The Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities, signed by President Biden on October 7, provides further clarity about the Trans-Atlantic Data Privacy Framework (“the Framework”), announced in March 2022. The Framework is a new instrument to support the lawful data transfer between the European Union and the US. The Order and the Framework provide certainty about the legal basis for such transfers that has been absent since 2020. This was when the European Court of Justice (“ECJ”) declared the EU-U.S. Privacy Shield invalid.  

Requirements for lawful transatlantic transfer mirror those of the Privacy Shield. The Order does not impose new obligations. Instead, it addresses the ECJ’s concerns about the Privacy Shield as they relate to government surveillance. These concerns include the lack of an adequate redress mechanism for EU individuals who may have been subject to such surveillance. The Order therefore outlines steps that government – not companies – must take.  

Two-Tier Redress Mechanism to Address Complaints of Alleged Violations

The framework enhances protections for EU residents with respect to the activities of such agencies by restricting U.S. processing of EU data subjects’ personal data.  It also establishes a two-tier redress mechanism to address complaints of alleged violations. In the first step, “EU individuals will be able to lodge a complaint with the so-called ‘Civil Liberties Protection Officer' of the US intelligence community (the Officer).” In the second, EU individuals would have the right to appeal the decision of the Officer to the newly-created Data Protection Review Court (DPRC).

Members from outside the U.S. government will comprise the DPRC, appointed based on specific qualifications. They can only face dismissal for serious cause. Significantly, they cannot receive instructions from the government.  

The DPRC “will have powers to investigate complaints from EU individuals, including to obtain relevant information from intelligence agencies, and will be able to take binding remedial decisions. For example, if the DPRC would find that data was collected in violation of the safeguards provided in the Executive Order, itwill be able to order the deletion of the data.”

The framework, explained in detail in a Fact Sheet released by the White House, must now be ratified by the European Data Protection Board, the European Parliament, and the European Commission.  Following ratification, the framework is expected to come into effect in March 2023.