New Biden Executive Order On EU-US Data Transfers Fails to Adequately Protect Privacy

Today, the Biden administration issued an executive order intended to facilitate future data transfers between the European Union and the United States after a European court invalidated a previous data-transfer agreement on privacy and other grounds. The executive order imposes certain new rules for bulk surveillance by the United States and creates an administrative redress process for individuals subject to unlawful surveillance.

"President Biden's executive order does not go far enough. It fails to adequately protect the privacy of Americans and Europeans, and it fails to ensure that people whose privacy is violated will have their claims resolved by a wholly independent decision-maker," said Ashley Gorski, senior staff attorney with the ACLU National Security Project. "Although the executive order is a step in the right direction, it does not meet basic legal requirements in the EU, leaving EU-U.S. data transfers in jeopardy going forward."

The executive order is designed to respond to a July 2020 decision by the EU's highest court to invalidate "Privacy Shield," a data-transfer agreement between the EU and the U.S. More than 5,000 U.S. companies relied on Privacy Shield for trans-Atlantic data transfers. The EU Court of Justice concluded that Privacy Shield failed to adequately protect the privacy rights of Europeans from U.S. mass surveillance for foreign intelligence purposes. In the absence of Privacy Shield, large-scale data transfers to the U.S. are more complicated, costly, and surrounded by legal uncertainty.

The Court of Justice's ruling came in a case originally brought by Austrian lawyer and privacy advocate Max Schrems against Facebook Ireland. The American Civil Liberties Union provided expert testimony about U.S. surveillance laws in the case.

The July 2020 ruling was the second time that the Court of Justice invalidated a data-transfer agreement between the European Union and the United States. In 2015, the court invalidated the "Safe Harbor" agreement -- the two governments' initial attempt to reconcile European privacy law and U.S. surveillance practices -- after Edward Snowden's revelations about the scope of warrantless NSA surveillance.

"The problems with the U.S. surveillance regime cannot be cured by an executive order alone," said Gorski. "To protect our privacy and to put transatlantic data transfers on a sound legal footing, Congress must enact meaningful surveillance reform. Until that happens, U.S. businesses and individuals will continue to pay the price."

The ACLU is calling on Congress to radically reform U.S. surveillance laws to rein in warrantless spying, and to ensure that there is a meaningful opportunity to challenge the government's surveillance.

Necessary reforms include:

• Ending bulk, generalized data collection conducted under Executive Order 12333;
• Narrowing the categories of persons who may be targeted using surveillance under Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333; and
• Ensuring that individuals impacted by U.S. surveillance are able to challenge improper surveillance in U.S. courts, including by reforming the "state secrets privilege."