Though the headline announcing the European Commission’s report on the third annual review of the EU-U.S. Privacy Shield was banal, several paragraphs within the report were anything but.

In its report and accompanying staff working document, the European Commission cited one “clarification” and three court cases with the potential to influence the outcome of the Schrems II case currently pending before the Court of Justice of the European Union. These commission findings relate to the independence of oversight of U.S. government access to EU personal data and judicial review of the same. Ostensibly, these commission holdings could chart a path for a CJEU decision that would reaffirm the sufficiency of protections under the U.S. legal framework for government access to private-sector data.

These statements and their relationship to the Schrems II case are well worth considering.

Focus of Schrems II

The Schrems II case focuses on whether EU-approved standard contractual clauses provide protections that meet EU legal requirements for personal data transferred by a company in the EU to a company in the United States, considering the potential for U.S. government access to that data. To address this question, the court has been asked to consider issues of form and substance, including what the appropriate comparator is when assessing U.S. national security oversight – EU law, member state law or member state practices – as well as whether a commercial instrument could ever provide sufficient protection since it cannot bind government parties. If the court addresses the substance of U.S. legal protections, the key question before it is whether U.S. oversight of national security and law enforcement access to personal data provides EU individuals an effective remedy before an independent tribunal if their rights are violated, as required by Article 47 of the Charter of Fundamental Rights of the European Union.

In its initial Schrems decision in 2015, the CJEU outlined its interpretation of “an effective remedy before an independent tribunal.” In part, that decision stated,

In Schrems II, the Court could choose to assess whether that exists in the United States today.   

Relevance of Privacy Shield to Schrems II

Why is a report on the review of the functioning of the Privacy Shield Framework relevant to a court case challenging standard contractual clauses?  

Privacy Shield is relevant to Schrems II for three reasons. First, the text of the Privacy Shield Framework links the two data transfer instruments. The Framework’s Annex A states that the Privacy Shield Ombudsperson mechanism will be followed for “requests relating to national security access to data transmitted from the EU to the United States pursuant to the Privacy Shield, standard contractual clauses …” and basically all other current or potential future transfer mechanisms.

Second, the Privacy Shield Framework letters describing safeguards and limitations applicable to U.S. national security authorities and safeguards and limitations on U.S. government access for law enforcement and public interest purposes are descriptive in nature and not tied to any particular data transfer mechanism. Since the annual Privacy Shield review is an assessment of the functioning of all aspects of the framework, it includes a detailed discussion of updates relevant to the oversight described in these letters.

And finally, the Irish High Court linked Privacy Shield to the Schrems II case directly by asking, in the questions it referred to the CJEU, about the relevance of the European Commission’s adequacy determination for Privacy Shield to the questions at hand and whether the Ombudsperson mechanism in conjunction with the existing U.S. regime constitutes a sufficient remedy for data subjects under EU law.

Noteworthy commission findings in the Privacy Shield review

The report on the third annual review offers insights into how the European Commission is thinking about each of those questions referred to the CJEU. Four of the commission’s findings merit attention.

First, the commission’s staff working document states,

This commission finding speaks to the standard laid down by the CJEU that an effective remedy must include the ability to erase data. This Commission statement and confirmation by U.S. authorities is also particularly noteworthy at this juncture, as the IG of the intelligence community recently demonstrated that the powers and independence of his office are not merely theoretical, but incredibly strong in practice.

Second, the commission cites Fazaga v. FBI, explaining that the case “clarified the procedure under FISA that applies when the U.S. government invokes the State secrets evidentiary privilege.” The commission writes that “the Court of Appeal of the Ninth Circuit held that the procedure under FISA that provides for judicial review of secret evidence (50 USC §1806(f)) takes precedence over the State secrets evidentiary privilege…. This ensures independent judicial review of information obtained through electronic surveillance under FISA, including in situations where it could otherwise be withheld by the government on national security grounds.” According to the commission, this case demonstrates that the U.S. government cannot thwart judicial review in the national security context by withholding evidence in the name of national security. Rather, in cases involving state secrets and FISA claims, the government must submit the evidence to the court, even if the review is in camera and ex parte.

Third, the commission raises ACLU v. National Security Agency, which it notes, “concerned a request under the Freedom of Information Act … seeking the disclosure of documents concerning the U.S. government’s surveillance powers under EO 12333.” The commission writes that, “[t]he Court of Appeal upheld that the requested documents could not be disclosed, in accordance with exemptions provided under FOIA.” But, it goes on to say, “[w]hat matters is that an independent court can review the use of the exception by the intelligence community (and order disclosure in case of abuse), which is what happened in this particular case.” Hence, the Commission acknowledges that, like other sovereigns, the U.S. government benefits from certain exemptions from full FOIA disclosure, and it points out that under ACLU v. NSA, the U.S. government’s authority to withhold data in the national security arena is restricted by judicial review, and that there is an avenue to obtain data that has been withheld inappropriately.

Fourth, the commission cites Wikimedia v. National Security Agency, which is still pending, noting that, “[t]he case concerns a challenge to the lawfulness of the Upstream program under Section 702 FISA under the Electronic Communications Privacy Act and the Administrative Procedures Act. It is based on publicly available information about how Section 702 FISA operates (including the PCLOB report) and Wikimedia's assertion that, given its large volume of global internet communications, it is extremely likely that some of its data has been intercepted through the Upstream program. The trial court granted the U.S. government's motion to dismiss for lack of standing, but the appellate court reversed that decision, finding that Wikimedia's allegations met the legal requirements of the standing doctrine.”  In the past, EU authorities expressed concern that U.S. standing requirements would create a de facto bar to judicial redress in the national security context. EU authorities claimed that plaintiffs would purportedly be barred from accessing classified material needed to prove they were directly impacted by U.S. surveillance practices. The appellate court’s decision regarding standing promises prospective plaintiffs’ access to justice in similar cases.

What happens next?

Taken together, these commission findings present a path that EU individuals could pursue to challenge the secrecy and legality of U.S. government surveillance. Through this report, has the commission provided the CJEU a roadmap to find that U.S. oversight of national security and law enforcement access to personal data provides EU individuals an effective remedy before an independent tribunal if their rights are violated? On December 12, the Advocate General is expected to release his opinion in the Schrems II case and provide a sense of whether these findings are impactful.

Photo credit: Image provided by the Court of Justice of the European Union.