On October 7, 2022, U.S. President Biden signed the long-awaited Executive Order (EO) on ‘Enhancing Safeguards for United States Signals Intelligence Activities‘. Some would say it is merely a memorandum on how the US will continue to spy on individuals. Others would say it is an effort to control the intelligence system in place without drastically restricting the purpose for which it was established.
As I wrote in my blog article in March, Will the Trans-Atlantic Data Privacy Framework Bloom this Summer?, the U.S. declared that, “Under the Trans-Atlantic Data Privacy Framework, the United States has made unprecedented commitments to:
Strengthen the privacy and civil liberties safeguards governing U.S. signals intelligence activities;
Establish a new redress mechanism with independent and binding authority; and
Enhance its existing rigorous and layered oversight of signals intelligence activities.”
On this point the European Commission stated that, “the new Executive Order provides for:
Binding safeguards that limit access to data by US intelligence authorities to what is necessary and proportionate to protect national security;
The establishment of an independent and impartial redress mechanism, which includes a new Data Protection Review Court (‘DPRC‘); to investigate and resolve complaints regarding access to their data by US national security authorities;”
Others do not share the European Commission’s assessment of the EO. With its release last Friday the following comments were released.
Max Schrems, the Chairman of noyb.eu, stated: „The EU and the US agree on the term ‚proportionate‘, but apparently not on its meaning. In the end, the ECJ’s definition will prevail – and thus probably nullify the agreement again. It’s disappointing that the European Commission wants to continue spying on Europeans based on this word.“
The Electronic Privacy Information Center (EPIC) has this to say about the new EO, “While the EO does provide some privacy safeguards, it does not fully bar the use of bulk collection programs by U.S. intelligence agencies.” (see here)
The Transatlantic Consumer Dialogue (TACD) urged the European Commission not to adopt a new adequacy decision without further changes to the order, due to the fact that “the new provisions would not adequately protect European consumers’ fundamental rights to privacy and data protection”. ()
Despite the many critics of the EO the European Commission sounds optimistic that this order can be the basis of the new adequacy decision between the U.S and the EU, stating “The Executive Order introduces new binding safeguards to address all the points raised by the Court of Justice of the EU, limiting access to EU data by US intelligence services and establishing a Data Protection Review Court.”
The next step in the process of creating an adequacy decision is for the Commission to create a draft and present it to the European Data Protection Board. The entire process can take up to 6 months. We will continue to monitor the progress of this very important process, because as the White House points out in their press release on Friday, “Transatlantic data flows are critical to enabling the $7.1 trillion EU-U.S. economic relationship.” (see here)