TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

Westin Research Center | The Privacy Shield review and its potential to impact Schrems II Related reading: Notes from the IAPP Europe Managing Director, 22 Nov. 2019

rss_feed
GDPR-Ready_300x250-Ad

Though the headline announcing the European Commission’s report on the third annual review of the EU-U.S. Privacy Shield was banal, several paragraphs within the report were anything but.

In its report and accompanying staff working document, the European Commission cited one “clarification” and three court cases with the potential to influence the outcome of the Schrems II case currently pending before the Court of Justice of the European Union. These commission findings relate to the independence of oversight of U.S. government access to EU personal data and judicial review of the same. Ostensibly, these commission holdings could chart a path for a CJEU decision that would reaffirm the sufficiency of protections under the U.S. legal framework for government access to private-sector data.

These statements and their relationship to the Schrems II case are well worth considering.

Focus of Schrems II

The Schrems II case focuses on whether EU-approved standard contractual clauses provide protections that meet EU legal requirements for personal data transferred by a company in the EU to a company in the United States, considering the potential for U.S. government access to that data. To address this question, the court has been asked to consider issues of form and substance, including what the appropriate comparator is when assessing U.S. national security oversight – EU law, member state law or member state practices – as well as whether a commercial instrument could ever provide sufficient protection since it cannot bind government parties. If the court addresses the substance of U.S. legal protections, the key question before it is whether U.S. oversight of national security and law enforcement access to personal data provides EU individuals an effective remedy before an independent tribunal if their rights are violated, as required by Article 47 of the Charter of Fundamental Rights of the European Union.

In its initial Schrems decision in 2015, the CJEU outlined its interpretation of “an effective remedy before an independent tribunal.” In part, that decision stated,

format_quote“legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter. The first paragraph of Article 47 of the Charter requires everyone whose rights and freedoms guaranteed by the law of the European Union are violated to have the right to an effective remedy before a tribunal in compliance with the conditions laid down in that article. The very existence of effective judicial review designed to ensure compliance with provisions of EU law is inherent in the existence of the rule of law.”

In Schrems II, the Court could choose to assess whether that exists in the United States today.   

Relevance of Privacy Shield to Schrems II

Why is a report on the review of the functioning of the Privacy Shield Framework relevant to a court case challenging standard contractual clauses?  

Privacy Shield is relevant to Schrems II for three reasons. First, the text of the Privacy Shield Framework links the two data transfer instruments. The Framework’s Annex A states that the Privacy Shield Ombudsperson mechanism will be followed for “requests relating to national security access to data transmitted from the EU to the United States pursuant to the Privacy Shield, standard contractual clauses …” and basically all other current or potential future transfer mechanisms.

Second, the Privacy Shield Framework letters describing safeguards and limitations applicable to U.S. national security authorities and safeguards and limitations on U.S. government access for law enforcement and public interest purposes are descriptive in nature and not tied to any particular data transfer mechanism. Since the annual Privacy Shield review is an assessment of the functioning of all aspects of the framework, it includes a detailed discussion of updates relevant to the oversight described in these letters.

And finally, the Irish High Court linked Privacy Shield to the Schrems II case directly by asking, in the questions it referred to the CJEU, about the relevance of the European Commission’s adequacy determination for Privacy Shield to the questions at hand and whether the Ombudsperson mechanism in conjunction with the existing U.S. regime constitutes a sufficient remedy for data subjects under EU law.

Noteworthy commission findings in the Privacy Shield review

The report on the third annual review offers insights into how the European Commission is thinking about each of those questions referred to the CJEU. Four of the commission’s findings merit attention.

First, the commission’s staff working document states,

format_quote“the Inspector General … of the Intelligence Community, Michael Atkinson, explained … that his office would systematically be informed of complaints submitted to the Ombudsperson mechanism and would carry out an independent assessment.” The IG confirmed that this assessment had been conducted for the first request received by the Ombudsperson. “In addition, the U.S. authorities explained how a case would be resolved if the investigation of a complaint before the Ombudsperson would reveal a violation of the targeting and minimisation procedures under Section 702 FISA. It was clarified that any such violation would be reported to the FISC, which would carry out an independent review and, if necessary, order the relevant intelligency [sic] agency to take remedial action. The remedies in question may range from individual to structural measures, e.g from the deletion of unlawfully obtained data to a change in the collection practice, including in terms of guidance and training for staff.”

This commission finding speaks to the standard laid down by the CJEU that an effective remedy must include the ability to erase data. This Commission statement and confirmation by U.S. authorities is also particularly noteworthy at this juncture, as the IG of the intelligence community recently demonstrated that the powers and independence of his office are not merely theoretical, but incredibly strong in practice.

Second, the commission cites Fazaga v. FBI, explaining that the case “clarified the procedure under FISA that applies when the U.S. government invokes the State secrets evidentiary privilege.” The commission writes that “the Court of Appeal of the Ninth Circuit held that the procedure under FISA that provides for judicial review of secret evidence (50 USC §1806(f)) takes precedence over the State secrets evidentiary privilege…. This ensures independent judicial review of information obtained through electronic surveillance under FISA, including in situations where it could otherwise be withheld by the government on national security grounds.” According to the commission, this case demonstrates that the U.S. government cannot thwart judicial review in the national security context by withholding evidence in the name of national security. Rather, in cases involving state secrets and FISA claims, the government must submit the evidence to the court, even if the review is in camera and ex parte.

Third, the commission raises ACLU v. National Security Agency, which it notes, “concerned a request under the Freedom of Information Act … seeking the disclosure of documents concerning the U.S. government’s surveillance powers under EO 12333.” The commission writes that, “[t]he Court of Appeal upheld that the requested documents could not be disclosed, in accordance with exemptions provided under FOIA.” But, it goes on to say, “[w]hat matters is that an independent court can review the use of the exception by the intelligence community (and order disclosure in case of abuse), which is what happened in this particular case.” Hence, the Commission acknowledges that, like other sovereigns, the U.S. government benefits from certain exemptions from full FOIA disclosure, and it points out that under ACLU v. NSA, the U.S. government’s authority to withhold data in the national security arena is restricted by judicial review, and that there is an avenue to obtain data that has been withheld inappropriately.

Fourth, the commission cites Wikimedia v. National Security Agency, which is still pending, noting that, “[t]he case concerns a challenge to the lawfulness of the Upstream program under Section 702 FISA under the Electronic Communications Privacy Act and the Administrative Procedures Act. It is based on publicly available information about how Section 702 FISA operates (including the PCLOB report) and Wikimedia's assertion that, given its large volume of global internet communications, it is extremely likely that some of its data has been intercepted through the Upstream program. The trial court granted the U.S. government's motion to dismiss for lack of standing, but the appellate court reversed that decision, finding that Wikimedia's allegations met the legal requirements of the standing doctrine.”  In the past, EU authorities expressed concern that U.S. standing requirements would create a de facto bar to judicial redress in the national security context. EU authorities claimed that plaintiffs would purportedly be barred from accessing classified material needed to prove they were directly impacted by U.S. surveillance practices. The appellate court’s decision regarding standing promises prospective plaintiffs’ access to justice in similar cases.

What happens next?

Taken together, these commission findings present a path that EU individuals could pursue to challenge the secrecy and legality of U.S. government surveillance. Through this report, has the commission provided the CJEU a roadmap to find that U.S. oversight of national security and law enforcement access to personal data provides EU individuals an effective remedy before an independent tribunal if their rights are violated? On December 12, the Advocate General is expected to release his opinion in the Schrems II case and provide a sense of whether these findings are impactful.

Photo credit: Image provided by the Court of Justice of the European Union.

Comments

If you want to comment on this post, you need to login.