More than six months after an “agreement in principle” between the EU and the US, US President Joe Biden has signed the long-awaited Executive Order that is meant to respect the European Court of Justice’s (CJEU) past judgments. This is meant to overcome limitations in EU-US data transfers. The CJEU required (1) that US surveillance is proportionate within the meaning of Article 52 of the Charter of Fundamental Rights (CFR) and (2) that there is access to judicial redress, as required under Article 47 CFR. Biden’s new Executive Order seems to fail on both requirements. There is continuous “bulk surveillance” and a “court” that is not an actual court.
Executive Order. An Executive Order is an internal directive by the US President within the federal government, but not a law. Previously the matter was regulated by an order by President Obama from 2014, called PPD-28. While it is good to see that our litigation now leads to a reaction by the US President, this internal presidential order will likely not solve the problem:
Bulk surveillance continues via two types of “proportionality”. The US highlights, that the new executive order uses the wording of EU law (“necessary” and “proportionate” as in Article 52 CFR) instead of the previous term “as tailored as feasible” used in Section 1(d) of PPD-28. This could solve the problem, if the US would follow the same understanding and also apply the proportionality test of the CJEU.
However, despite changing these words, there is no indication that US mass surveillance will change in practice. So-called “bulk surveillance” will continue under the new Executive Order (see Section 2 (c)(ii)) and any data sent to US providers will still end up in programs like PRISM or Upstream, despite of the CJEU declaring US surveillance laws and practices as not “proportionate” (under the European understanding of the word) twice.
How is this possible? It seems, the EU and the US agreed to copy the words “necessary” and “proportionate” into the Executive Order, but did not agree that it will have the same legal meaning. If it would have the same meaning, the US would have to fundamentally limit its mass surveillance systems to comply with the EU understanding of “proportionate” surveillance.
Max Schrems, chair of noyb.eu: “The EU and the US now agree on use of the word ‘proportionate’ but seem to disagree on the meaning of it. In the end…
New Trans-Atlantic Data Privacy Framework largely a copy of “Privacy Shield”. noyb will challenge the decision.
Third attempt of the European Commission to get a stable agreement on EU-US data transfers…
Schrems II Judgment Day
The Court of Justice of the European Union (“CJEU“) issued its judgment today in …
