The U.S. Senate Thursday confirmed three members, including a new chairman, to the Privacy and Civil Liberties Oversight Board. The news could be potentially significant for the future of transatlantic data flows as it comes just before the European Commission's second annual review of the EU-U.S. Privacy Shield agreement.
Confirmed by voice vote, and posted to Twitter, the Senate approved Adam Klein as PCLOB's new chairman for a term expiring Jan. 29, 2024, as well as Edward Felten and Jane Nitze for terms expiring Jan. 29, 2019 and Jan. 29, 2023, respectively.
Confirmed by Voice Vote: Exec. Cal. #694 Adam Klein to be Chairman and Member of the Privacy and Civil Liberties Oversight Board for a term expiring January 29, 2024
Confirmed by Voice Vote: Exec. Cal. #920 Edward Felten to be a Member of the Privacy and Civil Liberties Oversight Board for the remainder of the term expiring January 29, 2019
— Senate Cloakroom (@SenateCloakroom) October 12, 2018
Confirmed by Voice Vote: Exec. Cal. #921 Jane Nitze to be a Member of the Privacy and Civil Liberties Oversight Board for a term expiring January 29, 2023
— Senate Cloakroom (@SenateCloakroom) October 12, 2018
"By confirming three outstanding candidates for PCLOB, including the new chairman, Adam Klein, the Senate took a critical step to signal how important the U.S. takes privacy and civil liberties concerns," said Sidley Austin Partner Alan Charles Raul in comments provided to The Privacy Advisor. Raul, who once served as vice chairman of PCLOB under former President George W. Bush, echoed that the move could help in the Commission's upcoming review of the Privacy Shield agreement. "The EU has been calling for PCLOB to get back up and running, so the Senate's action should help support a favorable outcome on the annual review of the Privacy Shield."
The board, which was created by President Bush after the 9/11 terrorist attacks, has essentially lain dormant since its previous chairman, David Medine, resigned in 2016. As has been previously reported by the IAPP's Angelique Carson, CIPP/US, PCLOB is an independent agency that ensures the executive branch's counterterrorism efforts are balanced with privacy and civil liberties concerns and that "liberty concerns" are included in the development of counterterrorism laws and regulations.
In addition to providing an advisory role in balancing privacy with counterterrorism issues, PCLOB is a significant component of Privacy Shield. After its first annual joint review in late 2017, the Article 29 Working Party (now the European Data Protection Board since the implementation of the EU General Data Protection Regulation) concluded, among other concerns, that "PCLOB members ... should be appointed."
Alston & Bird Senior Counsel Peter Swire, CIPP/US, said, "Confirmation of the PCLOB board members is welcome, although long overdue."
Center for Democracy & Technology President and CEO Nuala O'Connor, CIPP/G, CIPP/US, agreed, in an emailed statement to The Privacy Advisor. "The PCLOB has been inactive for too long, and these confirmations come moments before the U.S. government's failure to sustain a vibrant PCLOB was about to be criticized by the European delegation during the Privacy Shield review."
Indeed, last summer, the European Parliament voted to suspend Privacy Shield unless it took corrective actions, including the restaffing of PCLOB and the naming by the U.S. State Department of an independent ombudsperson to review complaints from EU citizens. Relatedly, on Sept. 28, the State Department designated Manisha Singh as Privacy Shield Ombudsperson.
Not long after, earlier this month, U.S. Ambassador Gordon Sondland said the U.S. is "fully compliant" with the Shield.
At a hearing of the Senate Judiciary Committee in January, Klein emphasized his dedication to civil liberties. That same month, EU Justice Commissioner Vera Jourova's head of cabinet, Renate Nikolay, said the commission expects "this U.S. administration ... to fill these important positions because they are one of the key important novelties of this regime of the Privacy Shield."
The PCLOB has a long — and at times difficult — road. As Carson reported, the board has undergone three incarnations and times of dormancy since its creation in 2001. It's an issue that Swire says should be addressed. "Going forward," he said in an email to The Privacy Advisor, "Congress should consider measures to enable the board to function more effectively when there are vacant board positions."
Raul also suggested the EU has a role to fill.
"It would also be great if the EU and its member states set up their own version of PCLOB to ensure that government surveillance in Europe is subject to ongoing privacy advice and oversight to a similar extent as it is in the U.S. If the EU did set up such a review body, it might be a good counterpart to PCLOB and help harmonize oversight of government surveillance in the EU and the U.S. Right now, the U.S. does not really have a relevant interlocutor to discuss the proper balance between privacy and surveillance. Since the EU data protection authorities do not have jurisdiction over national security issues establishing another avenue of dialogue could be highly beneficial to ameliorate U.S.-EU privacy tensions."
The confirmation of Felten was also applauded. O'Connor said the CDT is "delighted" that he and the other members were confirmed. Swire also highlighted Felten's technological background. "The inclusion of Ed Felten on the board illustrates the importance of having expect technologists in oversight positions, to complement those expert in law, intelligence and other disciplines."