(1)

Regulation (EU) 2016/679 (2) sets out the rules for the transfer of personal data from controllers or processors in the Union to third countries and international organisations to the extent that such transfers fall within its scope of application. The rules on international data transfers are laid down in Chapter V of that Regulation. While the flow of personal data to and from countries outside the European Union is essential for the expansion of cross-border trade and international cooperation, the level of protection afforded to personal data in the Union must not be undermined by transfers to third countries or international organisations (3).

(2)

Pursuant to Article 45(3) of Regulation (EU) 2016/679, the Commission may decide, by means of an implementing act, that a third country, a territory or one or more specified sectors within a third country, ensure(s) an adequate level of protection. Under this condition, transfers of personal data to a third country may take place without the need to obtain any further authorisation, as provided for in Article 45(1) and recital 103 of Regulation (EU) 2016/679.

(3)

As specified in Article 45(2) of Regulation (EU) 2016/679, the adoption of an adequacy decision has to be based on a comprehensive analysis of the third country’s legal order, covering both the rules applicable to data importers and the limitations and safeguards as regards access to personal data by public authorities. In its assessment, the Commission has to determine whether the third country in question guarantees a level of protection ‘essentially equivalent’ to that ensured within the Union (recital 104 of Regulation (EU) 2016/679). Whether this is the case is to be assessed against Union legislation, notably Regulation (EU) 2016/679, as well as the case law of the Court of Justice of the European Union (the Court of Justice) (4).

(4)

As clarified by the Court of Justice in its judgment of 6 October 2015 in Case C-362/14, Maximillian Schrems v Data Protection Commissioner (5) (Schrems), this does not require finding an identical level of protection. In particular, the means to which the third country in question has recourse for protecting personal data may differ from the ones employed in the Union, as long as they prove, in practice, effective for ensuring an adequate level of protection (6). The adequacy standard therefore does not require a point-to-point replication of Union rules. Rather, the test is whether, through the substance of privacy rights and their effective implementation, supervision and enforcement, the foreign system as a whole delivers the required level of protection (7). Furthermore, according to that judgment, when applying this standard, the Commission should notably assess whether the legal framework of the third country in question provides rules intended to limit interferences with the fundamental rights of the persons whose data is transferred from the Union, which the State entities of that country would be authorised to engage in when they pursue legitimate objectives, such as national security, and provides effective legal protection against interferences of that kind (8). The ‘Adequacy Referential’ of the European Data Protection Board, which seeks to further clarify this standard, also provides guidance in this regard (9).

(5)

The applicable standard with respect to such interference with the fundamental rights to privacy and data protection was further clarified by the Court of Justice in its judgment of 16 July 2020 in Case C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (Schrems II), which invalidated Commission Implementing Decision (EU) 2016/1250 (10) on a previous transatlantic data flow framework, the EU-U.S. Privacy Shield (Privacy Shield). The Court of Justice considered that the limitations to the protection of personal data arising from U.S. domestic law on the access and use by U.S. public authorities of data transferred from the Union to the United States for national security purposes were not circumscribed in a way that satisfies requirements that are essentially equivalent to those under Union law, as regards the necessity and proportionality of such interferences with the right to data protection (11). The Court of Justice also considered that no cause of action was available before a body which offers the persons whose data was transferred to the United States guarantees essentially equivalent to those required by Article 47 of the Charter on the right to an effective remedy (12).

(6)

Following the Schrems II judgment, the Commission entered into talks with the U.S. government with a view to a possible new adequacy decision that would meet the requirements of Article 45(2) of Regulation (EU) 2016/679 as interpreted by the Court of Justice. As a result of these discussions, the United States on 7 October 2022 adopted Executive Order 14086 ‘Enhancing Safeguards for US Signals Intelligence Activities’ (EO 14086), which is complemented by a Regulation on the Data Protection Review Court issued by the U.S. Attorney General (AG Regulation) (13). In addition, the framework that applies to commercial entities processing data transferred from the Union under the present Decision – the ‘EU-U.S. Data Privacy Framework’ (EU-U.S. DPF or DPF) – has been updated.

(7)

The Commission has carefully analysed U.S. law and practice, including EO 14086 and the AG Regulation. Based on the findings set out in recitals 9-200, the Commission concludes that the United States ensures an adequate level of protection for personal data transferred under the EU-U.S. DPF from a controller or a processor in the Union (14) to certified organisations in the United States.

(8)

This Decision has the effect that personal data transfers from controllers and processors in the Union (15) to certified organisations in the United States may take place without the need to obtain any further authorisation. It does not affect the direct application of Regulation (EU) 2016/679 to such organisations where the conditions regarding the territorial scope of that Regulation, laid down in its Article 3, are fulfilled.

(9)

The EU-U.S. DPF is based on a system of certification by which U.S. organisations commit to a set of privacy principles - the ‘EU-U.S. Data Privacy Framework Principles’, including the Supplemental Principles (together: the Principles) - issued by the U.S. Department of Commerce (DoC) and contained in Annex I to this Decision (16). To be eligible for certification under the EU-U.S. DPF, an organisation must be subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) or the U.S. Department of Transportation (DoT) (17). The Principles apply immediately upon certification. As explained in more detail in recitals 48-52, EU-U.S. DPF organisations are required to re-certify their adherence to the Principles on an annual basis (18).

(10)

The protection afforded under the EU-U.S. DPF applies to any personal data transferred from the Union to organisations in the U.S. that have certified their adherence to the Principles with the DoC, with the exception of data that is collected for publication, broadcast or other forms of public communication of journalistic material and information in previously published material disseminated from media archives (19). Such information can therefore not be transferred on the basis of the EU-U.S. DPF.

(11)

The Principles define personal data/personal information in the same way as Regulation (EU) 2016/679, i.e. as “data about an identified or identifiable individual that are within the scope of the GDPR received by an organization in the United States from the EU, and recorded in any form” (20). Accordingly, they also cover pseudonymised (or “key-coded”) research data (including where the key is not shared with the receiving U.S. organisation) (21). Similarly, the notion of processing is defined as “any operation or set of operations which is performed upon personal data, whether or not by automated means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure or dissemination and erasure or destruction” (22).

(12)

The EU-U.S. DPF applies to organisations in the U.S. that qualify as controllers (i.e. as a person or organisation which, alone or jointly with others, determines the purposes and means of the processing of personal data) (23) or processors (i.e. agents acting on behalf of a controller) (24). U.S. processors must be contractually bound to act only on instructions from the EU controller and assist the latter in responding to individuals exercising their rights under the Principles (25). In addition, in the case of sub-processing, a processor must conclude a contract with the sub-processor guaranteeing the same level of protection as provided by the Principles and take steps to ensure its proper implementation (26).

(13)

Personal data should be processed lawfully and fairly. It should be collected for a specific purpose and subsequently used only insofar as this is not incompatible with the purpose of processing.

(14)

Under the EU-U.S. DPF, this is ensured through different Principles. Firstly, under the Data Integrity and Purpose Limitation Principle, similarly as under Article 5(1)(b) of Regulation (EU) 2016/679, an organisation may not process personal data in a way that is incompatible with the purpose for which it was originally collected or subsequently authorised by the data subject (27).

(15)

Secondly, before using personal data for a new (changed) purpose that is materially different but still compatible with the original purpose, or disclosing it to a third party, the organisation must provide data subjects with the opportunity to object (opt-out), in accordance with the Choice Principle (28), through a clear, conspicuous and readily available mechanism. Importantly, this Principle does not supersede the express prohibition on incompatible processing (29).

(16)

Specific safeguards should exist where ‘special categories’ of data are processed.

(17)

In accordance with the Choice Principle, specific safeguards apply to the processing of ‘sensitive information’, i.e. personal data specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, information on the sex life of the individual or any other information received from a third party that is identified and treated by that party as sensitive (30). This means that any data that is considered sensitive under Union data protection law (including data on sexual orientation, genetic data and biometric data) will be treated as sensitive under the EU-U.S. DPF by certified organisations.

(18)

As a general rule, organisations must obtain affirmative express consent (i.e. opt-in) from individuals to use sensitive information for purposes other than those for which it was originally collected or subsequently authorised by the individual (through opt-in), or to disclose it to third parties (31).

(19)

Such consent does not have to be obtained in limited circumstances similar to comparable exceptions provided under Union data protection law, e.g. where the processing of sensitive data is in the vital interest of a person; is necessary for the establishment of legal claims; or is required to provide medical care or diagnosis (32).

(20)

Data should be accurate and, where necessary, kept up to date. It should also be adequate, relevant and not excessive in relation to the purposes for which it is processed, and in principle be kept for no longer than is necessary for the purposes for which the personal data is processed.

(21)

Under the Data Integrity and Purpose Limitation Principle (33), personal data must be limited to what is relevant for the purpose of the processing. In addition, organisations must, to the extent necessary for the purposes of the processing, take reasonable steps to ensure that personal data is reliable for its intended use, accurate, complete and current.

(22)

Moreover, personal information may be retained in a form identifying or rendering an individual identifiable (and thus in the form of personal data) (34) only for as long as it serves the purpose(s) for which it was initially collected or subsequently authorised by the individual pursuant to the Choice Principle. This obligation does not prevent organisations from continuing to process personal information for longer periods, but only for the time and to the extent such processing reasonably serves one of the following specific purposes similar to comparable exceptions provided under Union data protection law: archiving in the public interest, journalism, literature and art, scientific and historical research and statistical analysis (35). Where personal data is retained for one of these purposes, its processing is subject to the safeguards provided by the Principles (36).

(23)

Personal data should also be processed in a manner that ensures its security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage. To that end, controllers and processors should take appropriate technical or organisational measures to protect personal data from possible threats. These measures should be assessed taking into consideration the state of the art, related costs and the nature, scope, context and purposes of processing, as well as the risks for the rights of individuals.

(24)

Under the EU-U.S. DPF, this is ensured by the Security Principle, which requires, similarly to Article 32 Regulation (EU) 2016/679, to take reasonable and appropriate security measures, taking into account the risks involved in the processing and the nature of the data (37).

(25)

Data subjects should be informed of the main features of the processing of their personal data.

(26)

This is ensured through the Notice Principle (38), which, similarly to the transparency requirements under Regulation (EU) 2016/679, requires organisations to inform data subjects about, inter alia, (i) the participation of the organisation in the DPF, (ii) the type of data collected, (iii) the purpose of the processing, (iv) the type or identity of third parties to which personal data may be disclosed and the purposes for doing so, (v) their individual rights, (vi) how to contact the organisation and (vii) available redress avenues.

(27)

This notice must be provided in a clear and conspicuous language when individuals are first asked to provide the personal data or as soon as practicable thereafter, but in any event before the data is used for a materially different (but compatible) purpose than the one for which it was collected, or before it is disclosed to a third party (39).

(28)

In addition, organisations must make their privacy policies reflecting the Principles public (or, in the case of human resources data, make them readily available to the concerned individuals) and provide links to the DoC’s website (with further details on certification, the rights of data subjects and available recourse mechanisms), the Data Privacy Framework List (DPF List) of participating organisations and the website of an appropriate alternative dispute settlement provider (40).

(29)

Data subjects should have certain rights which can be enforced against the controller or processor, in particular the right of access to data, the right to object to the processing and the right to have data rectified and erased.

(30)

The Access Principle (41) of the EU-U.S. DPF provides individuals with such rights. In particular, data subjects have the right, without the need for justification, to obtain from an organisation confirmation of whether it is processing personal data related to them; have the data communicated to them; and obtain information about the purpose of the processing, the categories of personal data being processed and the (categories of) recipients to whom the data is disclosed (42). Organisations are required to respond to access requests within a reasonable period of time (43). An organisation may set reasonable limits to the number of times within a given period that access requests from a particular individual will be met and may charge a fee that is not excessive, e.g. where requests are manifestly excessive, in particular because of their repetitive character (44).

(31)

The right of access may only be restricted in exceptional circumstances similar to the ones provided under Union data protection law, in particular where the legitimate rights of others would be violated; where the burden or expense of providing access would be disproportionate to the risks to the individual’s privacy in the circumstances of the case (although expense and burden are not controlling factors in determining whether providing access is reasonable); to the extent that disclosure is likely to interfere with the safeguarding of important countervailing public interests, such as national security, public security or defence; the information contains confidential commercial information; or the information is processed solely for research or statistical purposes (45). Any denial of, or limitation to a right has to be necessary and duly justified, with the organisation bearing the burden of demonstrating that these requirements are fulfilled (46). In carrying out that assessment, the organisation must take particularly into account the individual’s interests (47). Where it is possible to separate information from other data to which a restriction applies, the organisation must redact the protected information and disclose the remaining information (48).

(32)

In addition, data subjects have the right to obtain rectification or amendment of inaccurate data, and to obtain deletion of data that has been processed in violation of the Principles (49). Moreover, as explained in recital 15, individuals have a right to object/opt-out to the processing of their data for materially different (but compatible) purposes than those for which the data was collected and to the disclosure of their data to third parties. When personal data is used for direct marketing purposes, individuals have a general right to opt-out from the processing at any time (50).

(33)

The Principles do not specifically address the issue of decisions affecting the data subject based solely on the automated processing of personal data. However, as regards personal data that has been collected in the Union, any decision based on automated processing will typically be taken by the controller in the Union (which has a direct relationship with the concerned data subject) and is thus directly subject to Regulation (EU) 2016/679 (51). This includes transfer scenarios where the processing is carried out by a foreign (for instance U.S.) business operator acting as an agent (processor) on behalf of the controller in the Union (or as a sub-processor acting on behalf of the Union processor having received the data from a Union controller that collected it) which on this basis then takes the decision.

(34)

This was confirmed by a study commissioned by the Commission in 2018 in the context of the second annual review of the functioning of the Privacy Shield (52), which concluded that, at the time, there was no evidence suggesting that automated decision-making was normally being carried out by Privacy Shield organisations on the basis of personal data transferred under the Privacy Shield.

(35)

In any event, in areas where companies most likely resort to the automated processing of personal data to take decisions affecting the individual (e.g. credit lending, mortgage offers, employment, housing and insurance), U.S. law offers specific protections against adverse decisions (53). These acts typically provide that individuals have the right to be informed of the specific reasons underlying the decision (e.g. the rejection of a credit), to dispute incomplete or inaccurate information (as well as reliance on unlawful factors), and to seek redress. In the area of consumer credit, the Fair Credit Reporting Act (FCRA) and Equal Credit Opportunity Act (ECOA) contain safeguards that provide consumers with some form of a right to explanation and a right to contest the decision. These Acts are relevant in a wide range of areas, including credit, employment, housing and insurance. In addition, certain anti-discrimination laws, such as Title VII of the Civil Rights Act and the Fair Housing Act, provide individuals with protections with respect to models used in automated decision-making that could lead to discrimination on the basis of certain characteristics, and grant individuals rights to challenge such decisions, including automated ones. With respect to health information, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule creates certain rights that are similar to those of Regulation (EU) 2016/679 with respect to accessing personal health information. In addition, guidance from the U.S. authorities require medical providers to receive information that allow them to inform individuals of automated decision-making systems used in the medical sector (54).

(36)

Therefore, these rules offer protections similar to those provided under Union data protection law in the unlikely situation in which automated decisions would be taken by the EU-U.S. DPF organisation itself.

(37)

The level of protection afforded to personal data transferred from the Union to organisations in the United States must not be undermined by the further transfer of such data to a recipient in the United States or another third country.

(38)

Under the Accountability for Onward Transfer Principle (55) , special rules apply for so-called ‘onward transfers’, i.e. transfers of personal data from an EU-U.S. DPF organisation to a third party controller or processor, irrespective of whether the latter is located in the United States or a third country outside the United States (and the Union). Any onward transfer can only take place (i) for limited and specified purposes, (ii) on the basis of a contract between the EU-U.S. DPF organisation and the third party (56) (or comparable arrangement within a corporate group (57)) and (iii) only if that contract requires the third party to provide the same level of protection as the one guaranteed by the Principles.

(39)

This obligation to provide the same level of protection as guaranteed by the Principles, read in combination with the Data Integrity and Purpose Limitation Principle, notably means that the third party may only process the personal information transmitted to it for purposes that are not incompatible with the purposes for which it was collected or subsequently authorised by the individual (in accordance with the Choice Principle).

(40)

The Accountability for Onward Transfer Principle should also be read in conjunction with the Notice Principle and, in the case of an onward transfer to a third party controller (58), with the Choice Principle, according to which data subjects must be informed (among others) about the type/identity of any third party recipient, the purpose of the onward transfer and the choice offered, and can object (opt out) or, in the case of sensitive data, have to give “affirmative express consent” (opt in) for the onward transfer.

(41)

The obligation to provide the same level of protection as required by the Principles applies to any and all third parties involved in the processing of the data so transferred irrespective of their location (in the U.S. or another third country) as well as when the original third party recipient itself transfers those data to another third party recipient, for example for sub-processing purposes.

(42)

In all cases, the contract with the third-party recipient must provide that the latter will notify the EU-U.S. DPF organisation if it makes a determination that it can no longer meet its obligation. When such a determination is made, the processing by the third party must cease or other reasonable and appropriate steps must be taken to remedy the situation (59).

(43)

Additional protections apply in the case of an onward transfer to a third party agent (i.e. a processor). In such a case, the U.S. organisation must ensure that the agent only acts on its instructions and take reasonable and appropriate steps (i) to ensure that the agent effectively processes the personal information transferred in a manner consistent with the organisation’s obligations under the Principles and, (ii) to stop and remediate unauthorised processing, upon notice (60). The organisation may be required by the DoC to provide a summary or representative copy of the privacy provisions of the contract (61). Where compliance problems arise in a (sub-)processing chain, the organisation acting as the controller of the personal data will in principle face liability, as specified in the Recourse, Enforcement and Liability Principle, except if it proves that it is not responsible for the event giving rise to the damage (62).

(44)

Under the accountability principle, entities processing data are required to put in place appropriate technical and organisational measures to effectively comply with their data protection obligations and be able to demonstrate such compliance, in particular to the competent supervisory authority.

(45)

Once an organisation has voluntarily decided to certify (63) under the EU-U.S. DPF, its effective compliance with the Principles is compulsory and enforceable. Under the Recourse, Enforcement and Liability Principle (64), EU-U.S. DPF organisations must provide effective mechanisms to ensure compliance with the Principles. Organisations must also take measures to verify (65) that their privacy policies conform to the Principles and are in fact complied with. This can be done either through a system of self-assessment, which must include internal procedures ensuring that employees receive training on the implementation of the organisation’s privacy policies and that compliance is periodically reviewed in an objective manner, or outside compliance reviews, the methods of which may include auditing, random checks or use of technology tools.

(46)

In addition, organisations must retain records on the implementation of their EU-U.S. DPF practices and make them available upon request in the context of an investigation or a complaint about non-compliance to an independent dispute resolution body or competent enforcement authority (66).

(47)

The EU-U.S. DPF will be administered and monitored by the DoC. The Framework provides for oversight and enforcement mechanisms in order to verify and ensure that EU-U.S. DPF organisations comply with the Principles and that any failure to comply is addressed. These mechanisms are set out in the Principles (Annex I) and the commitments undertaken by the DoC (Annex III), the FTC (Annex IV) and the DoT (Annex V).

(48)

To certify under the EU-U.S. DPF (or re-certify on an annual basis), organisations are required to publicly declare their commitment to comply with the Principles, make their privacy policies available and fully implement them (67). As part of their (re-)certification application, organisations have to submit information to the DoC on, inter alia, the name of the relevant organisation, a description of the purposes for which the organisation will process personal data, the personal data that will be covered by the certification, as well as the chosen verification method, the relevant independent recourse mechanism and the statutory body that has jurisdiction to enforce compliance with the Principles (68).

(49)

Organisations can receive personal data on the basis of the EU-U.S. DPF from the date they are placed on the DPF list by the DoC. To ensure legal certainty and avoid ‘false claims’, organisations certifying for the first time are not allowed to publicly refer to their adherence to the Principles before the DoC has determined that the organisation’s certification submission is complete and added the organisation to the DPF List (69). To be allowed to continue to rely on the EU-U.S. DPF to receive personal data from the Union, such organisations must annually re-certify their participation in the framework. When an organisation leaves the EU-U.S. DPF for any reason, it must remove all statements implying that the organisation continues to participate in the Framework (70).

(50)

As reflected in the commitments set out in Annex III, the DoC will verify whether organisations meet all certification requirements and have put in place a (public) privacy policy containing the information required under the Notice Principle (71). Building on the experience with the (re-)certification process under the Privacy Shield, the DoC will carry out a number of checks, including to verify whether organisations’ privacy policies contain a hyperlink to the correct complaint form on the website of the relevant dispute resolution mechanism and, when several entities and subsidiaries of one organisation are included in a certification submission, whether the privacy policies of each of those entities meet the certification requirements and are readily available to data subjects (72). In addition, where necessary, the DoC will carry out cross-checks with the FTC and DoT to verify that the organisations are subject to oversight body identified in their (re-)certification submissions, and will work with alternative dispute resolution bodies to verify that the organisations are registered for the independent recourse mechanism identified in their (re-)certification submission (73).

(51)

The DoC will inform organisations that, in order to complete the (re-)certification, they must address all issues identified during its review. In case an organisation fails to respond within a timeframe set by the DoC (for example, as regards re-certification the expectation would be that the process is completed within 45 days) (74) or otherwise fails to complete its certification, the submission will be considered abandoned. In that case, any misrepresentation about participation or compliance with the EU-U.S. DPF may be subject to enforcement action by the FTC or DoT (75).

(52)

To ensure the proper application of the EU-U.S. DPF, interested parties, such as data subjects, data exporters and the national data protection authorities (DPAs), must be able to identify those organisations adhering to the Principles. To ensure such transparency at the ‘entry point’, the DoC has committed to maintain and make available to the public the list of organisations that have certified their adherence to the Principles and fall within the jurisdiction of at least one of the enforcement authorities referred to in Annexes IV and V to this Decision (76). The DoC will update the list on the basis of an organisation’s annual re-certification submission and whenever an organisation withdraws or is removed from the EU-U.S. DPF. Furthermore, to guarantee transparency also at the ‘exit point’, the DoC will maintain and make available to the public a record of organisations that have been removed from the list, in each case identifying the reason for such removal (77). Finally, it will provide a link to the FTC’s webpage on the EU-U.S. DPF, which will list the FTC’s enforcement action under the Framework (78).

(53)

The DoC will monitor on an ongoing basis the effective compliance with the Principles by EU-U.S. DPF organisations through different mechanisms (79). In particular, it will carry out ‘spot checks’ of randomly selected organisations, as well as ad hoc spot checks of specific organisations when potential compliance issues are identified (e.g. reported to the DoC by third parties) to verify whether (i) point(s) of contact for handling complaints and data subject requests are available and responsive; (ii) the organisation’s privacy policy is readily available, both on its website and via a hyperlink on the DoC’s website; (iii) the organisation’s privacy policy continues to comply with the certification requirements and (iv) the organisations’ chosen independent dispute resolution mechanism is available to handle complaints (80).

(54)

If there is credible evidence that an organisation does not comply with its commitments under the EU-U.S. DPF (including if the DoC receives complaints or the organisation does not respond satisfactorily to inquiries of the DoC), the DoC will require the organisation to complete and submit a detailed questionnaire (81). An organisation that fails to satisfactorily and timely reply to the questionnaire will be referred to the relevant authority (the FTC or DoT) for possible enforcement action (82). As part of its compliance monitoring activities under the Privacy Shield, the DoC regularly conducted the spot checks mentioned in recital 53 and continuously monitored public reports, which allowed it to identify, address and resolve compliance issues (83). Organisations that persistently fail to comply with the Principles will be removed from the DPF List and must return or delete the personal data received under the Framework (84).

(55)

In other cases of removal, such as voluntary withdrawal from participation or failure to recertify, the organisation must either delete or return the data, or may retain it, provided it affirms to the DoC on an annual basis its commitment to continue to apply the Principles or provides adequate protection for the personal data by another authorized means (e.g. by using a contract that fully reflects the requirements of the relevant standard contractual clauses approved by the Commission) (85). In this case, an organisation also has to identify a contact point within the organisation for all EU-U.S. DPF-related questions.

(56)

The DoC will monitor any false claims of EU-U.S. DPF participation or the improper use of the EU-U.S. DPF certification mark, both ex officio and on the basis of complaints (e.g. received from DPAs) (86). In particular, the DoC will on an ongoing basis verify that organisations that (i) withdraw from participation in the EU-U.S. DPF, (ii) fail to complete the annual re-certification (i.e. either started, but failed to complete the annual re-certification process in a timely manner or did not even start the annual re-certification process), (iii) are removed as a participant, notably for “persistent failure to comply,” or (iv) fail to complete an initial certification (i.e. started, but failed to complete the initial certification process in a timely manner), remove from any relevant published privacy policy references to the EU-U.S. DPF that imply that the organisation actively participates in the Framework (87). The DoC will also conduct internet searches to identify references to the EU-U.S. DPF in organisations’ privacy policies, including to identify false claims by organisations that never participated in the EU-U.S. DPF (88).

(57)

Where the DoC finds that references to the EU-U.S. DPF have not been removed or are improperly used, it will inform the organisation about a possible referral to the FTC/DoT (89). If an organisation fails to respond satisfactorily, the DoC will refer the matter to the relevant agency for potential enforcement action (90). Any misrepresentation to the general public by an organisation concerning its adherence to the Principles in the form of misleading statements or practices is subject to enforcement action by the FTC, DoT or other relevant U.S. enforcement authorities. Misrepresentations to the DoC are enforceable under the False Statements Act (18 U.S.C. § 1001).

(58)

In order to ensure that an adequate level of data protection is guaranteed in practice, an independent supervisory authority tasked with powers to monitor and enforce compliance with the data protection rules should be in place.

(59)

EU-U.S. DPF organisations must be subject to the jurisdiction of the competent U.S. authorities – the FTC and DoT – which have the necessary investigatory and enforcement powers to effectively ensure compliance with the Principles (91).

(60)

The FTC is an independent authority composed of five Commissioners, who are appointed by the President with the advice and consent of the Senate (92). Commissioners are appointed for a seven-year term and may only be removed by the President for inefficiency, neglect of duty, or malfeasance in office. The FTC may not have more than three Commissioners of the same political party and Commissioners may not, during their appointment, engage in any other business, vocation, or employment.

(61)

The FTC can investigate compliance with the Principles, as well as false claims of adherence to the Principles or participation in the EU-U.S. DPF by organisations which either are no longer on the DPF List or have never certified (93). The FTC can enforce compliance by seeking administrative or federal court orders (including ‘consent orders’ achieved via settlements) (94) for preliminary or permanent injunctions or other remedies, and will systematically monitor compliance with such orders (95). Where organisations fail to comply with such orders, the FTC may seek civil penalties and other remedies, including for any injury caused by the unlawful conduct. Each consent order issued to an EU-U.S. DPF organisation will have self-reporting provisions (96), and organisations will be required to make public any relevant EU-U.S. DPF-related sections of any compliance or assessment report submitted to the FTC. Finally, the FTC will maintain an online list of organisations subject to FTC or court orders in EU-U.S. DPF cases (97).

(62)

With respect to the Privacy Shield, the FTC took enforcement action in around 22 cases, both with respect to violations of specific requirements of the framework (e.g. failure to affirm to the DoC that the organisation continued to apply the Privacy Shield protections after it left the framework, failure to verify, through a self-assessment or outside compliance review, that the organisation complied with the framework) (98) and false claims of participation in the framework (e.g. by organisations that failed to complete the necessary steps to obtain certification, or allowed their certification to lapse but misrepresented their continued participation) (99). This enforcement action inter alia resulted from the proactive use of administrative subpoenas to obtain materials from certain Privacy Shield participants to check to check for substantive violations of the Privacy Shield obligations (100).

(63)

More generally, the FTC has in the past years taken enforcement action in a number of cases concerning compliance with specific data protection requirements that are also provided under the EU-U.S. DPF, e.g. as regards the principles of purpose limitation and data retention (101), data minimisation (102), data security (103) and data accuracy (104).

(64)

The DoT has exclusive authority to regulate the privacy practices of airlines, and shares jurisdiction with the FTC with respect to the privacy practices of ticket agents in the sale of air transportation. DoT officers first aim at reaching a settlement and, if this is not possible, may initiate enforcement proceedings involving an evidentiary hearing before a DoT administrative law judge who has the authority to issue cease-and-desist orders and civil penalties (105). Administrative law judges benefit from several protections under the Administrative Procedure Act (APA) to ensure their independence and impartiality. For example, they can only be dismissed for good cause; are assigned to cases in rotation; may not perform duties inconsistent with their duties and responsibilities as administrative law judges; are not subject to supervision by the investigative team of the authority they are employed by (in this case the DoT); and must conduct their adjudicative/enforcement function impartially (106). The DoT has committed to monitor enforcement orders and ensure that orders resulting from EU-U.S. DPF cases are available on its website (107).

(65)

In order to ensure adequate protection and in particular the enforcement of individual rights, the data subject should be provided with effective administrative and judicial redress.

(66)

The EU-U.S. DPF, through the Recourse, Enforcement and Liability Principle, requires organisations to provide recourse for individuals who are affected by non-compliance and thus the possibility for Union data subjects to lodge complaints regarding non-compliance by EU-U.S. DPF organisations and to have these complaints resolved, if necessary by a decision providing an effective remedy (108). As part of their certification, organisations must satisfy the requirements of this Principle by providing for effective and readily available independent recourse mechanisms by which each individual’s complaints and disputes can be investigated and expeditiously resolved at no cost to the individual (109).

(67)

Organisations may choose independent recourse mechanisms in either the Union or in the United States. As explained in more detail in recital 73, this includes the possibility to voluntarily commit to cooperate with the EU DPAs. Where organisations process human resources data, such commitment to cooperate with EU DPAs is mandatory. Other alternatives include independent alternative dispute resolution or private-sector developed privacy programs that incorporate the Principles into their rules. The latter must include effective enforcement mechanisms in accordance with the requirements of the Recourse, Enforcement and Liability Principle.

(68)

Consequently, the EU-U.S. DPF provides data subjects with a number of possibilities to enforce their rights, lodge complaints regarding non-compliance by EU-U.S. organisations and to have their complaints resolved, if necessary by a decision providing an effective remedy. Individuals can bring a complaint directly to an organisation, to an independent dispute resolution body designated by the organisation, to national DPAs, the DoC or to the FTC. In cases where their complaints have not been resolved by any of these recourse or enforcement mechanisms, individuals also have a right to invoke binding arbitration (Annex I of Annex I to this Decision). Except for the arbitral panel, which requires certain remedies to be exhausted before it can be invoked, individuals are free to pursue any or all of the redress mechanisms of their choice, and are not obliged to choose one mechanism over the other or to follow a specific sequence.

(69)

Firstly, Union data subjects may pursue cases of non-compliance with the Principles through direct contacts with the EU-U.S. DPF organisations (110). To facilitate resolution, the organisation must put in place an effective redress mechanism to deal with such complaints. An organisation’s privacy policy must therefore clearly inform individuals about a contact point, either within or outside the organisation, that will handle complaints (including any relevant establishment in the Union that can respond to inquiries or complaints), as well as on the designated independent dispute resolution body (see recital 70). Upon receipt of an individual’s complaint, directly from the individual or through the DoC following referral by a DPA, the organisation must provide a response to the Union data subject within a period of 45 days (111). Likewise, organisations are required to respond promptly to inquiries and other requests for information from the DoC or from a DPA (112) (where the organisation has committed to cooperate with the DPA) relating to their adherence to the Principles.

(70)

Secondly, individuals can also bring a complaint directly to the independent dispute resolution body (either in the United States or in the Union) designated by an organisation to investigate and resolve individual complaints (unless they are obviously unfounded or frivolous) and to provide appropriate recourse free of charge to the individual (113). Sanctions and remedies imposed by such a body must be sufficiently rigorous to ensure compliance by organisations with the Principles and should provide for a reversal or correction by the organisation of the effects of non-compliance and, depending on the circumstances, the termination of the further processing of the personal data at stake and/or their deletion, as well as publicity for findings of non-compliance (114). Independent dispute resolution bodies designated by an organisation are required to include on their public websites relevant information regarding the EU-U.S. DPF and the services they provide under it (115). Each year, they must publish an annual report providing aggregate statistics regarding these services (116).

(71)

As part of its compliance review procedures, the DoC may verify that EU-U.S. DPF organisations are actually registered with the independent recourse mechanisms they claim they are registered with (117). Both the organisations and the responsible independent recourse mechanisms are required to respond promptly to inquiries and requests by the DoC for information relating to the EU-U.S. DPF. The DoC will work with independent recourse mechanisms to verify that they include information on their websites regarding the Principles and the services they provide under the EU-U.S. DPF and that they publish annual reports (118).

(72)

In cases where the organisation fails to comply with the ruling of a dispute resolution or self-regulatory body, the latter must notify such non-compliance to the DoC and the FTC (or another U.S. authority with jurisdiction to investigate non-compliance by the organisation), or a competent court (119). If an organisation refuses to comply with a final determination by any privacy self-regulatory, independent dispute resolution or government body, or where such a body determines that an organisation frequently fails to comply with the Principles, this may be considered as a persistent failure to comply with the result that the DoC, after first providing 30 days’ notice and an opportunity to respond to the organisation that has failed to comply, will strike the organisation off the DPF List (120). If, after removal from the list, the organisation continues to make the claim of EU-U.S. DPF certification, the DoC will refer it to the FTC or other enforcement agency (121).

(73)

Thirdly, individuals may also bring their complaints to a national DPA in the Union, which may make use of their investigatory and remedial powers under Regulation (EU) 2016/679. Organisations are obliged to cooperate in the investigation and the resolution of a complaint by a DPA either when it concerns the processing of human resources data collected in the context of an employment relationship or when the respective organisation has voluntarily submitted to the oversight by DPAs (122). Notably, organisations have to respond to inquiries, comply with the advice given by the DPA, including for remedial or compensatory measures, and provide the DPA with written confirmation that such action has been taken (123). In cases of non-compliance with the advice given by the DPA, the DPA will refer such cases to the DoC (which may remove organisations from the EU-U.S. DPF list) or, for possible enforcement action, to the FTC or the DoT (failure to cooperate with the DPAs or to comply with the Principles is actionable under U.S. law) (124).

(74)

To facilitate cooperation for an effective handling of complaints, both the DoC and the FTC have put in place a dedicated point of contact that is responsible for liaising directly with DPAs (125). Those points of contact assist with DPA enquiries regarding an organisation’s compliance with the Principles.

(75)

The advice provided by the DPAs (126) is issued after both sides in the dispute have had a reasonable opportunity to comment and to provide any evidence they wish. The panel may deliver advice as quickly as the requirement for due process allows, and as a general rule within 60 days after receiving a complaint (127). If an organisation fails to comply within 25 days of delivery of the advice and has offered no satisfactory explanation for the delay, the panel may give notice of its intention either to submit the matter to the FTC (or other competent U.S. enforcement authority), or to conclude that the commitment to cooperate has been seriously breached. In the first alternative, this may lead to enforcement action based on Section 5 of the FTC Act (or similar statute) (128). In the second alternative, the panel will inform the DoC which will consider the organisation’s refusal to comply with the advice of the DPA panel as a persistent failure to comply that will lead to the organisation’s removal from the DPF List.

(76)

If the DPA to which the complaint has been addressed has taken no or insufficient action to address a complaint, the individual complainant has the possibility to challenge such (in-)action in the national courts of the respective EU Member State.

(77)

Individuals may also bring complaints to DPAs even when the DPA panel has not been designated as an organisation’s dispute resolution body. In these cases, the DPA may refer such complaints either to the DoC or the FTC. In order to facilitate and increase cooperation on matters relating to individual complaints and non-compliance by EU-U.S. DPF organisations, the DoC will establish a dedicated contact point to act as a liaison and to assist with DPA inquiries regarding an organisation's compliance with the Principles (129). Likewise, the FTC has committed to establish a dedicated point of contact (130).

(78)

Fourthly, the DoC has committed to receive, review and undertake best efforts to resolve complaints about an organisation’s non-compliance with the Principles (131). To this end, the DoC provides special procedures for DPAs to refer complaints to a dedicated contact point, track them and follow up with organisations to facilitate resolution (132). In order to expedite the processing of individual complaints, the contact point liaises directly with the respective DPA on compliance issues and in particular updates it on the status of complaints within a period of not more than 90 days following referral (133). This allows data subjects to bring complaints of non-compliance by EU-U.S. DPF organisations directly to their national DPA and have them channelled to the DoC as the U.S. authority administering the EU-U.S. DPF.

(79)

Where, on the basis of its ex officio verifications, complaints or any other information, the DoC concludes that an organisation has persistently failed to comply with the Principles it may remove such an organisation from the DPF list (134). Refusal to comply with a final determination by any privacy self-regulatory, independent dispute resolution or government body, including a DPA, will be regarded as a persistent failure to comply (135).

(80)

Fifthly, an EU-U.S. DPF organisation must be subject to the jurisdiction of U.S. authorities, in particular the FTC (136), which have the necessary investigatory and enforcement powers to effectively ensure compliance with the Principles. The FTC gives priority consideration to referrals of non-compliance with the Principles received from independent dispute resolution or self-regulatory bodies, the DoC and DPAs (acting on their own initiative or upon complaints) to determine whether Section 5 of the FTC Act has been violated (137). The FTC has committed to create a standardised referral process, to designate a point of contact at the agency for DPA referrals, and to exchange information on referrals. In addition, it may accept complaints directly from individuals and undertake EU-U.S. DPF investigations on its own initiative, in particular as part of its wider investigation of privacy issues.

(81)

Sixthly, as a recourse mechanism of ‘last resort’ in case none of the other available redress avenues has satisfactorily resolved an individual's complaint, the Union data subject may invoke binding arbitration by the ‘EU-U.S. Data Privacy Framework Panel’ (EU-U.S. DPF Panel) (138). Organisations must inform individuals about their possibility to invoke binding arbitration and they are obliged to respond once an individual has invoked this option by delivering notice to the concerned organisation (139).

(82)

This EU-U.S. DPF Panel consists of a pool of at least ten arbitrators that will be designated by the DoC and the Commission based on their independence, integrity, as well as experience in U.S. privacy and Union data protection law. For each individual dispute, the parties select from this pool a panel of one or three (140) arbitrators.

(83)

The International Centre for Dispute Resolution (ICDR), the international division of the American Arbitration Association (AAA), was selected by the DoC to administer arbitrations. Proceedings before the EU-U.S. DPF Panel will be governed by a set of agreed arbitration rules and a code of conduct for appointed arbitrators. The ICDR-AAA website provides clear and concise information to individuals about the arbitration mechanism and the procedure to file for arbitration.

(84)

The arbitration rules agreed between the DoC and the Commission supplement the EU-U.S. DPF which contains several features which enhance the accessibility of this mechanism for Union data subjects: (i) in preparing a claim before the panel, the data subject may be assisted by his or her national DPA; (ii) while the arbitration will take place in the United States, Union data subjects may choose to participate through video or telephone conference, to be provided at no cost to the individual; (iii) while the language used in the arbitration will as a rule be English, interpretation at the arbitral hearing and translation will in principle be provided upon a reasoned request and at no cost to the data subject; (iv) finally, while each party has to bear its own attorney’s fees, if represented by an attorney before the panel, the DoC will maintain a fund supplied with annual contributions by the EU-U.S. DPF organisations, which are to cover the costs of the arbitration procedure up to maximum amounts to be determined by the U.S. authorities in consultation with the Commission (141).

(85)

The EU-U.S. DPF Panel has the authority to impose individual-specific, non-monetary equitable relief (142) necessary to remedy non-compliance with the Principles. While the panel takes into account other remedies already obtained by other EU-U.S. DPF mechanisms when making its determination, individuals may still resort to arbitration if they consider these other remedies to be insufficient. This allows Union data subjects to invoke arbitration in all cases where the action or inaction of EU-U.S. DPF organisations, independent recourse mechanisms or the competent U.S. authorities (for instance the FTC) has not satisfactorily resolved their complaints. Arbitration may not be invoked if a DPA has the legal authority to resolve the claim at issue with respect to the EU-U.S. DPF organisation, namely in those cases where the organisation is either obliged to cooperate and comply with the advice of the DPAs as regards the processing of human resources data collected in the employment context, or has voluntarily committed to do so. Individuals can enforce the arbitration decision in the U.S. courts under the Federal Arbitration Act, thereby ensuring a legal remedy in case an organisation fails to comply.

(86)

Seventh, where an organisation does not comply with its commitment to respect the Principles and published privacy policy, additional avenues for judicial redress are available under U.S. law, including to obtain compensation for damages. For example, individuals can under certain conditions obtain judicial redress (including compensation for damages) under State consumer laws in cases of fraudulent misrepresentation, unfair or deceptive acts or practices (143), and under tort law (in particular under the torts of intrusion upon seclusion (144), appropriation of name or likeness (145) and public disclosure of private facts (146)).

(87)

Together, the various redress avenues described above ensure that each complaint regarding non-compliance with the EU-U.S DPF by certified organisations will be effectively adjudicated and remedied.

(88)

The Commission also assessed the limitations and safeguards, including the oversight and individual redress mechanisms available in United States law as regards the collection and subsequent use by U.S. public authorities of personal data transferred to controllers and processors in the U.S. in the public interest, in particular for criminal law enforcement and national security purposes (government access) (147). In assessing whether the conditions under which government access to data transferred to the United States under this Decision fulfil the ‘essential equivalence’ test pursuant to Article 45(1) of Regulation (EU) 2016/679, as interpreted by the Court of Justice in light of the Charter of Fundamental Rights, the Commission took into account several criteria.

(89)

In particular, any limitation to the right to the protection of personal data must be provided for by law and the legal basis which permits the interference with such a right must itself define the scope of the limitation to the exercise of the right concerned (148). In addition, in order to satisfy the requirement of proportionality, according to which derogations from and limitations to the protection of personal data must apply only in so far as is strictly necessary in a democratic society to meet specific objectives of general interest equivalent to those recognized by the Union, this legal basis must lay down clear and precise rules governing the scope and application of the measures in question and impose minimum safeguards so that the persons whose data has been transferred have sufficient guarantees to protect effectively their personal data against the risk of abuse (149). Moreover, these rules and safeguards must be legally binding and enforceable by individuals (150). In particular, data subjects must have the possibility of bringing legal action before an independent and impartial tribunal in order to have access to their personal data, or to obtain the rectification or erasure of such data (151).

(90)

As regards interference with personal data transferred under the EU-U.S. DPF for criminal law enforcement purposes, the law of the United States imposes a number of limitations on the access and use of personal data, and provides oversight and redress mechanisms which are in line with the requirements referred to in recital 89 of this Decision. The conditions under which such access can take place and the safeguards applicable to the use of those powers are assessed in detail in the following sections. In this respect, the U.S. government (through the Department of Justice, DoJ) has also provided assurances on the applicable limitations and safeguards (Annex VI to this Decision).

(91)

Personal data processed by certified U.S. organisations that would be transferred from the Union on the basis of the EU-U.S. DPF may be accessed for criminal law enforcement purposes by U.S. federal prosecutors and federal investigative agents under different procedures, as explained in more detail in recitals 92-99. These procedures apply in the same way when information is obtained from any U.S. organisation, regardless of the nationality or place of residence of the concerned data subjects (152).

(92)

Firstly, upon request of a federal law enforcement officer or an attorney for the government, a judge may issue a warrant for a search or seizure (including of electronically stored information) (153). Such a warrant may only be issued if there is ‘probable cause (154)’ that ‘seizable items’ (evidence of a crime, illegally possessed items, or property designed or intended for use or used in committing a crime) are likely to be found in the place specified by the warrant. The warrant must identify the property or item to be seized and designate the judge to which the warrant must be returned. A person subject to a search or whose property is subject to a search may move to suppress evidence obtained or derived from an unlawful search if that evidence is introduced against that person during a criminal trial (155). When a data holder (e.g. a company) is required to disclose data pursuant to a warrant, it may notably challenge the requirement to disclose as unduly burdensome (156).

(93)

Secondly, a subpoena may be issued by a grand jury (an investigative arm of the court impanelled by a judge or magistrate) in the context of investigations of certain serious crimes (157), usually at the request of a federal prosecutor, to require someone to produce or make available business records, electronically stored information, or other tangible items. In addition, different statutes authorise the use of administrative subpoenas to produce or make available business records, electronically stored information, or other tangible items in investigations involving health care fraud, child abuse, Secret Service protection, controlled substance cases, and Inspector General investigations (158). In both cases, the information must be relevant to the investigation and the subpoena cannot be unreasonable, i.e. overbroad, oppressive or burdensome (and can be challenged by the recipient of the subpoena on those grounds) (159).

(94)

Very similar conditions apply to administrative subpoenas issued to seek access to data held by companies in the US for civil or regulatory (“public interest”) purposes. The authority of agencies with civil and regulatory responsibilities to issue such administrative subpoenas must be established in statute. The use of an administrative subpoena is subject to a “reasonableness test”, which requires that the investigation is conducted pursuant to a legitimate purpose, the information requested under the subpoena is relevant to that purpose, the agency does not already have the information it is seeking with the subpoena, and the necessary administrative steps to issue the subpoena have been followed (160). Case law of the Supreme Court has also clarified the need to balance the importance of the public interest in the information being requested with the importance of personal and organisational privacy interests (161). While the use of an administrative subpoena is not subject to prior judicial approval, it becomes subject to judicial review in case of a challenge by the recipient on the above-mentioned grounds, or if the issuing agency seeks to enforce the subpoena in court (162). In addition to these general overarching limitations, specific (stricter) requirements may follow from individual statutes (163).

(95)

Thirdly, several legal bases enable criminal law enforcement authorities to obtain access to communications data. A court may issue an order authorising the collection of real-time, non-content dialling, routing, addressing and signalling information about a phone number or e-mail (through the use of a pen register or trap and trace device), if it finds that the authority has certified that the information likely to be obtained is relevant to a pending criminal investigation (164). The order must, inter alia, specify the identity, if known, of the suspect; the attributes of the communications to which it applies and a statement of the offense to which the information to be collected relates. The use of a pen register or trap and trace device may be authorised for a maximum period of sixty days, which may only be extended by a new court order.

(96)

In addition, access for criminal law enforcement purposes to subscriber information, traffic data and stored content of communications held by internet service providers, telephone companies, and other third party service providers may be obtained on the basis of the Stored Communications Act (165). To obtain the stored content of electronic communications, criminal law enforcement authorities must in principle obtain a warrant from a judge based on probable cause to believe that the account in question contains evidence of a crime (166). For subscriber registration information, IP addresses and associated time stamps, and billing information, criminal law enforcement authorities may use a subpoena. For most other stored, non-content information, such as e-mail headers without the subject line, a criminal law enforcement authority must obtain a court order, which will be issued if the judge is satisfied that there are reasonable grounds to believe that the requested information is relevant and material to an ongoing criminal investigation.

(97)

Providers that receive requests under the Stored Communications Act may voluntarily notify a customer or subscriber whose information is sought, except when the relevant criminal law enforcement authority obtains a protective order prohibiting such notification (167). Such a protective order is a court order requiring a provider of electronic communications services or remote computing services to whom a warrant, subpoena or court order is directed, not to notify any other person of the existence of the warrant, subpoena or court order, for as long as the court deems appropriate. Protective orders are granted if a court finds that there is reason to believe that notification would seriously jeopardise an investigation or unduly delay a trial, e.g. because it would result in endangering the life or physical safety of an individual, flight from prosecution, intimidation of potential witnesses, etc. A Deputy Attorney General memorandum (which is binding on all DoJ attorneys and agents) requires prosecutors to make a detailed determination regarding the need for a protective order and provide a justification to the court on how the statutory criteria for obtaining a protective order are met in the specific case (168). The memorandum also requires that applications for protective orders must generally not seek to delay notification for more than one year. Where, in exceptional circumstances, orders of longer duration might be necessary, such orders may only be sought with the written agreement of a supervisor designated by the U.S. Attorney or the appropriate Assistant Attorney General. In addition, a prosecutor must, when closing an investigation, immediately assess whether there is a basis to maintain any outstanding protective orders and, where this is not the case, terminate the protective order and ensure the service provider is notified thereof (169).

(98)

Criminal law enforcement authorities may also intercept in real time wire, oral or electronic communications on the basis of a court order in which a judge finds, inter alia, that there is probable cause to believe that the wiretap or electronic interception will produce evidence of a federal crime, or the whereabouts of a fugitive fleeing from prosecution (170).

(99)

Further protections are provided by various Department of Justice policies and guidelines, including the Attorney General Guidelines for Domestic FBI Operations (AGG-DOM), which, inter alia require that the Federal Bureau of Investigation (FBI) uses the least intrusive investigative methods feasible, taking into account the effect on privacy and civil liberties (171).

(100)

According to the representations made by the U.S. government, the same or higher protections described above apply to law enforcement investigations at State level (with respect to investigations carried out under State laws) (172). In particular, constitutional provisions, as well as statutes and case-law at State level reaffirm the above mentioned protections against unreasonable searches and seizures by requiring the issuance of a search warrant (173). Similar to the protections afforded at the federal level, search warrants may be issued only upon a showing of probable cause and must describe the place to be searched and the person or thing to be seized (174).

(101)

As regards the further use of data collected by federal criminal law enforcement authorities, different statutes, guidelines and standards impose specific safeguards. With the exception of the specific instruments applicable to the activities of the FBI (AGG-DOM and FBI Domestic Investigations and Operations Guide), the requirements described in this section generally apply to the further use of data by any federal authority, including to data accessed for civil or regulatory purposes. This includes the requirements following from the Office of Management and Budget memos/regulations, the Federal Information Security Management Modernization Act, the E-Government Act and the Federal Records Act.

(102)

In accordance with authority provided by the Clinger-Cohen Act (P.L. 104-106, Division E) and the Computer Security Act of 1987 (P.L. 100-235), the Office of Management and Budget (OMB) issued Circular No. A-130 to establish general binding guidance that applies to all federal agencies (including law enforcement authorities) when they handle personally identifiable information (175). In particular, the circular requires all federal agencies to “limit the creation, collection, use, processing, storage, maintenance, dissemination, and disclosure of personally identifiable information to that which is legally authorized, relevant, and reasonably deemed necessary for the proper performance of authorised agency functions” (176). In addition, to the extent reasonably practicable, federal agencies must ensure that personally identifiable information is accurate, relevant, timely and complete, and reduced to the minimum necessary for the proper performance of an agency’s functions. More generally, federal agencies must establish a comprehensive privacy program to ensure compliance with applicable privacy requirements, develop and evaluate privacy policies and manage privacy risks; maintain procedures to detect, document and report privacy compliance incidents; develop privacy awareness and training programmes for employees and contractors; and put in place policies and procedures to ensure that personnel is held accountable for complying with privacy requirements and policies (177).

(103)

In addition, the E-Government Act (178) requires all federal agencies (including criminal law enforcement authorities) to put in place information security protections that are commensurate with the risk and magnitude of the harm that would result from unauthorized access, use, disclosure, disruption, modification, or destruction; have a Chief Information Officer to ensure compliance with information security requirements and perform an annual independent evaluation (e.g. by an Inspector General, see recital 109) of their information security program and practices (179). Similarly, the Federal Records Act (FRA) (180) and supplemental regulations (181) require information held by federal agencies to be subject to safeguards ensuring the physical integrity of the information and protecting it against unauthorized access.

(104)

Pursuant to federal statutory authority, including the Federal Information Security Modernisation Act of 2014, the OMB and the National Institute of Standards and Technology (NIST) have developed standards which are binding on federal agencies (including criminal law enforcement authorities) and that further specify the minimum information security requirements that have to be put in place, including access controls, ensuring awareness and training, contingency planning, incident response, auditing and accountability tools, ensuring system and information integrity, conducting privacy and security risk assessments etc. (182). Moreover, all federal agencies (including criminal law enforcement authorities) must, in accordance with guidelines of the OMB, maintain and implement a plan for handling data breaches, including when it comes to responding to such breaches and assessing the risks of harm (183).

(105)

As regards data retention, the FRA (184) requires U.S. federal agencies (including criminal law enforcement authorities) to establish retention periods for their records (after which such records must be disposed), which must be approved by the National Archives and Record Administration (185). The length of these retention period is fixed in light of different factors, such as the type of investigation, whether the evidence is still relevant to the investigation, etc. With respect to the FBI, AGG-DOM provides that the FBI must have in place such a records retention plan and maintain a system that can promptly retrieve the status of and basis for investigations.

(106)

Finally, OMB Circular No. A-130 also contains certain requirements for disseminating personally identifiable information. In principle, the dissemination and disclosure of personally identifiable information must be limited to what is legally authorised, relevant and reasonably deemed necessary for the proper performance of an agency’s functions (186). When sharing personally identifiable information with other government entities, U.S. federal agencies must impose, where relevant, conditions (including the implementation of specific security and privacy controls) that govern the processing of the information through written agreements (including contracts, data use agreements, information exchange agreements and memoranda of understanding) (187). As regards the grounds on which information may be disseminated, the AGG-DOM and FBI Domestic Investigations and Operations Guide (188) for instance provide that the FBI may be under a legal requirement to do so (e.g. under an international agreement) or is allowed to disseminate information in certain circumstances, e.g. to other U.S. agencies if disclosure is compatible with the purpose for which the information was collected and it is related to their responsibilities; to congressional committees; to foreign agencies if the information is related to their responsibilities and the dissemination is consistent with the interests of the United States; the dissemination is notably necessary to protect the safety or security of persons or property, or to protect against or prevent a crime or threat to the national security and the disclosure is compatible with the purpose for which the information was collected (189).

(107)

The activities of federal criminal law enforcement agencies are subject to oversight by various bodies (190). As explained in recitals 92-99, in most cases this includes prior oversight by the judiciary, which has to authorise individual collection measures before they can be used. In addition, other bodies oversee different stages of the activities of criminal law enforcement authorities, including the collection and processing of personal data. Together, these judicial and non-judicial bodies ensure that law enforcement authorities are subject to independent oversight.

(108)

Firstly, Privacy and Civil Liberties Officers exist within various departments with criminal law enforcement responsibilities (191). While the specific powers of these officers may vary somewhat depending on the authorising statute, they typically encompass the supervision of procedures to ensure that the respective department/agency is adequately considering privacy and civil liberties concerns and has put in place adequate procedures to address complaints from individuals who consider that their privacy or civil liberties have been violated. The heads of each department or agency must ensure that Privacy and Civil Liberties Officers have the material and resources to fulfil their mandate, are given access to any material and personnel necessary to carry out their functions, and are informed about and are consulted on proposed policy changes (192). Privacy and Civil Liberties Officers periodically report to Congress, including on the number and nature of the complaints received by the department/agency and a summary of the disposition of such complaints, the reviews and inquiries conducted and the impact of the activities carried out by the Officer (193).

(109)

Secondly, an independent Inspector General oversees the activities of the Department of Justice, including the FBI (194). Inspectors General are statutorily independent (195) and responsible for conducting independent investigations, audits, and inspections of the Department’s programs and operations. They have access to all records, reports, audits, reviews, documents, papers, recommendations or other relevant material, if need be by subpoena, and may take testimony (196). While Inspectors General issue non-binding recommendations for corrective action, their reports, including on follow-up action (or the lack thereof) (197) are generally made public and sent to Congress, which can on this basis exercise its oversight function (see recital 111) (198).

(110)

Thirdly, to the extent they carry out counter-terrorism activities, departments with criminal law enforcement responsibilities are subject to oversight by the Privacy and Civil Liberties Oversight Board (PCLOB), an independent agency within the executive branch composed of a bipartisan, five-member Board appointed by the President for a fixed six-year term with Senate approval (199). According to its founding statute, the PCLOB is entrusted with responsibilities in the field of counterterrorism policies and their implementation, with a view to protect privacy and civil liberties. In its review it can access all relevant agency records, reports, audits, reviews, documents, papers and recommendations, including classified information, conduct interviews and hear testimony (200). It receives reports from the civil liberties and privacy officers of several federal departments/agencies (201), may issue recommendations to the government andlaw enforcement authorities, and regularly reports to Congressional committees and the President (202). Reports of the Board, including the ones to Congress, must be made publicly available to the greatest extent possible (203).

(111)

Finally, criminal law enforcement activities are subject to oversight by specific Committees in the U.S. Congress (the House and Senate Judiciary Committees). The Judiciary Committees conduct regular oversight in different ways, in particular through hearings, investigations, reviews and reports (204).

(112)

As indicated, criminal law enforcement authorities must in most cases obtain prior judicial authorisation to collect personal data. Although this is not required for administrative subpoenas, these are limited to specific situations and will be subject to independent judicial review at least where the government seeks enforcement in court. In particular, recipients of administrative subpoenas may challenge them in court on the grounds that they are unreasonable, i.e. overbroad, oppressive or burdensome (205).

(113)

Individuals may first of all lodge requests or complaints with criminal law enforcement authorities concerning the handling of their personal data. This includes the possibility to request access to and correction of personal data (206). As regards activities relating to counter-terrorism, individuals may also lodge a complaint with Privacy and Civil Liberties Officers (or other privacy officials) within law enforcement authorities (207).

(114)

Moreover, U.S. law provides for a number of judicial redress avenues for individuals, against a public authority or one of its officials, where these authorities process personal data (208). These avenues, which include in particular the APA, the Freedom of Information Act (FOIA) and the Electronic Communications Privacy Act (ECPA), are open to all individuals irrespective of their nationality, subject to any applicable conditions.

(115)

Generally, under the judicial review provisions of the APA (209), “any person suffering legal wrong because of agency action, or adversely affected or aggrieved by agency action”, is entitled to seek judicial review (210). This includes the possibility to ask the court to “hold unlawful and set aside agency action, findings, and conclusions found to be […] arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law” (211).

(116)

More specifically, Title II of the ECPA (212) sets forth a system of statutory privacy rights and as such governs law enforcement access to the contents of wire, oral or electronic communications stored by third-party service providers (213). It criminalises the unlawful (i.e. not authorised by court or otherwise permissible) access to such communications and provides recourse for an affected individual to file a civil action in U.S. federal court for actual and punitive damages as well as equitable or declaratory relief against a government official that has wilfully committed such unlawful acts, or against the United States.

(117)

In addition, several other statutes afford individuals the right to bring suit against a U.S. public authority or official with respect to the processing of their personal data, such as the Wiretap Act (214), the Computer Fraud and Abuse Act (215), the Federal Torts Claim Act (216), the Right to Financial Privacy Act (217), and the Fair Credit Reporting Act (218).

(118)

Also, under FOIA (219), 5 U.S.C. § 552 any person has the right to obtain access to federal agency records, including where these contain the individual's personal data. After exhausting administrative remedies, an individual may invoke such right to access in court unless those records are protected from public disclosure by an exemption or special law enforcement exclusion (220). In this case, the court will assess whether any exemption applies or has been lawfully invoked by the relevant public authority.

(119)

The law of the United States contains various limitations and safeguards with respect to the access and use of personal data for national security purposes, and provides oversight and redress mechanisms that are in line with the requirements referred to in recital 89 of this Decision. The conditions under which such access can take place and the safeguards applicable to the use of these powers are assessed in detail in the following sections.

(120)

Personal data transferred from the Union to EU-U.S. DPF organisations may be collected by U.S. authorities for national security purposes on the basis of different legal instruments, subject to specific conditions and safeguards.

(121)

Once personal data has been received by organisations located in the United States, U.S. intelligence agencies may seek access to such data for national security purposes only as authorised by statute, specifically under the Foreign Intelligence Surveillance Act (FISA) or and statutory provisions authorising access through National Security Letters (NSL) (221). FISA contains several legal bases that may be used to collect (and subsequently process) the personal data of Union data subjects transferred under the EU-U.S. DPF (Section 105 FISA (222), Section 302 FISA (223), Section 402 FISA (224), Section 501 FISA (225) and Section 702 FISA (226)), as described in more detail in recitals 142-152.

(122)

U.S. intelligence agencies also have possibilities to collect personal data outside the United States, which may include personal data in transit between the Union and the United States. The collection outside the United States is based on Executive Order 12333 (EO 12333) (227), issued by the President (228).

(123)

The collection of signals intelligence is the form of intelligence collection that is the most relevant for the present adequacy finding, as it concerns the collection of electronic communications and data from information systems. Such collection may be carried out by U.S. intelligence agencies both within the United States (on the basis of FISA) and while data is in transit to the United States (on the basis of EO 12333).

(124)

On 7 October 2022, the U.S. President issued EO 14086 on Enhancing Safeguards for United States Signals Intelligence setting limitations and safeguards for all U.S. signals intelligence activities. This EO replaces Presidential Policy Directive (PPD-28) to a large extent (229), strengthens the conditions, limitations and safeguards that apply to all signals intelligence activities (i.e. on the basis of FISA and EO 12333), regardless of where they take place (230), and establishes a new redress mechanism through which these safeguards can be invoked and enforced by individuals (231) (see in more detail recitals 176-194). In doing so, it implements in U.S. law the outcome of the talks that took place between the EU and U.S. following the invalidation of the Commission’s adequacy decision on the Privacy Shield by the Court of Justice (see recital 6). It is, therefore, a particularly important element of the legal framework assessed in this Decision.

(125)

The limitations and safeguards introduced by EO 14086 supplement those provided by Section 702 FISA and EO 12333. The requirements described below (in sections 3.2.1.2 and 3.2.1.3) must be applied by intelligence agencies when engaging in signals intelligence activities pursuant to Section 702 FISA and EO 12333, e.g. when selecting/identifying categories of foreign intelligence information to be acquired pursuant to Section 702 FISA; collecting foreign intelligence or counterintelligence pursuant to EO 12333; and making individual targeting decisions under Section 702 FISA and EO 12333.

(126)

The requirements laid down in this Executive Order issued by the President are binding on the entire Intelligence Community. They must be further implemented through agency policies and procedures that transpose them into concrete directions for day-to-day operations. In this respect, EO 14086 provides U.S. intelligence agencies with a maximum of one year to update their existing policies and procedures (i.e. by 7 October 2023) to bring them in line with the EO’s requirements. Such updated policies and procedures have to be developed in consultation with the Attorney General, the Civil Liberties Protection Officer of the Director of National Intelligence (ODNI CLPO) and the PCLOB – an independent oversight body authorised to review Executive Branch policies and their implementation, with a view to protect privacy and civil liberties (see recital 110 as regards the role and status of the PCLOB) – and be made publicly available (232). In addition, once the updated policies and procedures are in place, the PCLOB will conduct a review to ensure that they are consistent with the EO. Within 180 days of completion of such a review by the PCLOB, each intelligence agency must carefully consider and implement or otherwise address all of the PCLOB’s recommendations. On 3 July 2023, the U.S. government published such updated policies and procedures (233).

(127)

EO 14086 sets a number of overreaching requirements that apply to all signals intelligence activities (collection, use, dissemination, etc. of personal data).

(128)

Firstly, such activities must be based on statute or Presidential authorisation and undertaken in compliance with U.S. law, including the Constitution (234).

(129)

Secondly, appropriate safeguards must be in place to ensure that privacy and civil liberties are integral considerations in the planning of such activities (235).

(130)

In particular, any signals intelligence activity may only be carried out “following a determination, based on a reasonable assessment of all relevant factors, that the activities are necessary to advance a validated intelligence priority” (as regards the notion of ‘validated intelligence priority’, see recital 135) (236).

(131)

Moreover, such activities may only be conducted “to the extent and in a manner that is proportionate to the validated intelligence priority for which they have been authorized” (237). In other words, a proper balance must be achieved “between the importance of the intelligence priority pursued and the impact on the privacy and civil liberties of affected individuals, regardless of their nationality or wherever they might reside” (238).

(132)

Finally, to ensure compliance with these general requirements - which reflect the principles of legality, necessity and proportionality - signals intelligence activities are subject to oversight (see in more detail section 3.2.2) (239).

(133)

These overarching requirements are further substantiated with respect to the collection of signals intelligence through a number of conditions and limitations ensuring that the interference with the rights of individuals is limited to what is necessary and proportionate to advance a legitimate objective.

(134)

Firstly, the EO limits the grounds on which data can be collected as part of signals intelligence activities in two ways. On the one hand, the EO lays down the legitimate objectives that may be pursued by signals intelligence collection, e.g. to understand or assess the capabilities, intentions, or activities of foreign organisations, including international terrorist organisations, that pose a current or potential threat to the national security of the United States; to protect against foreign military capabilities and activities; to understand or assess transnational threats that impact global security, such as climate and other ecological change, public health risks and humanitarian threats (240). On the other hand, the EO lists certain objectives that must never be pursued by signals intelligence activities, e.g. for the purpose of burdening criticism, dissent, or the free expression of ideas or political opinions by individuals or the press; for the purpose of disadvantaging persons based on their ethnicity, race, gender, gender identity, sexual orientation, or religion; or to afford a competitive advantage to U.S. companies (241).

(135)

Moreover, the legitimate objectives laid down in EO 14086 cannot by themselves be relied upon by intelligence agencies to justify signals intelligence collection but must be further substantiated, for operational purposes, into more concrete priorities for which signals intelligence may be collected. In other words, actual collection can only take place to advance a more specific priority. Such priorities are established through a dedicated process aimed at ensuring compliance with the applicable legal requirements, including those relating to privacy and civil liberties. More specifically, intelligence priorities are first developed by the Director of National Intelligence (through the so-called National Intelligence Priorities Framework) and submitted to the President for approval (242). Before proposing intelligence priorities to the President, the Director must, in accordance with EO 14086, obtain an assessment from the ODNI CLPO for each priority as to whether it (1) advances one or more legitimate objectives listed in the EO; (2) was neither designed nor is anticipated to result in signals intelligence collection for a prohibited objective listed in the EO; and (3) was established after appropriate consideration for the privacy and civil liberties of all persons, regardless of their nationality or wherever they might reside (243). In case the Director disagrees with the CLPO’s assessment, both views must be presented to the President (244).

(136)

Therefore, this process notably ensures that privacy considerations are taken into account from the initial stage where intelligence priorities are developed.

(137)

Secondly, once an intelligence priority has been established, a number of requirements govern the decision as to whether and to what extent signals intelligence may be collected to advance such a priority. These requirements operationalise the overarching necessity and proportionality standards set forth by Section 2(a) of the EO.

(138)

In particular, signals intelligence may only be collected “following a determination that, based on a reasonable assessment of all relevant factors, the collection is necessary to advance a specific intelligence priority” (245). In determining whether a specific signals intelligence collection activity is necessary to advance a validated intelligence priority, U.S. intelligence agencies must consider the availability, feasibility and appropriateness of other less intrusive sources and methods, including from diplomatic and public sources (246). When available, such alternative, less intrusive sources and methods must be prioritised (247).

(139)

When, in the application of such criteria, the collection of signals intelligence is considered necessary, it must be as “tailored as feasible” and must “not disproportionately impact privacy and civil liberties” (248). To ensure that privacy and civil liberties are not disproportionately affected – i.e. to strike a proper balance between national security needs and the protection of privacy and civil liberties – all relevant factors have to be duly taken into account, such as the nature of the pursued objective; the intrusiveness of the collection activity, including its duration; the probable contribution of the collection to the objective pursued; the reasonably foreseeable consequences to individuals; and the nature and sensitivity of the data to be collected (249).

(140)

As regards the type of signals intelligence collection, collection of data within the United States, which is the most relevant for the present adequacy finding as it concerns data that has been transferred to organisations in the U.S., must always be targeted, as explained in more detail in recitals 142-153.

(141)

‘Bulk collection’ (250) may only be carried out outside the United States, on the basis of EO 12333. Also in this case, pursuant to EO 14086, targeted collection must be prioritised (251). Conversely, bulk collection is only allowed where the information necessary to advance a validated intelligence priority cannot reasonably be obtained by targeted collection (252). When it is necessary to carry out bulk collection of data outside the United States, specific safeguards under EO 14086 apply (253). Firstly, methods and technical measures must be applied in order to limit the data collected to only what is necessary to advance a validated intelligence priority, while minimizing the collection of non-pertinent information (254). Secondly, the EO limits the use of information collected in bulk (including querying) to six specific objectives, including protecting against terrorism, the taking of hostages, and the holding of individuals captive by or on behalf of a foreign government, organisation or person; protecting against foreign espionage, sabotage, or assassination; protecting against threats from the development possession, or proliferation of weapons of mass destruction or related technologies and threats, etc. (255) Finally, any querying of signals intelligence obtained in bulk may only take place where necessary to advance a validated intelligence priority, in pursuit of these six objectives and in accordance with policies and procedures that appropriately take into account the impact of the queries on the privacy and civil liberties of all persons, regardless of their nationality or wherever they might reside (256).

(142)

In addition to the requirements of EO 14086, the signals intelligence collection of data that has been transferred to an organisation in the United States is subject to specific limitations and safeguards governed by Section 702 FISA (257). Section 702 FISA allows the collection of foreign intelligence information through the targeting of non-U.S. persons reasonably believed to be located outside the United States with the compelled assistance of U.S. electronic communication service providers (258). In order to collect foreign intelligence information pursuant to Section 702 FISA, the Attorney General and the Director of National Intelligence submit annual certifications to the Foreign Intelligence Surveillance Court (FISC) which identify categories of foreign intelligence information to be acquired (259). Certifications must be accompanied by targeting, minimization and querying procedures, which are also approved by the Court and are legally binding on U.S. intelligence agencies.

(143)

The FISC is an independent tribunal (260) created by federal statute whose decisions can be appealed to the Foreign Intelligence Surveillance Court of Review (FISCR) (261) and, ultimately, the Supreme Court of the United States (262). The FISC (and FISCR) is supported by a standing panel of five attorneys and five technical experts that have an expertise in national security matters as well as civil liberties (263). From this group the court appoints an individual to serve as amicus curiae to assist in the consideration of any application for an order or review that, in the opinion of the court, presents a novel or significant interpretation of the law, unless the court finds that such appointment is not appropriate (264). This ensures in particular that privacy considerations are properly reflected in the court’s assessment. The court may also appoint an individual or organisation to serve as amicus curiae, including to provide technical expertise, whenever it deems this appropriate or, upon motion, permit an individual or organisation leave to file an amicus curiae brief (265).

(144)

The FISC reviews the certifications and the related procedures (in particular targeting and minimisation procedures) for compliance with the requirements of FISA. If it considers that the requirements are not fulfilled, it can deny the certification in full or in part and request the procedures to be amended (266). In this respect, the FISC has repeatedly confirmed that its review of Section 702 targeting and minimization procedures is not confined to the procedures as written, but also includes how the procedures are implemented by the government (267).

(145)

Individual targeting determinations are made by the National Security Agency (NSA, the intelligence agency responsible for targeting under Section 702 FISA) in accordance with FISC-approved targeting procedures, which require the NSA to assess, based on the totality of the circumstances, that targeting a specific person is likely to acquire a category of foreign intelligence information identified in a certification (268). This assessment must be particularized and fact-based, informed by analytical judgment, the specialized training and experience of the analyst, as well as the nature of the foreign intelligence information to be obtained (269). The targeting is carried out by identifying so-called selectors that identify specific communications facilities, like the target’s e-mail address or telephone number, but never key words or names of individuals (270).

(146)

NSA analysts will first identify non-U.S. persons located abroad whose surveillance will lead, based on the analysts’ assessment, to the relevant foreign intelligence specified in the certification (271). As set out in the NSA’s targeting procedures, the NSA can only direct surveillance at a target when it has already learned something about the target (272). This may follow from information from different sources, for instance human intelligence. Through these other sources, the analyst must also learn about a specific selector (i.e. communication account) used by the potential target. Once these individualised persons have been identified and their targeting has been approved by an extensive review mechanism within the NSA (273), selectors identifying communication facilities (such as e-mail addresses) used by the targets will be ‘tasked’ (i.e. developed and applied) (274).

(147)

The NSA must document the factual basis for the selection of the target (275) and, at regular intervals after the initial targeting, affirm that the targeting standard continues to be met (276). Once the targeting standard is no longer satisfied, collection must be ceased (277). The selection by the NSA of each target and its record of each recorded targeting assessment and rationale is reviewed for compliance with the targeting procedures on a bi-monthly basis by officials in the intelligence oversight offices at the Department of Justice, who are under an obligation to report any violation to the FISC and to Congress (278). The NSA’s written documentation facilitates the FISC’s oversight of whether specific individuals are properly targeted under Section 702 FISA, in accordance with its supervision powers described in recitals 173-174 (279). Finally, the Director of National Intelligence (DNI) is also required to report each year the total number of Section 702 FISA targets in public annual Statistical Transparency Reports. Companies that receive Section 702 FISA directives may publish aggregate data (via transparency reports) on the requests they receive (280).

(148)

As regards the other legal bases to collect personal data transferred to organisations in the U.S., different limitations and safeguards apply. In general, the collection of data in bulk is specifically prohibited under Section 402 FISA (pen register and trap and trace authority) and through the use of NSL, and the use of specific ‘selection terms’ is instead required (281).

(149)

To conduct traditional individualized electronic surveillance (pursuant to Section 105 FISA), intelligence agencies must submit an application to the FISC with a statement of the facts and circumstances relied upon to justify the belief that there is probable cause that the facility is used or about to be used by a foreign power or an agent of a foreign power (282) . The FISC will assess, among others, whether on the basis of the submitted facts there is probable cause that this is indeed the case (283).

(150)

To carry out a search of premises or property that is intended to result in an inspection, seizure, etc. of information, material, or property (e.g. a computer device) on the basis of Section 301 FISA, an application for an order by the FISC is required (284). Such application must, inter alia, show that there is probable cause that the target of the search is a foreign power or an agent of a foreign power; that the premise or property to be searched contains foreign intelligence information and that the premise to be searched is owned, used, possessed by, or is in transit to or from an (agent of a) foreign power (285).

(151)

Similarly, the installation of pen registers or trap and trace devices (pursuant to Section 402 FISA) requires an application for an order by the FISC (or a U.S. Magistrate Judge) and the use of a specific selection term, i.e. a term that specifically identifies a person, account, etc. and is used to limit, to the greatest extent reasonably possible, the scope of the information sought (286). This authority does not concern the contents of communications, but rather aims at information about the customer or subscriber using a service (such as name, address, subscriber number, length/type of service received, source/mechanism of payment).

(152)

Section 501 FISA (287), which allows the collection of business records of a common carrier (i.e. any person or entity transporting people or property by land, rail, water or air for compensation), public accommodation facility (e.g. a hotel, motel or inn), vehicle rental facility, or physical storage facility (i.e. which provides space for or services related to the storage of goods and materials) (288), also requires an application to the FISC or a Magistrate Judge. This application must specify the records sought and the specific and articulable facts giving reason to believe that the person to whom the records pertain is a foreign power or an agent of foreign power (289).

(153)

Finally, NSL are authorised by different statutes and allow investigating agencies to obtain certain information (not including the content of communications) from certain entities (e.g. financial institutions, credit reporting agencies, electronic communication providers) contained in credit reports, financial records and electronic subscriber and transactional records (290). The NSL statute that authorises access to electronic communications may be used only by the FBI and requires that requests use a term that specifically identifies a person, entity, telephone number, or account and certify that the information is relevant to an authorized national security investigation to protect against international terrorism or clandestine intelligence activities (291). Recipients of an NSL have the right to challenge it in court (292).

(154)

The processing of personal data collected by U.S. intelligence agencies through signals intelligence is subject to a number of safeguards.

(155)

Firstly, each intelligence agency must ensure appropriate data security and prevent access by unauthorised persons to personal data collected through signals intelligence. In this respect, different instruments, including statute, guidelines and standards further specify the minimum information security requirements that have to be put in place (e.g. multifactor authentication, encryption, etc.) (293). Access to collected data must be limited to authorised, trained personnel with a need to know the information to perform their mission (294). More generally, intelligence agencies must provide appropriate training to their employees, including on procedures for reporting and addressing violations of the law (including EO 14086) (295).

(156)

Secondly, intelligence agencies must comply with Intelligence Community standards for accuracy and objectivity, in particular with respect to ensuring data quality and reliability, the consideration of alternative sources of information and objectivity in performing analyses (296).

(157)

Thirdly, as regards data retention, EO 14086 clarifies that personal data of non-U.S. persons is subject to the same retention periods as the ones that apply to the data of U.S. persons (297). Intelligence agencies are required to define specific retention periods and/or the factors that must be taken into account to determine the length of applicable retention periods (e.g. whether the information is evidence of a crime; whether the information constitutes foreign intelligence information; whether the information is needed to protect the safety of persons or organisations, including victims or targets of international terrorism), which are laid down in different legal instruments (298).

(158)

Fourthly, specific rules apply as regards the dissemination of personal data collected through signals intelligence. As a general requirement, personal data on non-U.S. persons may only be disseminated if it involves the same type of information that can be disseminated about U.S. persons, e.g. information needed to protect the safety of a person or organisation (such as targets, victims or hostages of international terrorist organisations) (299). Moreover, personal data may not be disseminated solely because of a person’s nationality or country of residence or for the purpose of circumventing the requirements of EO 14086 (300). Dissemination within the U.S. government may only take place if an authorised and trained individual has a reasonable belief that the recipient has a need to know the information (301) and will protect it appropriately (302). To determine whether personal data can be disseminated to recipients outside the U.S. government (including a foreign government or international organisation), the purpose of the dissemination, the nature and extent of the data being disseminated, and the potential for harmful impact on the person(s) concerned must be taken into account (303).

(159)

Finally, including in order to facilitate oversight of compliance with the applicable legal requirements as well as effective redress, each intelligence agency is required under EO 14086 to keep appropriate documentation about the collection of signals intelligence. The documentation requirements cover elements such as the factual basis for the assessment that a specific collection activity is necessary to advance a validated intelligence priority (304).

(160)

In addition to the abovementioned safeguards of EO 14086 for the use of information collected through signals intelligence, all US intelligence agencies are subject to more general requirements on purpose limitation, data minimisation, accuracy, security, retention and dissemination, following in particular from OMB Circular No. A-130, the E-Government Act, the Federal Records Act (see recitals 101-106) and guidance from the Committee on National Security Systems (CNSS) (305).

(161)

The activities of U.S. intelligence agencies are subject to supervision by different bodies.

(162)

Firstly, EO 14086 requires each intelligence agency to have senior-level legal, oversight and compliance officials to ensure compliance with applicable U.S. law (306). In particular, they must conduct periodic oversight of signals intelligence activities and ensure that any non-compliance is remedied. Intelligence agencies must provide such officials with access to all relevant information to carry out their oversight functions and may not take any actions to impede or improperly influence their oversight activities (307). Moreover, any significant non-compliance incident (308) identified by an oversight official or any other employee must promptly be reported to the head of the intelligence agency and the Director of National Intelligence, who must ensure that any necessary actions are taken to remediate and prevent the recurrence of the significant incident of non-compliance (309).

(163)

This oversight function is fulfilled by officers with a designated compliance role, as well as Privacy and Civil Liberties Officers and Inspectors General (310).

(164)

As is the case with respect to criminal law enforcement authorities, Privacy and Civil Liberties Officers exist at all intelligence agencies (311). The powers of these officers typically encompass the supervision of procedures to ensure that the respective department/agency is adequately considering privacy and civil liberties concerns and has put in place adequate procedures to address complaints from individuals who consider that their privacy or civil liberties have been violated (and in some cases, like the Office of the Director of National Intelligence (ODNI), may themselves have the power to investigate complaints (312)). The heads of intelligence agencies must ensure that Privacy and Civil Liberties Officers have the resources to fulfil their mandate, are given access to any material and personnel necessary to carry out their functions, and are informed about and are consulted on proposed policy changes (313). Privacy and Civil Liberties Officers periodically report to Congress and the PCLOB, including on the number and nature of the complaints received by the department/agency with a summary of the disposition of such complaints, the reviews and inquiries conducted and the impact of the activities carried out by the Officer (314).

(165)

Secondly, each intelligence agency has an independent Inspector General with the responsibility, among others, to oversee foreign intelligence activities. This includes, within the ODNI, an Office of the Inspector General of the Intelligence Community with comprehensive jurisdiction over the entire Intelligence Community which is authorised to investigate complaints or information concerning allegations of unlawful conduct, or abuse of authority, in connection with ODNI and/or Intelligence Community programs and activities (315). As is the case for criminal law enforcement authorities (see recital 109), such Inspectors General are statutorily independent (316) and responsible for conducting audits and investigations relating to the programs and operations carried out by the respective agency for national intelligence purposes, including with respect to abuse or violation of the law (317). They have access to all records, reports, audits, reviews, documents, papers, recommendations or other relevant material, if need be by subpoena, and may take testimony (318). Inspectors General refer cases of suspected criminal violations for prosecution and make recommendations for corrective action to agency heads (319). While their recommendations are non-binding, their reports, including on follow-up action (or the lack thereof) (320) are generally made public and sent to Congress, which can on this basis exercise its own oversight function (see recitals 168-169) (321).

(166)

Thirdly, the Intelligence Oversight Board (IOB), which is established within the President’s Intelligence Advisory Board (PIAB), oversees compliance by U.S. intelligence authorities with the Constitution and all applicable rules (322). The PIAB is an advisory body within the Executive Office of the President that consists of 16 members appointed by the President from outside the U.S. government. The IOB consists of a maximum of five members designated by the President from among PIAB members. According to EO 12333 (323), the heads of all intelligence agencies are required to report any intelligence activity for which there is reason to believe that it may be unlawful or contrary to an Executive Order or Presidential Directive to the IOB. To ensure that the IOB has access to the information necessary to perform its functions, Executive Order 13462 directs the Director of National Intelligence and heads of intelligence agencies to provide any information and assistance the IOB determines is needed to perform its functions, to the extent permitted by law (324). The IOB is in turn required to inform the President about intelligence activities it believes may be in violation of U.S. law (including Executive Orders) and are not being adequately addressed by the Attorney General, Director of National Intelligence or the head of an intelligence agency (325). In addition, the IOB is required to inform the Attorney General about possible violations of criminal law.

(167)

Fourthly, intelligence agencies are subject to oversight by the PCLOB. According to its founding statute, the PCLOB is entrusted with responsibilities in the field of counterterrorism policies and their implementation, with a view to protect privacy and civil liberties. In its review of intelligence agencies actions, it can access all relevant agency records, reports, audits, reviews, documents, papers and recommendations, including classified information, conduct interviews and hear testimony (326). It receives reports from the civil liberties and privacy officers of several federal departments/agencies (327), may issue recommendations to the government and intelligence agencies, and regularly reports to Congressional committees and the President (328). Reports of the Board, including the ones to Congress, must be made publicly available to the greatest extent possible (329). The PCLOB has issued several oversight and follow-up reports, including an analysis of the programs run on the basis of Section 702 FISA and the protection of privacy in this context, the implementation of PPD 28 and EO 12333 (330). The PCLOB is also charged with carrying out specific oversight functions as regards the implementation of EO 14086, in particular by reviewing whether agency procedures are consistent with the EO (see recital 126) and evaluating the correction functioning of the redress mechanism (see recital 194).

(168)

Fifthly, in addition to the oversight mechanisms within the executive branch, specific Committees in the U.S. Congress (the House and Senate Intelligence and Judiciary Committees) have oversight responsibilities regarding all U.S. foreign intelligence activities. Members of these Committees have access to classified information as well as intelligence methods and programs (331). The Committees exercise their oversight functions in different ways, in particular through hearings, investigations, reviews and reports (332).

(169)

The Congressional Committees receive regular reports on intelligence activities, including from the Attorney General, the Director of National Intelligence, intelligence agencies and other oversight bodies (e.g. Inspectors General), see recitals 164-165. In particular, according to the National Security Act, ”[t]he President shall ensure that the congressional intelligence committees are kept fully and currently informed of the intelligence activities of the United States, including any significant anticipated intelligence activity as required by this subchapter” (333). In addition, “[t]he President shall ensure that any illegal intelligence activity is reported promptly to the congressional intelligence committees, as well as any corrective action that has been taken or is planned in connection with such illegal activity” (334).

(170)

Moreover, additional reporting requirements follow from specific statutes. In particular, FISA requires the Attorney General to “fully inform” the Senate and House Intelligence and Judiciary Committees regarding the government’s activities under certain sections of FISA (335). It also requires the government to provide the Congressional committees with copies of all decisions, orders, or opinions of the FISC or FISCR that include “significant construction or interpretation” of FISA provisions. As regards surveillance under Section 702 FISA, parliamentary oversight is exercised through statutorily required reports to the Intelligence and Judiciary Committees, as well as frequent briefings and hearings. These include a semi-annual report by the Attorney General describing the use of Section 702 FISA, with supporting documents, including Department of Justice and ODNI compliance reports and a description of any incidents of non-compliance (336), and a separate semi-annual assessment by the Attorney General and the DNI documenting compliance with the targeting and minimization procedures (337).

(171)

In addition, FISA requires the U.S. government to disclose to Congress (and the public) each year the number of FISA orders sought and received, as well as estimates of the number of U.S. and non-U.S. persons targeted by surveillance, among others (338). The Act also requires additional public reporting about the number of NSL issued, again both with regard to U.S. and non-U.S. persons (while at the same time allowing the recipients of FISA orders and certifications, as well as NSL requests, to issue transparency reports under certain conditions) (339).

(172)

More generally, the U.S. Intelligence Community undertakes various efforts to provide transparency about its (foreign) intelligence activities. For example, in 2015, the ODNI adopted Principles of Intelligence Transparency and a Transparency Implementation Plan, and directed each intelligence agency to designate an Intelligence Transparency Officer to foster transparency and lead transparency initiatives (340). As part of these efforts, the Intelligence Community has made and continues to make declassified parts of policies, procedures, oversight reports, reports on activities under Section 702 FISA and EO 12333, FISC decisions and other materials public, including on a dedicated webpage ‘IC on the Record’, managed by ODNI (341).

(173)

Finally, the collection of personal data pursuant to Section 702 FISA is, in addition to the supervision by oversight bodies mentioned in recitals 162-168, subject to oversight by the FISC (342). Pursuant to Rule 13 of the FISC Rules of Procedure, compliance officers in U.S. intelligence agencies are required to report any violations of FISA 702 targeting, minimization, and querying procedures to the DoJ and ODNI, who in turn report them to the FISC. Moreover, the DoJ and ODNI submit semi-annual joint oversight assessment reports to the FISC, which identify targeting compliance trends; provide statistical data; describe categories of compliance incidents; describe in detail the reasons certain targeting compliance incidents occurred, and outline the measures intelligence agencies have taken to avoid recurrence (343).

(174)

Where necessary (e.g. if violations of targeting procedures are identified), the Court may order the relevant intelligence agency to take remedial action (344). The remedies in question may range from individual to structural measures, e.g. from terminating data acquisition and deleting of unlawfully obtained data to a change in the collection practice, including in terms of guidance and training for staff (345). Moreover, during its annual review of Section 702 certifications, the FISC considers non-compliance incidents to determine if the submitted certifications comply with FISA requirements. Similarly, if the FISC finds that the government’s certifications were not sufficient, including because of particular compliance incidents, it can issue a so-called ‘deficiency order’ requiring the government to remedy the violation within 30 days or requiring the government to cease or not begin implementing the Section 702 certification. Finally, the FISC assesses trends it observes in compliance issues and may require changes to procedures or additional oversight and reporting to address compliance trends (346).

(175)

As explained in more detail in this section, a number of avenues in the United States provide Union data subjects with the possibility to bring legal action before an independent and impartial tribunal with binding powers. Together, they allow individuals to have access to their personal data, to have the lawfulness of government access to their data reviewed and, if a violation is found, to have such violation remedied, including through the rectification or erasure of their personal data.

(176)

First, a specific redress mechanism is established, under EO 14086, complemented by the AG Regulation establishing the Data Protection Review Court, to handle and resolve complaints from individuals concerning U.S. signals intelligence activities. Any individual in the EU is entitled to submit a complaint to the redress mechanism concerning an alleged violation of U.S. law governing signals intelligence activities (e.g. EO 14086, Section 702 FISA, EO 12333) that adversely affects their privacy and civil liberties interests (347). This redress mechanism is available to individuals from countries or regional economic integration organisations that have been designated by the U.S. Attorney General as ‘qualifying states’ (348). On 30 June 2023, the European Union and the three European Free Trade Association countries that together constitute the European Economic Area have been designated by the Attorney General under Section 3(f) EO 14086 as a ‘qualifying state’ (349). This designation is without prejudice to Article 4(2) of the Treaty on the European Union.

(177)

A Union data subject who wishes to lodge such a complaint must submit it to a supervisory authority in an EU Member State competent for the oversight of the processing of personal data by public authorities (a DPA) (350). This ensures easy access to the redress mechanism by allowing individuals to turn to an authority ‘close to home’ and with which they can communicate in their own language. After the requirements for filing a complaint referred to in recital 178 have been verified, the competent DPA will channel, via the secretariat of the European Data Protection Board, the complaint to the redress mechanism.

(178)

Bringing a complaint to the redress mechanism is subject to low admissibility requirements, as individuals do not need to demonstrate that their data has in fact been subject to U.S. signals intelligence activities (351). At the same time, to provide a starting point for the redress mechanism to carry out a review, certain basic information must be provided, e.g. regarding the personal data reasonably believed to have been transferred to the U.S. and the means by which it was believed to have been transferred; the identities of the U.S. Government entities believed to be involved in the alleged violation (if known); the basis for alleging that a violation of U.S. law occurred (although this again does not require showing that personal data was in fact collected by U.S. intelligence agencies) and the nature of the relief sought.

(179)

The initial investigation of complaints to this redress mechanism is carried out by the ODNI CLPO, whose existing statutory role and powers have been expanded for those specific actions taken pursuant to EO 14086 (352). Within the Intelligence Community, the CLPO is, inter alia, responsible for ensuring that the protection of civil liberties and privacy is appropriately incorporated in policies and procedures of the ODNI and intelligence agencies; overseeing compliance by the ODNI with applicable civil liberties and privacy requirements; and conducting privacy impact assessments (353). The ODNI CLPO can only be dismissed by the Director of National Intelligence for cause, i.e. in case of misconduct, malfeasance, breach of security, neglect of duty, or incapacity (354).

(180)

When conducting its review, the ODNI CLPO has access to the information for his/her assessment and can rely on the compelled assistance of Privacy and Civil Liberties Officers in the different intelligence agencies (355). Intelligence agencies are prohibited from impeding or improperly influencing the ODNI CLPO’s reviews. This includes the Director of National Intelligence who must not interfere with the review (356). When reviewing a complaint, the ODNI CLPO must “apply the law impartially”, having regard to both the national security interests in signal intelligence activities and privacy protections (357).

(181)

As part of its review, the ODNI CLPO determines whether a violation of applicable U.S. law has occurred and, if that is the case, decides on an appropriate remediation (358). The latter refers to measures that fully redress an identified violation, such as terminating unlawful acquisition of data, deleting unlawfully collected data, deleting the results of inappropriately conducted queries of otherwise lawfully collected data, restricting access to lawfully collected data to appropriately trained personnel, or recalling intelligence reports containing data acquired without lawful authorization or that were unlawfully disseminated (359). Decisions of the ODNI CLPO on individual complaints (including on the remediation) are binding on intelligence agencies concerned (360).

(182)

The ODNI CLPO must maintain documentation of its review and produce a classified decision explaining the basis for its factual findings, the determination with respect to whether a covered violation occurred and the determination of the appropriate remediation (361). If the ODNI CLPO’s review reveals a violation of any authority subject to the oversight of the FISC, the CLPO must also provide a classified report to the Assistant Attorney General for National Security, who in turn under an obligation to report the non-compliance to the FISC, which can take further enforcement action (in accordance with the procedure described in recitals 173-174) (362).

(183)

Once the review is completed, the ODNI CLPO informs the complainant, through the national authority, that “the review either did not identify any covered violations or the ODNI CLPO issued a determination requiring appropriate remediation” (363). This allows protection of the confidentiality of activities conducted to protect national security, while providing the individuals with a decision confirming that their complaint has been duly investigated and adjudicated. This decision can moreover be challenged by the individual. To this end, (s)he will be informed of the possibility to appeal to the DPRC for a review of the CLPO’s determinations (see recitals 184 and further) and that, in case the Court would be seized, a special advocate will be selected to advocate regarding the complainant’s interest (364).

(184)

Any complainant, as well as each element of the Intelligence Community, may seek review of the ODNI CLPO’s decision before the Data Protection Review Court (DPRC). Such applications for review must be submitted within 60 days after receiving the notification from the ODNI CLPO that its review is complete and include any information the individual wishes to provide to the DPRC (e.g. arguments on questions of law or the application of law to the facts of the case) (365). Union data subjects may again submit their application to the competent DPA (see recital 177).

(185)

The DPRC is an independent tribunal established by the Attorney General on the basis of EO 14086 (366). It consists of at least six judges, appointed by the Attorney General in consultation with the PCLOB, the Secretary of Commerce and the Director of National Intelligence for renewable terms of four years (367). The appointment of judges by the Attorney General is informed by the criteria used by the executive branch when assessing candidates for the federal judiciary, giving weight to any prior judicial experience (368). In addition, the judges must be legal practitioners (i.e. active members in good standing of the bar and duly licensed to practice law) and have appropriate experience in privacy and national security law. The Attorney General must endeavour to ensure that at least half of the judges at any given time have prior judicial experience and all judges must hold security clearances to be able to access classified national security information (369).

(186)

Only individuals who meet the qualifications mentioned in recital 185 and are not employees of the executive branch at the time of their appointment or in the preceding two years can be appointed to the DPRC. Similarly, during their term of office at the DPRC, the judges may not have any official duties or employment within the U.S. Government (other than as judges at the DPRC) (370).

(187)

The independence of the adjudication process is achieved through a number of guarantees. In particular, the executive branch (the Attorney General and intelligence agencies) are barred from interfering with or improperly influencing the DPRC’s review (371). The DPRC itself is required to impartially adjudicate cases (372) and operates according to its own rules of procedure (adopted by majority vote). Moreover, DPRC judges may be dismissed only by the Attorney General and only for cause (i.e. misconduct, malfeasance, breach of security, neglect of duty or incapacity), after taking due account of the standards applicable to federal judges laid down in the Rules for Judicial-Conduct and Judicial-Disability Proceedings (373).

(188)

Applications to the DPRC are reviewed by panels of three judges, including a presiding judge, who must act in accordance with the Code of Conduct for U.S. Judges (374). Each panel is assisted by a Special Advocate (375), who has access to all information pertaining to the case, including classified information (376). The role of the Special Advocate is to ensure that the complainant’s interests are represented and that the DPRC panel is well informed about all relevant issues of law and fact (377). To further inform its position on an application for review to the DPRC by an individual, the Special Advocate can seek information from the complainant through written questions (378).

(189)

The DPRC reviews the determinations made by the ODNI CLPO (both whether a violation of applicable U.S. law occurred and as regards the appropriate remediation) based, at a minimum, on the record of the ODNI CLPO’s investigation, as well as any information and submissions provided by the complainant, the Special Advocate or an intelligence agency (379). A DPRC panel has access to all information necessary to conduct a review, which it may obtain through the ODNI CLPO (the panel may e.g. request the CLPO to supplement its record with additional information or factual findings if necessary to carry out the review) (380).

(190)

When concluding its review, the DPRC may (1) decide that there is no evidence indicating that signals intelligence activities occurred involving personal data of the complainant, (2) decide that the ODNI CLPO’s determinations were legally correct and supported by substantial evidence, or (3) if the DPRC disagrees with the determinations of the ODNI CLPO (whether a violation of applicable U.S. law occurred or the appropriate remediation), issue its own determinations (381).

(191)

In all cases, the DPRC adopts a written decision by majority vote. In case the review reveals a violation of the applicable rules, the decision will specify any appropriate remediation, which includes deleting unlawfully collected data, deleting the results of inappropriately conducted queries, restricting access to lawfully collected data to appropriately trained personnel, or recalling intelligence reports containing data acquired without lawful authorization or that were unlawfully disseminated (382). The decision of the DPRC is binding and final with respect to the complaint before it (383). Moreover, if the review reveals a violation of any authority subject to the oversight of the FISC, the DPRC must also provide a classified report to the Assistant Attorney General for National Security, who in turn is under an obligation to report the non-compliance to the FISC, which can take further enforcement action (in accordance with the procedure described in recitals 173-174) (384).

(192)

Each decision of a DPRC panel is transmitted to the ODNI CLPO (385). In cases where the DPRC’s review was triggered by an application from the complainant, the complainant is notified through the national authority that the DPRC completed its review and that “the review either did not identify any covered violations or the DPRC issued a determination requiring appropriate remediation” (386). The Office of Privacy and Civil Liberties of the DoJ maintains a record of all information reviewed by the DPRC and all decisions issued, which is made available for consideration as non-binding precedent for future DPRC panels (387).

(193)

The DoC is also required to maintain a record for each complainant who submitted a complaint (388). To enhance transparency, the DoC must, at least every five years, contact relevant intelligence agencies to verify whether information pertaining to a review by the DPRC has been declassified (389). If this is the case, the individual will be notified that such information may be available under applicable law (i.e. that (s)he may request access to under the Freedom of Information Act, see recital 199).

(194)

Finally, the correct functioning of this redress mechanism will be subject to regular and independent evaluation. More specifically, pursuant to EO 14086, the functioning of the redress mechanism is subject to annual review by the PCLOB, an independent body (see recital 110) (390). As part of this review, the PCLOB will, inter alia, assess whether the ODNI CLPO and DPRC has processed complaints in a timely manner; whether they have obtained full access to necessary information; whether the substantive safeguards of EO 14086 have been properly considered in the review process; and whether the Intelligence Community has fully complied with determinations made by the ODNI CLPO and DPRC. The PCLOB will produce a report on the outcome of its review to the President, Attorney General, Director of National Intelligence, head of intelligence agencies, the ODNI CLPO and congressional intelligence committees, that will also be made public in an unclassified version – and will in turn feed into the periodic review of the functioning of the present Decision that will be conducted by the Commission. The Attorney General, Director of National Intelligence, ODNI CLPO and heads of intelligence agencies are required to implement or otherwise address all recommendations included in such reports. In addition, the PCLOB will make an annual public certification as to whether the redress mechanism is processing complaints consistent with the requirements of EO 14086.

(195)

In addition to the specific redress mechanism established under EO 14086, redress avenues are available to all individuals (irrespective of nationality or place of residence) before ordinary U.S. courts (391).

(196)

In particular, FISA and a related statute provides the possibility for individuals to bring a civil action for money damages against the United States when information about them has been unlawfully and wilfully used or disclosed (392); to sue U.S. government officials acting in their personal capacity for money damages (393); and to challenge the legality of surveillance (and seek to suppress the information) in the event the U.S. government intends to use or disclose any information obtained or derived from electronic surveillance against the individual in judicial or administrative proceedings in the U.S. (394). More generally, if the government intends to use information obtained during intelligence operations against a suspect in a criminal case, constitutional and statutory requirements (395) impose obligations to disclose certain information so the defendant can challenge the legality of the Government’s collection and use of the evidence.

(197)

Moreover, there are several specific avenues to seek legal recourse against government officials for unlawful government access to, or use of personal data, including for purported national security purposes (i.e. the Computer Fraud and Abuse Act (396); Electronic Communications Privacy Act (397); and Right to Financial Privacy Act (398)). All of these legal actions concern specific data, targets and/or types of access (e.g. remote access of a computer via the internet) and are available under certain conditions (e.g. intentional/wilful conduct, conduct outside of official capacity, harm suffered).

(198)

A more general redress possibility is offered by the APA (399), according to which “any person suffering legal wrong because of agency action, or adversely affected or aggrieved by agency action”, is entitled to seek judicial review (400). This includes the possibility to ask the court to “hold unlawful and set aside agency action, findings, and conclusions found to be […] arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law” (401). For example, a federal appellate court ruled on an APA claim in 2015 that the U.S. government’s bulk collection of telephony metadata was not authorised by Section 501 FISA (402).

(199)

Finally, in addition to the redress avenues mentioned in recitals 176-198, any individual has the right to seek access to existing federal agency records under FOIA, including where these contain the individual's personal data (403). Gaining such access can also facilitate bringing proceedings before ordinary courts, including in support of showing standing. Agencies may withhold information that falls within certain enumerated exceptions, including access to classified national security information and information concerning law enforcement investigations (404), but complainants who are dissatisfied with the response have the possibility to challenge it by seeking administrative and, subsequently, judicial review (before federal courts) (405).

(200)

It follows from the above that when U.S. law enforcement and national security authorities access personal data falling within the scope of this Decision, such access is governed by a legal framework that lays down the conditions under which access can take place and ensures that access and further use of the data is limited to what is necessary and proportionate to the public interest objective pursued. These safeguards can be invoked by individuals who enjoy effective redress rights.

(201)

The Commission considers that the United States – through the Principles issued by the U.S. DoC – ensures a level of protection for personal data transferred from the Union to certified organisations in the United States under the EU-U.S. Data Privacy Framework that is essentially equivalent to the one guaranteed by Regulation (EU) 2016/679.

(202)

Moreover, the Commission considers that the effective application of the Principles is guaranteed by transparency obligations and the administration of the DPF by the DoC. In addition, taken as a whole, the oversight mechanisms and redress avenues in U.S. law enable infringements of the data protection rules to be identified and punished in practice and offer legal remedies to the data subject to obtain access to personal data relating to him/her and, eventually, the rectification or erasure of such data.

(203)

Finally, on the basis of the available information about the U.S. legal order, including the information contained in Annexes VI and VII, the Commission considers that any interference in the public interest, in particular for criminal law enforcement and national security purposes, by U.S. public authorities with the fundamental rights of the individuals whose personal data are transferred from the Union to the United States under the EU-U.S. Data Privacy Framework, will be limited to what is strictly necessary to achieve the legitimate objective in question, and that effective legal protection against such interference exists. Therefore, in the light of the above findings, it should be decided that the United States ensures an adequate level of protection within the meaning of Article 45 of Regulation (EU) 2016/679, interpreted in light of the Charter of Fundamental Rights of the European Union, for personal data transferred from the European Union to organisations certified under the EU-U.S. Data Privacy Framework.

(204)

Given that the limitations, safeguards and redress mechanism established by EO 14086 are essential elements of the U.S. legal framework on which the Commission’s assessment is based, the adoption of this Decision is notably based on the adoption of updated policies and procedures to implement EO 14086 by all U.S. intelligence agencies and the designation of the Union as a qualifying organisation for the purpose of the redress mechanism that have taken place respectively on 3 July 2023 (see recital 126) and 30 June 2023 (see recital 176).

(205)

Member States and their organs are required to take the measures necessary to comply with acts of the Union institutions, as the latter are presumed to be lawful and accordingly produce legal effects until such time as they are withdrawn, annulled in an action for annulment or declared invalid following a reference for a preliminary ruling or a plea of illegality.

(206)

Consequently, a Commission adequacy decision adopted pursuant to Article 45(3) of Regulation (EU) 2016/679 is binding on all organs of the Member States to which it is addressed, including their independent supervisory authorities. In particular, transfers from a controller or processor in the Union to certified organisations in the United States may take place without the need to obtain any further authorisation.

(207)

It should be recalled that, pursuant to Article 58(5) of Regulation (EU) 2016/679 and as explained by the Court of Justice in the Schrems judgment (406), where a national data protection authority questions, including upon a complaint, the compatibility of a Commission adequacy decision with the fundamental rights of the individual to privacy and data protection, national law must provide it with a legal remedy to put those objections before a national court which may be required to make a reference for a preliminary ruling to the Court of Justice (407).

(208)

According to the case law of the Court of Justice (408), and as recognised in Article 45(4) of Regulation (EU) 2016/679, the Commission should continuously monitor relevant developments in the third country after the adoption of an adequacy decision in order to assess whether the third country still ensures an essentially equivalent level of protection. Such a check is required, in any event, when the Commission receives information giving rise to a justified doubt in that respect.

(209)

Therefore, the Commission should on an on-going basis monitor the situation in the United States as regards the legal framework and actual practice for the processing of personal data as assessed in this Decision. To facilitate this process, the U.S. authorities should promptly inform the Commission of material developments in the U.S. legal order that have an impact on the legal framework that is the object of this Decision, as well as any evolution in practices related to the processing of the personal data assessed in this Decision, both as regards the processing of personal data by certified organisations in the United States and the limitations and safeguards applicable to access to personal data by public authorities.

(210)

Moreover, in order to allow the Commission to effectively carry out its monitoring function, the Member States should inform the Commission about any relevant action undertaken by the national data protection authorities, in particular regarding queries or complaints by Union data subjects concerning the transfer of personal data from the Union to certified organisations in the United States. The Commission should also be informed about any indications that the actions of U.S. public authorities responsible for the prevention, investigation, detection or prosecution of criminal offences, or for national security, including any oversight bodies, do not ensure the required level of protection.

(211)

In application of Article 45(3) of Regulation (EU) 2016/679 (409), the Commission, following the adoption of this Decision, should periodically review whether the findings relating to the adequacy of the level of protection ensured by the United States under the EU-U.S. DPF are still factually and legally justified. Since in particular EO 14086 and the AG Regulation require the creation of new mechanisms and the implementation of new safeguards, this Decision should be subject to a first review within one year after its entry into force, to verify whether all relevant elements have been fully implemented and are functioning effectively in practice. Following that first review, and depending on its outcome, the Commission will decide in close consultation with the Committee established under Article 93(1) of Regulation (EU) 2016/679 and the European Data Protection Board on the periodicity of future reviews (410).

(212)

To perform the reviews, the Commission should meet with the DoC, FTC and DoT accompanied, if appropriate, by other departments and agencies involved in the implementation of the EU-U.S. DPF, as well as, for matters pertaining to government access to data, representatives of the DoJ, ODNI (including the CLPO), other Intelligence Community elements, the DPRC as well as the Special Advocates. The participation in this meeting should be open to representatives of the members of the European Data Protection Board.

(213)

The reviews should cover all aspects of the functioning of this Decision with respect to the processing of personal data in the United States, and in particular the application and implementation of the Principles, with special attention paid to protections afforded in case of onward transfers; relevant case law developments; the effectiveness of the exercise of individual rights; the monitoring and enforcement of compliance with the Principles; as well as the limitations and safeguards with respect to government access, notably the implementation and application of the safeguards introduced by EO 14086, including through policies and procedures developed by intelligence agencies; the interplay between the EO 14086 and Section 702 FISA and EO 12333; and the effectiveness of the oversight mechanisms and redress avenues (including the functioning of the new redress mechanism established under EO 14086). In the context of such reviews, attention will also be paid to cooperation between the DPAs and competent authorities of the United States, including the development of guidance and other interpretative tools on the application of the Principles as well as on other aspects of the functioning of the Framework.

(214)

On the basis of the review, the Commission should prepare a public report to be submitted to the European Parliament and the Council.

(215)

Where available information, in particular information resulting from the monitoring of this Decision or provided by U.S. or Member States’ authorities, reveals that the level of protection afforded to data transferred under this Decision may no longer be adequate, the Commission should promptly inform the competent U.S. authorities thereof and request that appropriate measures be taken within a specified, reasonable timeframe.

(216)

If, at the expiry of that specified timeframe, the competent U.S. authorities fail to take those measures or otherwise demonstrate satisfactorily that this Decision continues to be based on an adequate level of protection, the Commission will initiate the procedure referred to in Article 93(2) of Regulation (EU) 2016/679 with a view to partially or completely suspend or repeal this Decision.

(217)

Alternatively, the Commission will initiate that procedure with a view to amend the Decision, in particular by subjecting data transfers to additional conditions or by limiting the scope of the adequacy finding only to data transfers for which an adequate level of protection continues to be ensured.

(218)

In particular, the Commission should initiate the procedure for suspension or repeal in case of:

(219)

The Commission should also consider initiating the procedure leading to the amendment, suspension or repeal of this Decision if the competent U.S. authorities fail to provide the information or clarifications necessary for the assessment of the level of protection afforded to personal data transferred from the Union to the United States, or as regards compliance with this Decision. In this respect, the Commission should take into account the extent to which the relevant information can be obtained from other sources.

(220)

On duly justified imperative grounds of urgency, for example if EO 14086 or the AG Regulation would be amended in a way that undermines the level of protection described in this Decision or if the Attorney General’s designation of the Union as a qualifying organisation for the purpose of the redress mechanism is withdrawn, the Commission will make use of the possibility to adopt, in accordance with the procedure referred to in Article 93(3) of Regulation (EU) 2016/679, immediately applicable implementing acts suspending, repealing or amending this Decision.

(221)

The European Data Protection Board published its opinion (411), which has been taken into consideration in the preparation of this Decision.

(222)

The European Parliament adopted a resolution on the adequacy of the protection afforded by the EU-US Data Privacy Framework (412).

(223)

The measures provided for in this Decision are in accordance with the opinion of the Committee established under Article 93(1) Regulation (EU) 2016/679.