Data Privacy in the US and Schrems II: President Biden's Executive Order

On 7 October 2022, President Joe Biden signed an executive order meant to pave the way for a new transatlantic data protection agreement between Europe and the US. For several reasons, this measure strikes me as unsuitable for bringing the level of data protection in the US up to that of the GDPR.

Introduction

Update 21 January 2025: Immediately after Donald Trump took office, the mention of EO 14086, which is (was?) the basis for the data protection agreement between Europe and the US, disappeared. It is the web page shown in the image below.

Update: The new data protection agreement between Europe and the US, called the Data Privacy Framework (DPF), is based on the US executive order criticised here. The points of criticism have not been addressed and still stand. It is therefore to be expected that the DPF will be challenged in court and may well fall.

"Schrems II" is the name under which the judgment of the CJEU of 16 July 2020 (case C-311/18) became known. The CJEU found that the US is a developing country when it comes to data protection. Unfortunately, the rights the GDPR grants to data subjects are not guaranteed in the US.

Roughly speaking, the reason is the sprawling intelligence activity of the Americans. Data subjects do not even have a chance to find out that they have been spied on. That is in the nature of spying. Otherwise it would not be called "espionage" but "surveillance after the target has been informed".

The Privacy Shield, the informal agreement between the US and Europe for protecting the personal data of Europeans, was declared invalid because of Schrems II. Now the EU and America are looking for a new approach.

In this context, Joe Biden issued an executive order (the link has no longer been valid since Donald Trump's second term began) to show Europe that the US has a good level of data protection. My English is good to very good, but certainly not good enough to understand complex legal texts and administrative acts in English perfectly. I am not a lawyer either. Nevertheless, I believe I have found a few formulations in this executive order (presidential decree) that give cause for concern.

My Criticism of the Executive Order of 7 October 2022

The criticism is that the executive order appears unsuitable for raising the level of data protection in the US significantly and thus for granting data subjects fundamental rights comparable to those the GDPR is supposed to grant in Europe.

The numbering in the executive order document is a mess. I therefore cannot give it as a reference and will "only" quote. I abbreviate executive order as EO.

The EO states that the transition period is up to one year ("shall, within 1 year of the date of this order, in consultation with the Attorney General, the CLPO, and the Privacy and Civil Liberties Oversight Board (PCLOB), update those policies and procedures as necessary to implement the privacy and civil liberties safeguards in this order…"). So during this time no new agreement between the EU and the US can take effect in a legally compliant way.

Half a sentence later, it says that (addressed to the intelligence agencies) one should make the greatest effort to design all US rules as humanely as possible, of course while preserving the interests of the US: "… release these policies and procedures publicly to the maximum extent possible, consistent with the protection of intelligence sources and methods, in order to enhance the public’s understanding of, and to promote public trust in, the safeguards pursuant to which the United States conducts signals intelligence activities."

That means roughly as much as no change at all. After all, intelligence agencies should have been working exclusively within the given US legal framework from the start. Or are there new restrictions resulting from Biden's EO?

At any rate, my text search for the following terms in the EO returned no hits:

• GDPR
• Europe (except for one occurrence in the heading of the EO document)
• Cloud Act

At least I got a hit when searching for "concerned". "Concerned person" or "person concerned" stands for "data subject" (betroffene Person), as my data protection dictionary (German-English) reveals. The EO says: "… shall retain non-United States persons’ personal information collected through signals intelligence only if the retention of comparable information concerning United States persons would be permitted under applicable law and shall subject such information to the same retention periods that would apply to comparable information concerning United States persons; …".

From this and other formulations, it becomes clear that EU citizens are meant to be treated about as badly as US citizens, and thus better than before. So if intelligence agencies are allowed to process information about a US citizen, then in future that is also meant to be allowed for data of EU citizens. I am glad to hear it.

Biden's EO also says that data of EU citizens is to be deleted if the data would be deleted were it about US citizens.

Fortunately, only authorised and specially trained persons get access to data of EU citizens obtained through espionage: “… shall limit access to such personal information to authorized personnel who have a need to know the information to perform their mission and have received appropriate training on the requirements of applicable United States law …”. Luckily, only trained drone pilots fire into a crowd in Afghanistan, even if the crowd does not consist only of terrorists, or not at all. Last seen on Markus Lanz (a German talk show) when Chelsea Manning was a guest.

As the EO makes clear, the US legal provisions EO 12333 and FISA 702 are specifically not to be adapted, at least not as far as the rights, or rather non-rights, of US citizens are concerned, and thus also not as far as the non-rights of EU citizens are concerned, who are then meant to be on a par with US citizens: “This order is not intended to alter the rules applicable to United States persons adopted pursuant to FISA, Executive Order 12333, or other applicable law.”

Then a construct called the Civil Liberties Protection Officer (CLPO) is introduced. I see this person as a kind of adviser, a data protection adviser or data protection officer of the US government, so to speak. The CLPO gives their opinion to the "Director", who in turn decides on the basis of the National Intelligence Priorities Framework (NIPF). The NIPF, in turn, is adjusted under the EO so that EU citizens are to be treated as badly as US citizens. If the "Director" disagrees with the CLPO about the processing of EU citizens' data, the "Director" is to speak to the POTUS (POTUS = President Of The United States; if need be, they can then also speak to the FLOTUS – FLOTUS = First Lady Of The United States).

Once the CLPO, the Director and the POTUS have come to an agreement, and the FLOTUS has no objections either, say about the wall colour of the room in which the three are talking, the data processing is deemed approved by the POTUS as decided by the Director, and the CLPO has been overruled. So everything stays as it was. Everything stays in the old state (= unlawful under the Schrems II judgment) even faster if the CLPO and the Director agree immediately and the POTUS does not have to be briefed at all.

It gets quite funny when the Data Protection Review Court is mentioned. Court normally means a judicial body, but that is not what is meant here. The Attorney General is allowed to make up a procedure within 60 days that this pseudo-court is to follow when data protection questions arise. Suppose a data subject from the EU learns that they have been spied on, they may then turn to the Court. The Court consists of data protection specialists who are also supposed to be familiar with the national security laws of the US!

Furthermore, a lawyer is to advise the Court. So it is an association of Ladies and Gentlemen who make a decision. Jury decisions, as they seem to be customary in (real) American courts, are not to my liking either. But this association can only be called a big theatre.

So if a data subject has managed to learn about the espionage against them, they may receive an answer from the Court. In the end, however, the Court does not tell the person how exactly they were spied on, but only whether US laws were complied with or not: "… shall inform the complainant, through the appropriate public authority in a qualifying state and without confirming or denying that the complainant was subject to United States signals intelligence activities, that “the review either did not identify any covered violations or the Data Protection Review Court issued a determination requiring appropriate remediation.” Even the information as to whether spying took place at all may not be given under the executive order. That is only consistent, because espionage is secret, after all.

In some places, the executive order even expands data processing in the US. For in addition to existing procedures, the Data Protection Review Court now also gets access (“… are obtaining full access to necessary information ….”). At least it is reviewed annually whether this access to information should continue. But if not, how is the Court supposed to make sensible decisions? That is a bit reminiscent of parliamentary inquiries, to which the German federal government often responds with heavily redacted documents. In the course of the annual audits, it will probably also be decided whether further bodies are to be introduced that can be given a new abbreviation. The Privacy and Civil Liberties Oversight Board has already had this honour and is abbreviated PCLOB. I hope I have not forgotten any important abbreviation from the EO document.

I found the term "access" several times in the document, but never in the context of data subjects receiving access to their data, only in the sense of which bodies and organs now receive more or the same access as before, or just as much access as if an EU citizen were a US citizen.

Almost the most important point last: an executive order of an American president has no expiry date or duration. It can be reversed or amended at any time, for instance by the next president or by the current president if they no longer feel like keeping their order.

Conclusion

Even what I understood of Biden's executive order seems enough to me to regard it as unsuitable for guaranteeing the rights of European citizens. The GDPR still does NOT apply in the US.

EU citizens apparently are treated about as badly as US citizens. Data subjects get no access to information, just as little as now, so it seems to me. If the GDPR is not complied with in the US, why should it be complied with when EU citizens are treated as badly as US citizens? Perhaps better than before, but still too bad.

Incidentally, I think nothing of TIAs. TIAs are not a legal basis. TIA stands for Transfer Impact Assessment and is meant to say something about the risk of a data protection problem arising when data goes to the US or to companies headquartered in the US or with a US parent company. How is one supposed to make a statement about a black hole when its interior cannot be observed?

The term "right" (such as "right of access") appears in the entire document in only two places, neither of which improves the legal position of data subjects.

The executive order can be reversed or amended at any time. It has no binding force over time. From a trust perspective, it is therefore as if it did not exist at all.

The only good thing about the executive order is that it allows another year to take action against data transfers to the US. But even after this transition period, the EU must not grant the US an equivalent level of data protection. If it does anyway, that is a testimonial of poverty, which a lawsuit that has already been announced will soon expose again and undo.

How about this: ideally, do not use solutions from Google, Microsoft and so on if there are simple alternatives. Instead of Shopify (banned by the Rhineland-Palatinate data protection authority because of its use of the CDNs Fastly and Cloudflare), one could also use a different web shop system. What does not always work with Windows (replacing it) does work very well with Google Analytics.

Alle Bilder in diesem Beitrag wurden von einem Computer-Programm erzeugt. Verwendet wurde das selbst entwickelte KI-System von Dr. DSGVO, ähnlich zu Midjourney. Die Bilder dürfen auf Webseiten frei verwendet werden, mit der Bitte, eine Verlinkung auf diesen Blog zu setzen.