Date Transfers Post Schrems

Date Transfers Post Schrems Presented by: Mrs. Flanagan Date: 23th April 2024 EU US Data Privacy Framework - Executive Order 14086 On Enhancing Safeguards For United States Signals Intelligence Activities • SIGINT only pursuant to law, EO, other Presidential Directive • In compliance with Constitution, EOs and other statutes • Only where necessary to advance a validated intelligence priority, with oversight for identified legitimate objectives • Subject to safeguards for which privacy is an integral consideration Executive Order 14086 - Bulk collection only where determined that can't reasonably be obtained by targeted collection • Reasonable methods to ensure limited to what is necessary for the legitimate objective and minimizing other data collection - Access and use only for identified objectives by trained persons with need to know for their mission - Policies for minimization of dissemination and retention • Subject to same rules/considerations as would apply to that of US citizens EO 14086 - Update and review of policies to implement EO's privacy safeguards • Including by Privacy and Civil Liberties Oversight Board (PCLOB) (Independent agency created in 2007) • Public release to extent possible - Security and prevention of access by non-authorized persons - Reasonable documentation of the factual basis pursuant to which collection activity is found necessary to advance a validated intelligence priori EO 14086 - Oversight at each agency level, including Inspector General and a Privacy and Civil Liberties and compliance Officers • No action to influence their responsibilities - Training of all employees with access to SIGINT - Reporting of significant non-compliance incidents to agency/dept head and Director of National Intelligence - SIGINT Redress Mechanism procedure for complaints transmitted by national authorities SIGINT Redress Mechanism - Not found/remediation ordered after investigation by Civil Liberties Protection Officer of the Office of the Director of National Intelligence (CLPO) • Binding effect of remedy subject to Review Court contrary determination if disagrees with CLPO - Either complainant or intelligence community can appeal to EO/AG Regulationcreated, independent Data Protection Review Court (DOJ) • Appointed special advocate for complainant's interest • Classified report of CLPO findings to Review Court • Binding effect of decision Participating Organizations - Those regulated by the Department of Transportation and Federal Trade Commission - Registration with Department of Commerce • List of participants with types of data, contact info, redress mechanisms - Compliance with Principles Resolving a Complaint - Redress Process • Complaint to organization (45 days to respond) • Complaint to free, independent redress organization • Complaint to national DPA → DOC (90 days) • Binding arbitration recourse (Contribution to fund)  authority to impose individual-specific, non-monetary equitable relief (such as access, correction deletion, or return of the individual's data in question) necessary to remedy the violation of the EU-U.S. DPF Principles only • Contact the US regulator  FTC does not resolve individual complaints or regulate some entities Some Thoughts - Executive Orders are legally enforceable (See, Congressional Research Service, Executive Orders: An Introduction (March 2021) • Legislature can't change them, but subject to court challenge • Must be grounded in Constitutional authority (Article II) or statutory power • Can be revoked or amended by subsequent EO  So, permanence is not a guarantee - EO 14086 has sought to address Schrems II findings, but lack of guaranteed permanence may be an issue - The Data Protection Review Court is operational - But, if while it is in place it stands up to challenge, it will benefit transfers to US under any 'appropriate safeguards' mechanism - • Reforms re: SIGINT not limited to DPF • So, cases like Meta that included the 2021 SCCs would be resolved Does not resolve other non-adequate country transfer issues - Noted that transfers to other "Five Eyes" countries, several of which have adequacy decisions, have yet to be challenged - DPAs still charged by Schrems I to investigate complaints and bring question before courts