By: Alex Joel, Senior Project Director, and Alexandra Cohen, Research Assistant
When the Court of Justice of the European Union (CJEU) invalidated the European Commission’s adequacy decision for the EU-U.S. Privacy Shield framework, one ground for their decision was that, with regard to U.S. Government surveillance, “EU data subjects lack actionable judicial redress and, therefore, do not have a right to an effective remedy in the U.S., as required by Article 47 of the EU Charter.” In response, the United States and European Commission announced the Trans-Atlantic Data Privacy Framework (now renamed the EU-U.S. Data Privacy Framework) to create “a new multi-layer redress mechanism that includes an independent Data Protection Review Court (DPRC) that would consist of individuals chosen from outside the U.S. Government who would have full authority to adjudicate claims and direct remedial measures as needed.”
When we at Privacy Across Borders saw that announcement, our first question was, naturally, whether the new redress mechanism would satisfy the CJEU’s concerns. But we also wondered whether a claimant could challenge the DPRC’s determinations in a U.S. federal district court. So, while waiting for the executive order to be issued, we researched whether a federal district court could review the DPRC’s determinations under the Administrative Procedure Act (APA). The result is this paper, Judicial Review of the Determinations of the New Data Protection Review Court Under the Administrative Procedure Act, which we have updated to refer to the newly issued Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities and the Department of Justice regulations establishing the DPRC.
President Biden created the DPRC to satisfy the EU redress requirement. It is a carefully considered and serious effort to navigate through different aspects of U.S. law to establish effective redress. We are examining the new process in detail to assess how well it hits the CJEU’s redress target. In the meantime, we would like to share our research on judicial review under the APA. In creating the DPRC, the Administration is tapping into a rich and complex body of law governing how agency actions can be reviewed–and potentially overturned–in federal district court. We are simplifying these complicated issues for purposes of this blog post (and paper) in the hope that we can add some helpful context.
Two statements in the newly issued instruments indicate that the government is well aware of the APA implications of DPRC. First, the Executive Order’s final sentence states: “This order is not intended to, and does not, modify the availability or scope of any judicial review of the decisions rendered through the redress mechanism, which is governed by existing law.” Thus, President Biden decided to leave the question of judicial review where it stands under existing law, without expressing an intent either to foreclose or invite it. Second, Section 201.9(h)(3) of the Final Rule provides that the notification to the complainant of the outcome of the redress process “constitutes the final agency action in the matter.” As we discuss in our new paper, “final agency action” is a term of art under the APA, and is typically subject to judicial review.
Note that even though the DPRC is created by executive order, rather than statute, courts have recognized that administrative action pursuant to an executive order may qualify as agency action that can be judicially reviewed. Once there is a finding of final agency action, the APA empowers reviewing courts to “compel agency action unlawfully withheld or unreasonably delayed” and to “hold unlawful and set aside agency action, findings, and conclusions” that are “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law”.
For a question of law, the court would directly rule on what the law requires without deferring to the DPRC’s determinations unless the DPRC is interpreting its own regulations or a statute or executive order that it is charged with interpreting. Where the DPRC is interpreting the Executive Order that creates it, its interpretations must be “reasonable.” For questions of fact, the court’s inquiry would be highly situation specific, and would require that an agency demonstrate that it engaged in reasoned decision making when reaching its determination. Agencies must provide the essential facts upon which the administrative decision was based and explain what justifies their determinations with actual evidence beyond a conclusory statement. Courts may further invalidate an agency action if the agency failed to consider an important factor relevant to the action, such as the policy effects of the decision. A court could also review an agency’s procedural rulings for, at minimum, an abuse of discretion.
Note that like all lawsuits, plaintiffs must have standing to seek judicial review of the DPRC’s decisions; that said, the claimant’s actual injury from a DPRC final action might be thought of as the effect on the claimant of the DPRC determination itself, rather than having to show that the government in fact collected the claimant’s information. In addition, judicial proceedings could be impacted if the litigation would result in disclosure of classified information. These issues do not arise within the new redress mechanism: standing is not required, and the DPRC is authorized to review classified information. In any event, the issues of standing and the state secrets privilege are beyond the scope of our paper.
The potential for a federal district court to review the adjudications of the new DPRC could well provide an additional level of oversight beyond that offered by the DPRC itself.
