On 7 October 2022, the US White House published the Executive Order on enhancing safeguards for United States signals intelligence activities. This action is the first part of the US legal apparatus required for the EU Commission to find certain transfers to the US to be adequate. It is also likely in due course to make it easier to find more transfers under SCCs and BCRs to the US are compliant under transfer impact assessments.
When the White House first announced the shape of the EU/ US Transatlantic Data Protection Framework in March this year (see here) it said it would include commitments to limit the scope of signals intelligence activities and make them subject to proportionality, provide redress to EU data subjects via an independent Data Protection Review Court, and that participating companies would be required to adhere to the Privacy Shield Principles (thereby reviving the Privacy Shield transfer mechanism).
Today’s Executive Order sets out the controls that the US intelligence community will be subjected to and the high level principles for the independent Data Protection Review Court. However, the Executive Order’s applicability depends on the US Attorney General designating it to apply to a “qualifying state or regional economic integration organisation”, such designation to be applied only if the qualifying state protects US persons’ personal information in a similar fashion and if the qualifying state permits, or anticipates permitting, export of personal data to the US for commercial purposes. No such designation has been made alongside the Executive Order. It also anticipates that the US Attorney General will issue regulations establishing the Data Protection Review Court in the next 2 months. Finally, there is no mention of the Privacy Shield.
Whilst the publication of the Executive Order must be good news for data transfers to the US in that it certainly includes greater controls and better redress than the current position, its incompleteness, the fact it has no application until the EU is designated as a qualifying state means timing remains uncertain and its full utility for transfer impact assessments cannot be called at this point. That being said, the UK and US Governments published a joint statement with the UK welcoming the publication of the Executive Order in the context of the UK-US adequacy discussions, which it aims to work expediently to conclude. For completeness, the EU Commission’s FAQs on the Executive Order can be found here.
We will track the missing pieces and the impact on transfers to the US from the EU and UK in the coming days and weeks.
