On October 7, 2022, President Joseph R. Biden, Jr. signed Executive Order 14,086 on Enhancing Safeguards for United States Signals Intelligence ActivitiesFootnote ¹ to implement the EU-U.S. Data Privacy Framework (DPF) that was “agreed in principle” on March 27, 2022.Footnote ² The DPF seeks to address issues identified by the Court of Justice of the European Union (CJEU) in Schrems II (2020), which struck down the European Commission's adequacy decision approving the Privacy Shield, the prior legal framework for transferring EU personal data to the United States.Footnote ³ The European Commission anticipates issuing an adequacy decision concluding that U.S. law now achieves the standards required by EU law (a draft decision was published in December). After that decision enters into force, U.S. entities will be permitted to transfer personal data from the EU to the United States under clear rules, unless the CJEU rejects the decision when it is inevitably challenged. According to the White House, the “EU-U.S. DPF [when implemented] will restore an important legal basis for transatlantic data flows,” which is “critical to enabling the $7.1 trillion EU-U.S. economic relationship.”Footnote ⁴

EU law restricts the transfer of personal data outside of the European Union absent assurances that the data will be protected abroad in accordance with the conditions established by the General Data Protection Regulation (GDPR).Footnote ⁵ One method for providing such assurances is an “adequacy decision,” in which the European Commission certifies that rules and procedures are in place in a given third country that “ensure[] an adequate level of protection” for the EU personal data that is to be transferred.Footnote ⁶ Provided a third-country company follows its country's approved rules (in the United States this would be by committing to comply with specified privacy principles through annual self-certification to the Department of Commerce), they may transfer personal data from the European Union. An adequacy decision thus simplifies and creates certainty for companies whose data transfers are regulated by EU law. But an adequacy decision requires not just the Commission to conclude that the third country's rules meet the required threshold for data protection set by the GDPR. If the Commission's decision is challenged, the CJEU must do so as well. As will be explained below, the CJEU has twice determined that U.S. law does not meet EU legal requirements, invalidating the Commission's adequacy decisions.

In the absence of an adequacy decision, there are other ways for third-country companies to comply with the GDPR's data transfer rules.Footnote ⁷ They may, for example, establish Binding Corporate Rules (BCR) that are approved by the competent EU data protection authority.Footnote ⁸ And they may use EU-issued Standard Contractual Clauses (SCC), as many companies do.Footnote ⁹ But these mechanisms may be deemed insufficient for much the same reason that the adequacy decisions were faulted: that U.S. law does not match EU standards and the SCCs (and the other methods that could demonstrate that the transfers were subject to appropriate safeguards) do not include sufficient “additional measures” to compensate for the deficiencies.Footnote ¹⁰ Many European national data protection authorities, for example, have so concluded in complaints brought against European companies for their use of Google Analytics.Footnote ¹¹ It is anticipated that a pending decision against Meta Industries in Ireland will come to the same conclusion.Footnote ¹² This means that there may be no workable legal basis for EU-U.S. personal data transfers under EU law.

While some companies, like Microsoft, might be able to allow their European customers to store their data locally (data localization) and therefore avoid transfers out of the European Union,Footnote ¹³ that is not possible for Meta Industries, Inc. (Facebook), Alphabet, Inc. (Google), and many other U.S. companies, large and small, that depend on transatlantic data transfers to sell online ads or measure web traffic or simply manage their businesses from abroad.Footnote ¹⁴ This explains why the European Commission and the U.S. government have worked for years to establish a sound legal foundation for an adequacy decision. “The stakes are too high—and international trade between Europe and the U.S. too important to the livelihoods of millions of people—to fail at finding a prompt solution to this imminent problem,” Google's President of Global Affairs Kent Walker wrote in January 2022.Footnote ¹⁵

The DPF is the third attempt by the United States and the European Union to agree on a U.S. legal framework that would satisfy EU requirements. In cases brought by Austrian privacy activist Max Schrems, the CJEU invalidated two previous adequacy decisions approving prior agreements. The first pertained to the Safe Harbor Framework, in place from 2000 until it was undone in October 2015 by Schrems I.Footnote ¹⁶ In that case, the CJEU found that the Commission's 2000 decision endorsing Safe HarborFootnote ¹⁷ was invalid because U.S. law did not “ensure[] . . . a level of protection of fundamental rights [related to data protection] essentially equivalent to that guaranteed in the EU legal order.”Footnote ¹⁸ In particular, U.S. law “permit[ted] the public authorities [through surveillance programs] to have access on a generalised basis to the content of electronic communications.”Footnote ¹⁹ U.S. law also did “not provid[e] for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him [collected by the government], or to obtain the rectification or erasure of such data.”Footnote ²⁰ The EU and the United States swiftly replaced Safe Harbor with Privacy Shield, which came into effect in July 2016.Footnote ²¹ Privacy Shield sought to cure Safe Harbor's defects through the issuance of “written assurances [by the United States] that the access of public authorities for law enforcement and national security will be subject to clear limitations, safeguards and oversight mechanisms”Footnote ²² and the creation of a Privacy Shield Ombudsperson at the State Department to “review . . . allegations that the U.S. Intelligence Community has engaged in signals intelligence activities that do not comply with applicable restrictions.”Footnote ²³

In July 2020, in Schrems II, the CJEU invalidated the Commission's adequacy decision on the Privacy Shield.Footnote ²⁴ The Court found that U.S. laws pertaining to government surveillance programs did not provide EU persons with data protection that was “essentially equivalent” to that provided under EU law.Footnote ²⁵ They did not establish “minimum safeguards” and were not “limited to what is strictly necessary.”Footnote ²⁶ The Court also found that U.S. law did not provide an effective remedy for data protection violations because they did “not grant data subjects actionable rights before the courts against the US authorities.”Footnote ²⁷ The Privacy Shield's Ombudsperson was insufficient.

The DPF, as implemented through the executive order and related actions, seeks to address the two shortcomings in U.S. law identified in Schrems II. But the privacy principles that U.S. companies must adhere to under the DPF and the processes that U.S. companies use to self-certify and re-self-certify their adherence will remain substantively the same as under Privacy Shield.Footnote ²⁸ This is because Schrems II did not call into question the substantive safeguards that the Privacy Shield offered to EU individuals.Footnote ²⁹ As a result, U.S. companies will be able to subscribe to the DPF through compliance with an existing set of privacy obligations, including “the requirement to delete personal data when it is no longer necessary for the purpose for which it was collected, and to ensure continuity of protection when personal data is shared with third parties.”Footnote ³⁰ More than 5,000 U.S. companies self-certified under Privacy Shield.Footnote ³¹

The executive order, together with the Justice Department regulations and Intelligence Community Directive that were issued subsequently,Footnote ³² institute novel limitations on U.S. signals intelligence mass data collection for criminal law enforcement and national security purposes and provide new means of redress for EU persons who believe their rights have been breached.Footnote ³³ Specifically, the order requires signals intelligence activities to “take into consideration the privacy and civil liberties of all persons” and “be conducted only when necessary to advance a validated intelligence priority and only to the extent and in a manner proportionate to that priority.”Footnote ³⁴ The order “[m]andates handling requirements for personal information collected through signals intelligence activities and extends the responsibilities of . . . officials to ensure that appropriate actions are taken to remediate non-compliance.”Footnote ³⁵ And it requires “U.S. Intelligence Community elements to update their policies and procedures to reflect the new privacy and civil liberties safeguards” in the order.Footnote ³⁶

The executive order also establishes a “multi-layer mechanism for individuals from qualifying states and regional economic integration organizations . . . to obtain independent and binding review and redress of claims.”Footnote ³⁷ The Civil Liberties Protection Officer (CLPO) in the Office of the Director of National Intelligence will provide the first level of review to determine whether U.S. laws were violated and, if so, the “appropriate remediation.”Footnote ³⁸ The CLPO's decisions will be subject to binding review by the Data Protection Review Court (DPRC), created under Article II of the Constitution, whose judges “have relevant experience in the fields of data privacy and national security, review cases independently, and enjoy protections against removal.”Footnote ³⁹ The DPRC will appoint a “special advocate” to “assist the panel in its consideration of the application for review, including by advocating regarding the complainant's interest in the matter and ensuring that the [DPRC] is well informed of the issues and the law with respect to the matter.”Footnote ⁴⁰

Although the executive order is designed to address the concerns of the CJEU regarding U.S. signals intelligence gathering and the provision of independent avenues of redress, it has a broader effect. The new rules apply “regardless of . . . nationality,”Footnote ⁴¹ and so they can be extended to any “qualifying state.”Footnote ⁴² Thus, even though the United Kingdom will not be covered by the European Commission's adequacy decision, the British government announced on October 7, 2022, that it is also moving toward a data adequacy agreement with the United States based on the executive order.Footnote ⁴³

Full implementation of the DPF will take some time. The Commission's adequacy decision on the protection of personal data under the DPF will probably be adopted by the summer of 2023.Footnote ⁴⁴ On December 13, 2022, the Commission published a draft decision, finding that “the United States ensures an adequate level of protection . . . for personal data transferred from the European Union to organisations certified under the EU-U.S. Data Privacy Framework.”Footnote ⁴⁵ Before the decision can go into force, it must be reviewed by the European Data Protection Board (EDPB), and then it must be approved by a committee of representatives of EU member states.Footnote ⁴⁶ The European Parliament may also request that the Commission withdraw or amend the decision on the grounds that “its act exceeds the implementing powers provided for in the regulation” (right of scrutiny).Footnote ⁴⁷ On February 28, 2023, the EDPB adopted a non-binding opinion on the draft adequacy decision.Footnote ⁴⁸ The EDPB “welcome[d] substantial improvements [but] [a]t the same time, it expresse[d] concerns and request[ed] clarifications on several points . . . in particular, [relating] to certain rights of data subjects, onward transfers, the scope of exemptions, temporary bulk collection of data and the practical functioning of the redress mechanism.”Footnote ⁴⁹ In the United States, each element of the Intelligence Community must update their policies and procedures by October 7, 2023.Footnote ⁵⁰ The Privacy and Civil Liberties Oversight Board can then conduct a review of those policies and procedures “to ensure they are consistent with the enhanced safeguards contained” in the order.Footnote ⁵¹ The attorney general must also designate the European Union as a “qualifying state” and appoint judges and special advocates for the DPRC.Footnote ⁵² Separately, the Department of Commerce will need to adapt its existing Privacy Shield certification process to allow U.S. companies to commit to the required privacy principles under the DPF. Meanwhile, Schrems has already hinted that a legal challenge to the new adequacy decision is likely once it is adopted.Footnote ⁵³