Like much of the privacy community, we at Privacy Across Borders are closely studying the executive order to see whether it will hit the redress and necessity and proportionality targets laid out in the Schrems II ruling. We will soon post our initial impressions on the specific parts of the order that are aimed at each target.
But first, I want to share my personal reaction to the order itself (I will have more to say once I have had a greater opportunity to study the Order).
As someone who worked intensively on these issues from within the U.S. Intelligence Community (IC) for nearly two decades, I am struck by the breadth, depth, and ambition of this Order. It truly breaks new ground, both in delimiting the conduct of surveillance and in seeking to maximize the government’s ability, within the boundaries of the U.S. Constitution, to create an independent, binding, and most importantly, effective redress mechanism.
The Order goes well beyond the landmark work we did on Presidential Policy Directive-28. When the Snowden disclosures created a firestorm of criticism in 2013, I worked closely with others in the IC to respond. I vividly remember beginning our work on what was to become PPD-28 just as the government was shutting down in October 2013. After many weeks of intense and painstaking interagency deliberations and with President Obama demanding that we lean forward, PPD-28 emerged in January 2014.
PPD-28 articulated significant restrictions on the conduct of some of the nation’s most important national security activities. While the IC had always taken care to conduct its activities in a manner that applied protections to individuals regardless of nationality, aspects of the U.S. legal framework had been explicitly focused on the privacy of U.S. persons, so as to preserve the integrity of our democratic institutions and processes. For the first time, PPD-28 directly extended key U.S. person privacy protections to all individuals regardless of nationality.
As part of Privacy Shield, we sought to leverage the existing complaint investigation and redress processes within the U.S. system, and to focus those processes on complaints from EU residents, through a newly created ombudsperson position at the State Department. I was closely involved in the creation of this redress mechanism and in the laborious work of ensuring that the IC’s internal processes were aligned and fully prepared to robustly support it. That in itself was a major challenge, but obviously it fell short in the eyes of the CJEU.
During that time, the U.S. faced a great deal of criticism from our European friends and partners. We worked hard to address their concerns, including making changes such as those embodied in PPD-28, and launching a wide-ranging transparency effort that is still going strong to this day. Meanwhile, European countries were still coming to terms with their own governments’ intelligence practices. For example, a 2015 report by the Council of Europe Commissioner for Human Rights found that “[i]n many Council of Europe member states, bulk, untargeted surveillance by security services is either not regulated by any publicly available law or regulated in such a nebulous way that the law provides few restraints and little clarity on these measures” (p. 23).
The series of measures we took were, as we say in the U.S., a “heavy lift,” and it achieved a great deal, though not enough to sway the CJEU. That said, I remain proud of what we accomplished.
This new Order goes even further.
- At the outset, it is important to remember that the Order has the force and effect of law. National security is an arena in which the Executive has clear prerogatives under the Constitution, and the President has used his extensive authority to the fullest with this order.
- The Order establishes clear delineations on the scope of signals intelligence activity. It clarifies, enhances, and updates the safeguards in PPD-28. And very importantly, for the first time, it establishes in law an intelligence validation process to ensure that the objectives being pursued are legitimate. While the IC has always had a rigorous intelligence priorities and requirements process, this is the first time that this process is laid out so explicitly in a legal document of this kind. Moreover, the process expressly puts the Civil Liberties Protection Officer in the loop.
- Again for the first time in this kind of legal document, the Order uses the “necessity and proportionality” terminology that is a fundamental aspect of EU law. The U.S. has in the past resisted using this terminology not because the ordinary dictionary definitions of those terms are problematic–they are not–but rather out of concern that they would imply acceptance of the particular legal meaning accorded to those terms under EU law. Complicating the picture further is the fact that this terminology has also played a key role in the separate legal regime established by the European Convention on Human Rights (which exists apart from the European Union). The Order forges ahead despite these longstanding concerns and explicitly puts these terms front and center. It guards against the risk of adopting specialized legal meanings that do not readily translate to U.S. law by laying out what the U.S. government means when using them. While the Order takes care to provide that its terms are to be interpreted in accordance with U.S. law, the details provided should enable people to make an informed judgment on whether the Order has hit this particular target under EU law.
- Most dramatically, the Order breaks new ground in establishing an ambitious and innovative redress mechanism. As we discussed extensively in this article on redress, under longstanding (and recently reaffirmed) Supreme Court jurisprudence, it is particularly challenging to set up a redress mechanism within the Executive Branch that is both independent of the President and capable of issuing binding rulings. The Order seeks to maximize the President’s extensive national security powers to create a system that, in effect, ties his own hands and those of the agencies charged with protecting the nation’s security, in order to provide independent, binding, and effective redress to claimants who reasonably believe that their personal information has been transferred to the United States from another country (assuming that country has been deemed a “qualifying state”). Claimants will not have to show that they have been surveilled (i.e., establish “standing”) to trigger this process; nor will the state secrets privilege be an issue, as the independent arbiters will be fully cleared to review classified information.
To be sure, the Order also raises important questions that we will be diving into as we examine it more closely. For example, the PAB team will be looking into whether the rulings of the new court are reviewable by a U.S. district court under the Administrative Procedure Act. We will also be examining how the CJEU might evaluate the Order’s measures on the scope and conduct of surveillance in light of its prior rulings not only in Schrems II but also in other cases. And of course, we will need to dive into the measures laid out to make the redress mechanism both independent and binding.
As I said at the outset, this Order breaks new ground. We will see whether it is enough.