We Shouldn’t Allow A New Super Secret Surveillance Court Cover Up The Civil Liberties Problems Of The Old Super Secret Surveillance Court

Privacy

from the not-fixing-the-problem dept

For years now we’ve been covering the big ongoing fights between the US and the EU regarding the transfer of user data across the Atlantic. The main issue was that due to somewhat different data protection/privacy laws between the EU and the US, the two keep trying to work out a “deal” that allows (mostly) US companies to stores data from EU users on servers in the US. This transatlantic data flow agreement is important. It would be difficult for many US companies to offer services to EU citizens without it.

But it’s been a fucking mess for over a decade. Almost entirely because of US surveillance programs.

The agreements to handle this have gone by various names, starting with the EU/US Privacy “safe harbor,” and then later the “Privacy Shield.” In both cases, those agreements were eventually rejected by the EU Court of Justice, almost entirely because of the very big problem of the US’s surveillance activities, mostly overseen by the secretive FISA Court. (As a side note, EU government surveillance is in many ways worse than the US’s similar surveillance efforts, but somehow that never comes up in any of these discussions… but, I digress…).

Back in the fall of 2022, the EU and the US excitedly announced a new agreement to replace the old rejected agreements. Yet, as we pointed out at the time, unless they agreed to stop NSA surveillance on basically all electronic communications outside of the US, it wasn’t clear how it would actually fix the underlying reason these agreements keep getting thrown out.

As Politico recently detailed, the way the US has “fixed” this in the new privacy agreement… is to set up an entirely new, entirely secretive surveillance court. What could go wrong?

Officially known as the Data Protection Review Court, it was authorized in an October 2022 executive order to fix a collision of European and American law that had been blocking the lucrative flow of consumer data between American and European companies for three years.

The court’s eight judges were named last November, including former U.S. Attorney General Eric Holder. Its existence has allowed companies to resume the lucrative transatlantic data trade with the blessing of EU officials.

The details get blurry after that.

The court’s location is a secret, and the Department of Justice will not say if it has taken a case yet, or when it will. Though the court has a clear mandate — ensuring Europeans their privacy rights under U.S. law — its decisions will also be kept a secret, from both the EU residents petitioning the court and the federal agencies tasked with following the law. Plaintiffs are not allowed to appear in person and are represented by a special advocate, appointed by the U.S. attorney general.

That doesn’t seem that great.

Also, this new quasi-court has some other oddities, including that it is open to Europeans, but not Americans.

U.S. residents who suspect they are under improper surveillance cannot go to the Data Protection Review Court. Under U.S. law, they can go to a federal court — but only if they can show a concrete wrong or harm that gives them legal standing, which presents a Catch-22, since they can’t prove what they don’t know.

Adam Klein, former chair of the Privacy and Civil Liberties Oversight Board, an independent agency within the Executive Branch, pointed to former Trump campaign adviser Carter Page as the type of individual who could have benefited from a mechanism like the DPRC. Page was surveilled by the FBI during the 2016 presidential election as part of a probe into Russian influence in U.S. politics — and Justice Department inspector general investigation later found a swath of errors and material omissions in the documents used to seek the surveillance warrant. An FBI lawyer ultimately pleaded guilty to altering a document used for that warrant.

But Page himself had little recourse. He filed a lawsuit in 2020 seeking $75 million from the government and several current and former FBI and DOJ officials for violating his constitutional rights. A federal judge called the FBI’s conduct “troubling,” but ultimately found the law bars Page from pursuing a civil lawsuit. An appeal is pending.

Now, with the DPRC in place, “We’re in an odd place when non-residents have easier access to a place to raise their concerns about U.S. government surveillance than Americans do,” said Klein.

But even Europeans have no clear path to using this court that is so secretive no one’s even entirely sure if it’s actually opened for business.

According to the executive order, getting before the DPRC starts with a long preliminary process: a citizen complaint first has to shuttle between an EU data protection official and the U.S.’ Office of the Director of National Intelligence, which decides whether there was a civil rights violation from the data collection.

Regardless of the results, the response to the initial complaint will neither confirm or deny that the EU resident was under U.S. surveillance. The response will say there either was no violation found, or that there was a violation found and that the U.S. government took appropriate steps to resolve it. It won’t specify which one.

The EU resident can then appeal directly to the DPRC in America, — with the assistance of a court-appointed special advocate. That advocate will have the details from the underlying ODNI decision — although that decision remains off-limits to the person making the appeal.

“What are you going to write in the appeal? Nothing, because you don’t know what the answer is,” Schrems said. “As a lawyer, it’s really hard that you’ll ever win a case by saying ‘I appeal’ without saying what your problem is with the decision.”

While this seems to be a setup designed to make bureaucrats on either side of the Atlantic pretend they’re doing something useful, it’s hard to see how it will actually solve the underlying problems. Which, again, are because of NSA surveillance rubber stamped by the other secretive court, the FISA Court.

Stacking up more secretive courts does not seem like a real solution. Fixing overly broad, mass surveillance is.

But apparently that’s off the table.

Filed Under: data protection review court, eu, nsa, privacy shield, secrecy, surveillance, transatlantic data flows