-87-1800-1136_s1770x1032.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/petersantilli.com\/wp-content\/uploads\/2022\/10\/B3-Napolitano1_c0-87-1800-1136_s1770x1032.jpg?fit=300%2C175&ssl=1",300,175,true],"medium_large":["https:\/\/i0.wp.com\/petersantilli.com\/wp-content\/uploads\/2022\/10\/B3-Napolitano1_c0-87-1800-1136_s1770x1032.jpg?fit=768%2C448&ssl=1",768,448,true],"large":["https:\/\/i0.wp.com\/petersantilli.com\/wp-content\/uploads\/2022\/10\/B3-Napolitano1_c0-87-1800-1136_s1770x1032.jpg?fit=1024%2C597&ssl=1",1024,597,true],"rpg_gallery_admin_thumb":["https:\/\/i0.wp.com\/petersantilli.com\/wp-content\/uploads\/2022\/10\/B3-Napolitano1_c0-87-1800-1136_s1770x1032.jpg?resize=150%2C150&ssl=1",150,150,true],"rpg_gallery_thumb":["https:\/\/i0.wp.com\/petersantilli.com\/wp-content\/uploads\/2022\/10\/B3-Napolitano1_c0-87-1800-1136_s1770x1032.jpg?resize=150%2C150&ssl=1",150,150,true],"1536x1536":["https:\/\/i0.wp.com\/petersantilli.com\/wp-content\/uploads\/2022\/10\/B3-Napolitano1_c0-87-1800-1136_s1770x1032.jpg?fit=1536%2C896&ssl=1",1536,896,true],"2048x2048":["https:\/\/i0.wp.com\/petersantilli.com\/wp-content\/uploads\/2022\/10\/B3-Napolitano1_c0-87-1800-1136_s1770x1032.jpg?fit=1770%2C1032&ssl=1",1770,1032,true]},"author_info":{"info":["Peter Santilli"]},"category_info":"Featured Stories<\/a> Technocracy<\/a>","tag_info":"Technocracy","comment_count":"0","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/plD2r-1mG","jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/petersantilli.com\/wp-content\/uploads\/2022\/10\/B3-Napolitano1_c0-87-1800-1136_s1770x1032.jpg?fit=1770%2C1032&ssl=1","_links":{"self":[{"href":"https:\/\/petersantilli.com\/index.php?rest_route=\/wp\/v2\/posts\/5250","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/petersantilli.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/petersantilli.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/petersantilli.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/petersantilli.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5250"}],"version-history":[{"count":0,"href":"https:\/\/petersantilli.com\/index.php?rest_route=\/wp\/v2\/posts\/5250\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/petersantilli.com\/index.php?rest_route=\/wp\/v2\/media\/5253"}],"wp:attachment":[{"href":"https:\/\/petersantilli.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/petersantilli.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/petersantilli.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}