Joint Letter to Commissioner Jourová Re: Privacy Shield

February 28, 2017

Attn:
Věra Jourová
Commissioner for Justice, Consumers and Gender Equality
European Commission

CC:
Claude Moraes
Chairman, Committee on Civil Liberties, Justice and Home Affairs (LIBE)
European Parliament

Frans Timmermans
First Vice-President, Better Regulation, Interinstitutional Relations, the Rule of Law and the Charter of Fundamental Rights
European Commission

Andrus Ansip
Vice-President, Digital Single Market
European Commission

Isabelle Falque-Pierrotin
Chairwoman, Article 29 Working Party
European Commission

Dear Commissioner Jourová,

Recent developments in the United States call into question assurances by the US government that formed the foundation of both the Privacy Shield agreement and the US-EU umbrella agreement. We write to urge you to reexamine whether these agreements sufficiently protect the fundamental rights of people in the European Union in light of these changed circumstances.  

In recent weeks, President Donald Trump has issued several executive orders that represent an attack on the rights of immigrants and foreigners—including specific provisions designed to strip these individuals of critical privacy protections that have been provided by previous Democratic and Republican administrations for decades. Concurrently, there has been a deterioration in existing oversight and accountability structures that impact whether, consistent with the ruling in the Schrems[1] and Digital Rights Ireland judgments[2], people in the EU are afforded appropriate privacy protections and redress in cases where their data is transferred to the US. 

Previously, the ACLU and other rights organizations have written to you expressing our view that reform to US surveillance laws is necessary to ensure that EU data transferred to the US receives protection that is “essentially equivalent” to the protections required under the EU Charter—calling into question the legality of the existing Privacy Shield agreement (Attachment 1).[3] We have also stressed the inadequacy of existing privacy oversight and redress mechanisms for both US residents and individuals around the world.  The following recent changes to US policies only deepen our concerns that assurances underpinning both the Privacy Shield and US-EU umbrella agreement are not valid, requiring a reexamination of whether these agreements are consistent with the rights enshrined in the EU Charter of Fundamental Rights:

• Issuance of the executive order Enhancing Public Safety in the Interior of the United States: Issued on January 25, 2017, Section 14 of the executive order reverses policies of the Bush, Obama, and prior administrations by prohibiting federal agencies, consistent with applicable law, from providing Privacy Act protections to individuals who are not US citizens or lawful permanent residents.[4] As a result of this change, people in the EU have diminished protections when it comes to limits on dissemination of their personal information, the right to access their private information held by the US government, and the right to request corrections to their information.

• Deterioration of the Privacy and Civil Liberties Oversight Board (PCLOB): The Privacy and Civil Liberties Oversight Board, while fulfilling a valuable public reporting role, is limited in its oversight function and was not designed to provide redress concerning US surveillance practices. Thus, the PCLOB has never provided remedies for rights violations or functioned as a sufficient mechanism to protect personal data. In recent months, the situation has worsened: the PCLOB currently lacks a quorum, which strips its ability to issue public reports and recommendations, make basic staffing decisions, assist the Ombudsman created by the Privacy Shield framework, and conduct other routine business as part of its oversight responsibilities.[5] The current administration and Senate have yet to act to fill the vacancies on the PCLOB.[6]

1. Executive order: Enhancing Public Safety in the Interior of the United States:  

As part of the Schrems judgment, the Grand Chamber of the Court of European Justice of the European Union emphasized that Article 7 and 8 of the EU Charter of Fundamental Rights requires:

“…clear and precise rules governing the scope and application of a measure and imposing minimum safeguards so that the persons whose personal data is concerned have sufficient guarantees enabling their data to be effectively protected against the risk of abuse and against any unlawful access and use of their data.”[7]

In addition, they emphasized that any legislation:

“…not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, does not respect the essence of the fundamental right to effective judicial protections, as enshrined in Article 47 of the Charter.”[8]

Consistent with this requirement, the Privacy Shield framework adequacy determination relied in part on US government assurances that there were appropriate mechanisms in place for individuals to seek redress in cases where their data was accessed by the US government.[9] Similarly, the umbrella agreement requires the US to ensure that individuals are entitled to seek access and correction to their personal information, unless specified exceptions apply.[10] The umbrella agreement also requires that the US provide the ability to seek administrative redress to individuals in the EU in cases where they are improperly denied the ability to access or correct their information.[11]

While the Judicial Redress Act provides some additional privacy protections for EU citizens, it does not completely mitigate the impact of the executive order’s provision for several reasons. First, the Judicial Redress Act only applies to citizens of EU countries.[13] Thus, if an individual lawfully works or lives in the EU, but has not obtained full citizenship status, then he or she may not be entitled to protection under the Judicial Redress Act. Thus, the EO provision strips privacy protections from thousands of lawful EU immigrants.

Second, the Judicial Redress Act alone does not provide the full range of Privacy Act protections that were provided as a matter of policy, prior to issuance of the executive order.[14] The Judicial Redress Act only extends the right to EU citizens to bring a case in civil court to challenge US government action if their records were “willfully and intentionally” disseminated without consent in violation of relevant provisions of the Privacy Act, or in cases where a “designated federal agency or component” fails to comply with a request for information or correction.[15] Thus, even with the Judicial Redress Act, EU citizens may be left without appropriate recourse to address improper dissemination of their information that is accidental or inadvertent in nature. In addition, EU citizens may be unable to address failures to provide access or corrections in cases where their information is held by federal agencies that are not designated under the bill. For example, the Department of Health and Human Services (HHS) has several databases that contain personal information of refugees and immigrants to the US. However, HHS is not a designated agency under the Judicial Redress Act, and thus EU citizens may not be able to access or request corrections to information held by HHS.[16] Moreover, only information shared with the US government by an entity in a EU country for law enforcement purposes is covered­­—personal information collected by US agencies themselves is not covered, nor is information collected for non-law enforcement purposes such as intelligence gathering.    

Finally, the Judicial Redress Act requires that an individual file a civil claim to enforce their rights, and does not require that federal agencies create an administrative process to address privacy violations. As a practical matter, this means that enforcement of EU citizens’ rights may not only be time consuming, but also costly. Thus, while the Judicial Redress Act provides some relief to EU citizens, it does not fully mitigate the impact of the executive order.

2. Privacy and Civil Liberties Oversight Board

The CJEU has emphasized that appropriate oversight is critical to ensuring that EU data receives appropriate privacy and other fundamental rights protections.  Thus, as part of its adequacy determination for the Privacy Shield, the European Commission relied on assurances that the US intelligence community was subject to various oversight mechanisms, including the PCLOB. The adequacy determination notes that the PCLOB ensures appropriate oversight over US surveillance practices by examining relevant records, issuing recommendations, hearing testimony, and preparing reports (including an examination of PPD-28).[17]  Similarly, supporting documentation provided by the Director of National Intelligence asserted that the PCLOB is an independent oversight body that that is part of “robust and multi-layered oversight”.[18]

Even with a fully-functioning PCLOB, we had serious concerns that there was not effective oversight of US surveillance activities, and we strongly disagreed with many of the US government’s assertions in this arena. However, notwithstanding these concerns, it is clear that the European Commission relied on the representations regarding the oversight role of the PCLOB as part of its adequacy determination. Unfortunately, however, the PCLOB is no longer a fully functional body. Currently four of the five board positions on the PCLOB are vacant.[19] Without a quorum, the PCLOB cannot issue reports and recommendations, including its planned report on activities conducted under executive order 12333 and the implementation of PPD-28.[20] In addition, the Board is further limited in its ability to make staffing decisions necessary to fulfill its responsibilities.[21] Moreover, the vacancies also impact the extent to which the Board’s membership represents diverse political viewpoints. Under statute, no more than three of the Board members may come from the same political party, ensuring that a full Board contains representation from both political parties. The current membership, however, represents only one political party. 

The process of filling the vacancies on the Board is not an easy one. It requires nomination by the President and confirmation by the Senate—a process that can be lengthy, arduous, and easily derailed. Indeed, the PCLOB remained largely dormant from 2007 to 2012 due in part to these hurdles. For the PCLOB to operate effectively, it is critical that the President appoint and the Senate confirm individuals with a demonstrated commitment to and background in privacy, civil liberties, and transparency. 

Given these recent changes to US policies and oversight structures, we believe that the assurances that the European Commission relied on as part of the Privacy Shield and US-EU umbrella agreement are no longer valid. Thus, we urge you to examine whether these agreements are consistent with the protections enshrined in the EU Charter of Fundamental Rights.

Sincerely,