ANALYSIS: search for smooth navigation for data flow across the pond

More than a year after the invalidation of the EU-U.S. Privacy Shield, transatlantic data flows are still in rough waters. The use of standard contractual clauses (SPC) as the next best alternative has been fraught with pitfalls, not the least of which was the adoption by the European Commission of the New SCC, triggering a multitude of urgent updates. Are calmer waters waiting for us?

Yes, if a new Privacy Shield is adopted. Version 2.0 has been in the works since the Court of Justice of the European Union (CJEU) sunk the original Privacy Shield in its Schrems II decision. Although the Biden administration announced an effort to “step up” negotiations with the European Commission in March, no further announcements have been made publicly.

The American Chamber of Commerce, however, caused a sensation at the end of September by publishing a full page ad in the Washington post, highlighting five of his 13 reasons for wanting the US to strike a new deal with the EU. Although the ad urges the US and the EU to finalize a new deal that provides “legal certainty”, legal certainty is something that has so far proved elusive.

Arguably a new deal will not be ‘Schrems proof’, as Max Schrems himself will likely challenge the next iteration of the data transfer framework, just as he successfully challenged both the US-EU Security Shield (RIP 2015) and EU-US Privacy Shield (RIP 2020).

Rather, the real test is whether a Privacy Shield 2.0 could be CJEU-evidence. For this to happen, the deal would need to allay the two main concerns raised in the Schrems II decision: US federal law and right of appeal.

Surveillance benches

Regarding American law, the CJEU in 2020 specifically contested:

• Section 702 of the FISA Amendments Act of 2008 (50 USC § 1881a), which authorizes the United States Attorney General and the Director of National Intelligence to implement surveillance programs with the assistance of communications service providers electronic;
• Executive Order 12333 (EO 12333), which authorizes the collection of information by a number of federal departments and agencies; and
• Presidential Policy Directive 28 (PPD-28), which establishes the principles for the conduct of signals intelligence, that is, the collection of foreign intelligence from communications and information systems.

CJEU Schrems II The decision concluded that neither Article 702 nor EO 12333, read in conjunction with PPD-28, “correspond to the minimum guarantees resulting… from the principle of proportionality”. She also ruled that neither PPD-28 nor EO 12333 grants EU citizens actionable rights in court against US authorities.

The principle of proportionality, mentioned in Article 52 (1) of the Charter of Fundamental Rights of the EU, allows limitations on the exercise of fundamental rights “only if they are necessary and genuinely meet the objectives of general interest… or the need to protect the rights and freedoms of others. ”The American legal regime did not satisfy the principle of proportionality because, according to the court, it allows the massive collection of personal data.

Failed remedy

The right of appeal, described in art. 47 of the Charter, grants individuals “the right to an effective remedy before a tribunal” as well as to a hearing before an “independent and impartial” body. The creation by the Privacy Shield of an ombudsperson as a monitoring and compliance mechanism did not satisfy Art. 47, according to the court, because the ombudsman was neither an independent body nor a judicial tribunal.

Thus, to satisfy the CJEU, a new data protection shield must be able to define a framework “essentially equivalent” to the protections granted to EU citizens in the Charter. Or, in other words, a framework that limits surveillance to what is strictly “necessary” to protect the rights and freedoms of others against terrorist and criminal threats, while providing those affected with a means to seek legal redress. .

Could such a framework be achieved?

Dublin-based Arthur Cox partner Rob Corbet thinks so. He recently told me that the CJEU had left “just enough leeway” for a breakthrough to be possible.

I am okay.

Granted, the prospect of Congressional action is slim, so Section 702 will likely remain as it is. But the Biden administration certainly has its tool of choice at its disposal: the executive decree. (President Biden has already issued 66 executive orders in the first nine months of his presidency, not to mention 65 other statements classified by the president’s executive office as “Presidential memoranda, opinions, or decrees.”)

Favorable tides

With the power of the pen, the Biden administration could draft a new executive order that amends (or rescinds) the provisions of EO 12333 and PPD-28 that the CJEU finds most troubling. And the administration could create a new “tribunal” which would offer EU citizens a level of protection “essentially equivalent” to that guaranteed by art. 47 of the Charter.

While some may question whether the president has the power to create a new tribunal under s. II of the United States Constitution, so-called “Article II Courts” were created in the past. See, for example, the Mercer Law Review article by Professor David Bederman on Article II tribunals, where he notes that these tribunals were created in accordance with the President’s war powers, mainly in the territories occupied as a result. armed conflict.

If the exercise of such powers in the context of international data transfers is undoubtedly an open question, who would raise it? Max Schrems?

Granted, an Article II tribunal may not provide “legal certainty” constitutionally speaking, but it would grant affected persons like Schrems “the right to an effective remedy before a tribunal” and thus allay the concerns of the CJEU.

Once the transatlantic transfers are secured “favorable winds and a following sea”, the pond, at least, should be more navigable. But companies will still need to monitor barometric pressure until bilateral negotiations are replaced by multilateral negotiations, ushering in a global solution that satisfies trade across the globe.

Access additional insights from our Bloomberg Law 2022 series here, including articles covering trends in litigation, regulation and compliance, transactions and contracts and the future of the legal industry.

Bloomberg Law subscribers can find related content on our Schrems II in brief page, as well as our Cross-border data transfer resource page.

If you are reading this on the Bloomberg terminal, please run BLAW OUT to access the hypertext content, or click on here to view the web version of this article.