Surveillance Oversight, Intelligence Sharing, and the Rule of Law

1. Panel: “Surveillance Oversight, Intelligence Sharing, and the Rule of Law” Peter Swire Holder Chair of Law and Ethics @tlantic conference on Surveillance in EU & US Brussels (presented remotely) September 26, 2017

2. Overview • This talk summarizes key findings from 300-page sworn testimony in Schrems v. Facebook • Recently published • Explains US surveillance law to an EU audience • Full materials at: https://www.alston.com/en/resources/peter-swire-irish-high-court-case-testimony • Short summary essays about the testimony • Chapitre 1, “Résumé de Témoinage” estdisponible en français • Testimony of other experts at https://iapp.org/resources/article/schrems-2-0-expert-testimony

3. Swire Background • Student (a long time ago) at ULB on European Community law • Over 20 years as privacy, data protection, and cybersecurity professor • 1998 book on EU/US data protection • 1999-2001, Chief Counselor for Privacy in Clinton White House • Extensive work on the Safe Harbor • 2004: “The System of Foreign Intelligence Surveillance Law” • 2013, one of five members of President Obama’s Review Group on Intelligence & Communications Technology (“NSA Review Group”) • 2015, after Schrems I, sole non-government US expert who testified for DPAs on effects of Schrems – testimony documented 24 US surveillance reforms since 2013 (and more since) – https://ssrn.com/abstract=2709619

4. December 2013: The Situation Room

5. Background for the Testimony • Current case in High Court of Ireland, Schrems v. Facebook, on adequacy of Standard Contract Clauses • Irish Data Protection Commissioner found complaint by Schrems to be “well founded” • Issue: is there inadequacy due to national security surveillance for personal data transferred to the U.S.? • Irish court procedure: experts selected by a party (I was selected by FB), but sworn obligation to provide independent testimony to the Court on US law • I retained completed editorial control over content • Experts conferred about disagreements with each other’s testimony; based on that, I changed two sentences in 300 pages of testimony

6. U.S. Systemic Remedies • Many of the most effective protections for privacy exist systemically, before a violation, rather than only by ex post remedies • For auto accidents, it is good to have a remedy after the accident; it is better to prevent the accident from occurring • Chapter 3: many systemic remedies under US law (49 pages) • Chapter 6, Oxford team led by Ian Brown found “the US now serves as a baseline for foreign intelligence standards.” • The legal framework for foreign intelligence collection in the US “contains much clearer rules on the authorisation and limits on the collection, use, sharing and oversight of data relating to foreign nationals than the laws of almost all EU Member States.” • Chapter 4: strong systemic remedies for US criminal law

7. Foreign Intelligence Surveillance Court • Chapter 5: We reviewed all materials declassified by the FISC from 2013 to late 2016 • Significant compliance problems until about 2009 • The FISC today exercises independent and effective oversight over US intelligence surveillance • Growing number of requests refused or modified • Several surveillance programs halted or modified by the FISC • The FISC monitors surveillance programs far more than most have realized • Improved transparency • Third party, independent litigants increasingly appear before the FISC

8. Many US Individual Remedies for Privacy • Chapter 7 details many US remedies for privacy violations • Under US law in general, many advantages for plaintiffs, such as: • Broad discovery • Contingency fees • Favorable attorney’s fees • Jury trials • Class actions • Important remedies against service providers who violate law to provide telecommunications records to the government

9. Broader Implications of the SCC Case • Major impact if inadequacy finding “only” applies to (a) the US, for (b) Standard Contract Clauses • Geographic scope: study of the BRIC countries (Brazil, Russia, India, China), and none are close to the US in adequacy of surveillance oversight • Beyond SCCs: • Extent of surveillance within US is independent of the lawful basis of the transfer • Privacy Shield – very similar safeguards as SCCs • Binding Corporate Rules – again, within US, similar safeguards • And, US as “baseline” for strict standards for intelligence oversight • Therefore, hard to see how to limit the scope of an inadequacy finding – there may be no lawful basis for many transfers to most countries outside of the EU

10. Conclusion • For Schrems I, there was not much factual record about US law for oversight of national security surveillance • In my experience, there has been limited appreciation of the multiple safeguards within US law for intelligence oversight • This sworn testimony – very detailed, with footnotes for everything • I respectfully suggest that EU experts should read the published testimony of the experts in US law, in the current case • Without study of this material, we could see a decision with large consequences, without accurate recognition of actual US law and practice