Findings of EU-US Ad Hoc Working Group on US Surveillance and Data Protection

On 27 November, the EU-Commission and the EU-Presidency Council have published as Co-Chairs their "Report on the Findings of the EU Co-Chairs of the Ad Hoc EU-US Working Group on Data Protection". The purpose of this Working Group was to establish the facts about US surveillance programmes and their impact on fundamental rights in the EU and personal data of EU citizens. The summary of the main findings is provided here:

(1) Legal Basis and Scope of US Surveillance

"Under US law, a number of legal bases allow large-scale collection and processing, for foreign intelligence purposes, including counter-terrorism, of personal data that has been transferred to the US or is processed by US companies. The US has confirmed the existence and the main elements of certain aspects of these programmes, under which data collection and processing is done with a basis in US law that lays down specific conditions and safeguards. Other elements remain unclear, including the number of EU citizens affected by these surveillance programmes and the geographical scope of surveillance programmes under Section 702."

(2) Safeguards Applicable to Data Subjects

"There are differences in the safeguards applicable to EU data subjects compared to US data subjects, namely:

1. Collection of data pertaining to US persons is, in principle, not authorised under Section 702. Where it is authorised, data of US persons is considered to be "foreign intelligence" only if necessary to the specified purpose. This necessity requirement does not apply to data of EU citizens which is considered to be "foreign intelligence" if it relates to the purposes pursued. This results in lower threshold being applied for the collection of personal data of EU citizens.
2. The targeting and minimisation procedures approved by FISC under Section 702 are aimed at reducing the collection, retention and dissemination of personal data of or concerning US persons. These procedures do not impose specific requirements or restrictions with regard to the collection, processing or retention of personal data of individuals in the EU, even when they have no connection with terrorism, crime or any other unlawful or dangerous activity. Oversight of the surveillance programmes aims primarily at protecting US persons.
3. Under both Section 215 and Section 702, US persons benefit from constitutional protections (respectively, First and Fourth Amendments) that do not apply to EU citizens not residing in the US."

(3) Differences in Data and Their Protection Safeguards

"Moreover, under US surveillance programmes, different levels of data protection safeguards apply to different types of data (meta-data vs. content data) and different stages of data processing (initial acquisition vs. further processing/analysis)."

(4) Existence of Other Surveillance Programmes?

"A lack of clarity remains as to the use of other available legal bases, the existence of other surveillance programmes as well as limitative conditions applicable to these programmes. This is especially relevant regarding Executive Order 12333."

(5) No Access, Rectification or Erasure for Individuals

"Since the orders of the FISC are classified and companies are required to maintain secrecy with regard to the assistance they are required to provide, there are no avenues, judicial or administrative, for either EU or US data subjects to be informed of whether their personal data is being collected or further processed. There are no opportunities for individuals to obtain access, rectification or erasure of data, or administrative or judicial redress."

(6) Layers of US-Governmental Oversight

"Various layers of oversight by the three branches of Government apply to activities on the base of Section 215 and Section 702. There is judicial oversight for activities that imply a capacity to compel information, including FISC orders for the collection under Section 215 and annual certifications that provide the basis for collection under Section 702. There is no judicial approval of individual selectors to query the data collected under Section 215 or tasked for collection under Section 702. The FISC operates ex parte and in camera. Its orders and opinions are classified, unless they are declassified. There is no judicial oversight of the collection of foreign intelligence outside the US under Executive Order 12333, which are conducted under the sole competence of the Executive Branch."

"Report on the Findings of the EU Co-Chairs of the Ad Hoc EU-US Working Group on Data Protection" of 27 November 2013