"This executive order is a positive yet insufficient step to ensure that any future E.U.-U.S. data transfer deal effectively protects people's rights, and doesn't end up invalidated by the E.U.'s highest court," said Estelle Masse, global data protection lead at Access Now.
"Access Now appreciates the work done to bring more clarity on U.S. safeguards," she added, "but the measures signed today are not sufficient to guarantee an effective right to remedy and to put limitations to the far-reaching scope of U.S. surveillance."
Ashley Gorski, senior staff attorney with the ACLU National Security Project, was similarly critical.
"President Biden's executive order does not go far enough. It fails to adequately protect the privacy of Americans and Europeans, and it fails to ensure that people whose privacy is violated will have their claims resolved by a wholly independent decision-maker," she said. "Although the executive order is a step in the right direction, it does not meet basic legal requirements in the E.U., leaving E.U.-U.S. data transfers in jeopardy going forward."
Biden's order follows the Court of Justice of the European Union (CJEU) striking down the "Privacy Shield" data sharing agreement in 2020 after invalidating the "Safe Harbor" deal five years earlier, in the wake of whistleblower Edward Snowden exposing U.S. mass surveillance.
The order--which all relevant agencies must update their policies to comply with--says in part that "the United States shall conduct signals intelligence collection activities only following a determination that a specific signals intelligence collection activity, based on a reasonable assessment of all relevant factors, is necessary to advance a validated intelligence priority."
A White House fact sheet claims the order "bolsters an already rigorous array of privacy and civil liberties safeguards for U.S. signals intelligence activities," highlighting that it "creates an independent and binding mechanism enabling individuals in qualifying states and regional economic integration organizations... to seek redress if they believe their personal data was collected" in a manner that violates U.S. law.
The civil liberties protection officer in the Office of the Director of National Intelligence "will conduct an initial investigation of qualifying complaints," the fact sheet explains. Biden's order also directs the U.S. attorney general to establish a Data Protection Review Court "to provide independent and binding review" of the first-round decisions.
U.S. Secretary of Commerce Gina Raimondo told reporters at a Thursday briefing that the administration's commitments "fully address" the CJEU's previous concerns "and will cover personal data transfers to the United States under E.U. law," according to Politico.
As the news outlet reported:
The executive order is the next step in the creation of a new trans-Atlantic data sharing agreement that is needed for thousands of companies--from Google to General Electric--to move data between two of the world's most important economies. The decree will now be sent to Brussels where the European Commission--alongside input from the bloc's privacy agencies and politicians, as well as E.U. countries--will transpose the text into its own rules.
That process is expected to take around six months, and will lead to a final pact being published in roughly March, 2023.
Senior Biden administration officials, who spoke on the condition of anonymity because they were not authorized to speak publicly, said they were confident the White House executive order and the Department of Justice's new regulations would satisfy the commission's concerns. More importantly, the officials said they felt the new framework would also withstand any legal challenges that would force the U.S. government to have to go back to the drawing board.
Meanwhile, disappointed privacy rights supporters--who were skeptical that the E.O. will meet the E.U.'s standards--argued that Biden's inadequate action is proof that Congress must step in.
"The United States must urgently act to reform surveillance, provide privacy and data protection rights in its statutes at the federal level, and give non-U.S. persons a comprehensive right to remedy," said Willmary Escoto, U.S. data protection lead at Access Now.
"The lack of political willingness in the U.S. to protect privacy, in statutes and in practice, is putting people at risk in the U.S. and outside," Escoto warned. "This is a partial fix to a substantial problem, and while negotiators have made progress, this order may not satisfy all the requirements set by the E.U. court."
"Congress must enact meaningful surveillance reform."
Demand Progress senior policy counsel Sean Vitka declared that the order "fails to put in place the meaningful reforms necessary to protect privacy on both sides of the Atlantic and should be rejected as insufficient."
"The E.O. expressly provides for bulk surveillance, guaranteeing entirely innocent people will be harmed. It does not provide meaningful redress for people who have been wrongfully spied upon, including by failing to require government notice to them. And the E.O. can be changed by the administration at will," he continued. "The White House has failed to grapple meaningfully with the privacy questions at the heart of this issue. Congress must act where the administration has not."
Gorski at the ACLU agreed, stressing that "the problems with the U.S. surveillance regime cannot be cured by an executive order alone."
"To protect our privacy and to put trans-Atlantic data transfers on a sound legal footing, Congress must enact meaningful surveillance reform," she said. "Until that happens, U.S. businesses and individuals will continue to pay the price."
