US White House Executive Order Is Latest Step In Finalizing Agreement For EU-US Data Flows

On October 7, 2022, United States (US) President Joe Biden signed an Executive Order setting out the steps that the US will take to implement its commitments under the European Union-US Data Privacy Framework (the EU-US DPF). This comes after the March 2022 announcement that the European Commission and the US reached a new deal in principle on cross-border data flows, as previously reported by the E-TIPS® Newsletter here.

Specifically, the Executive Order:

• Increases safeguards for US signals intelligence activities, including requiring that such activities only be conducted for defined national security objectives;
• Directs handling requirements for personal information collected through signals intelligence activities;
• Extends the responsibilities of legal, oversight, and compliance officials to ensure that appropriate actions are taken to rectify cases of non-compliance; and   
• Requires US Intelligence Community elements to update their policies and procedures to reflect the new privacy and civil liberties safeguards within the Executive Order. 

The Executive Order also creates a multilayered mechanism for individuals from qualifying states and regional economic integration organizations to obtain independent, binding review and redress of claims that their personal information collected through US signals intelligence was collected or handled by the US in contravention of applicable US law. Finally, the Executive Order calls on the Privacy and Civil Liberties Oversight Board to review Intelligence Community policies and procedures to ensure consistency with the Executive Order, and for an annual review of the redress process.

According to the statement released by the White House, the Executive Order “bolsters an already rigorous array of privacy and civil liberties safeguards for U.S. signals intelligence activities. It also creates an independent and binding mechanism enabling individuals in qualifying states and regional economic integration organizations, as designated under the E.O., to seek redress if they believe their personal data was collected through U.S. signals intelligence in a manner that violated applicable U.S. law.”

The European Commission is expected to review the framework and decide on its adequacy.

Summary By: Sharan Johal