EDPB Report on the first review of the European Commission Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework

S. Data Privacy Framework . Article 3 of the adequacy decision requires the Commis sion to regularly review the decision, with the first periodic review to take place after one year from the date of the notification of the adequacy decision to the Member States. C. on 18 and 19 July of 2024. S. S. public authorit ies to personal data transferred from the EU to DPF - certified organisations . S. authorities and the Commission to implement the DPF , and takes positive note of several developments that took place since the adoption of the adequacy decision. S. S. companies, including developing a new website, updating procedures, engaging with companies, and conducting awareness - raising activities. Similarly, the multi - layered redress system under the DPF has been updated and implemented a nd provides for several, easily accessible avenues for complaints from EU individuals. S. authorities on compliance with the substantial elements of the DPF Principles.

Thus, the EDPB would like to encourage the Department of Commerce and the Federal Trad e Commission to increase ex officio investigations as regards substantial compliance of certified organizations with all DPF Principles in the near future. The EDPB would also like to incentivise the Department of Commerce to work on and publish practical guidance on the Accountability for Onward Transfer Principle of the DPF. Such guidance would ideally clarify the requirements that DPF - certified companies who receive personal data from EU exporters need to comply with when transferring such data to other third countries. The EDPB also believes that there is a need to settle the longstanding divergence in interpretation between EU and US authorities of the notion of ‘HR Data’ under the DPF. Therefore, the EDPB equally encourages the Department of Commerce to swiftly develop guidance on this matter that acknowledges the broad definition of HR Data under the DPF and lays out practical examples where HR Data would be processed under the DPF, explaining for each scenario which DPF Principles would be relevant.

The EDPB stands ready to provide feedback to the Department of Commerce’s guidance. S. public authorities to personal data transferred from the EU to DPF - certified organisations , the EDPB recalls that the adequacy decision is based in particular on the Commission’s favourable assessment of Executive Order 14086, which is effectively meant to remedy the deficits identified in the judgment of the CJEU in Case C - 311/18. S. legal framework on signals intelligence and establishing a new redress mechanism. In the first periodic review one year after the adoption of the adequacy decision, the EDPB focused on the effective implementation of these safeguards as well as on new developments concerning government access to personal data for national security purposes. S. Intelligence Community’s internal policies and procedures have been updated and published. The Adopted 5 EDPB would have welcomed, however, an opportunity during the periodic review to discuss examples that clearly identify how the pri nciples of necessity and proportionality are specifically interpreted and applied at agency level.

At the time of t he review , no complaint had been filed under the new framework by EU individuals. Also, the annual review of the redress mechanism carried out by the Privacy and Civil Liberties Oversight Board is still pending. The EDPB wishes to renew its call to the Com mission to monitor the practical functioning of the different safeguards of Executive Order 14086 designed to ensure an essentially equivalent level of protection. The redress mechanism should remain a priority during future periodic reviews. With regard t o the re - authorisation of Section 702 of the Foreign Intelligence Surveillance Act , the EDPB takes positive note of the legislative changes which increase privacy protections and recalls that Executive Order 14086 remains fully applicable when requesting a ccess to data under Section 702 of the Foreign Intelligence Surveillance Act . However, the EDPB regrets that the reform did not incorporate the recommendation of the Privacy and Civil Liberties Oversight Board to codify certain safeguards of the Executive Order in Section 702 of the Foreign Intelligence Surveillance Act , thus not taking the opportunity to introduce additional safeguards as also previously recommended by the EDPB.

The EDPB is concerned that the amendment to the definition of “electronic comm unication service provider” under Section 702 of the Foreign Intelligence Surveillance Act does not meet the requirement of clear, precise and accessible law. Notwithstanding the safeguards of Executive Order 14086, this change creates uncertainty about th e actual reach of Section 702 surveillance . The EDPB considers that it is important for the Commission to follow up on future developments concerning Section 702 of the Foreign Intelligence Surveillance Act and also encourages the Privacy and Civil Liberti es Oversight Board to monitor these developments. S. intelligence agencies from data brokers and other commercial en tities that is not captured by Executive Order 14086 . The Commission should further assess and monitor this particular form of government access and its practical use cases. The EDPB would find it appropriate for the next review of the DPF to take place within three years or less , taking into account the numerous important aspects of the adequacy decision and the implementation of the DPF that the EDPB has recommended the Commissi on to closely monitor.

This would allow the Commission and the EDPB to follow up in a structured manner on comprehensive information from U . S . authorities and other stakeholders about the practical application of the DPF sooner than the legally - established maximum time limit for the review. S. Data Privacy Fra mework (hereinafter ‘Decision’). HAS ADOPTED THE FOLL OWING REPORT 1 INTRODUCTION 1. S. Privacy Shield (the ‘Privacy Shie ld’). S. for national security purposes disproportionately limited the rights enshrined in Articles 7 and 8 of the EU Charter of Fundamental Rights (the ‘Charter’). 1 Moreover, t he CJEU stated that the Privacy Shield did not provide guarantees essentially equivalent to those required by Article 47 of the Charter. 2 2. S. government entered into discussions on a new framework that addressed the issu es raised by the CJEU. In March 2022, President von der Leyen and President Biden announced that they had reached an agreement in principle on a new transatlantic data flows framework, following the negotiations started in the wake of the Schrems II decisi on.

On 13 December 2022, the draft adequacy decision was published and transmitted to the EDPB for its opinion as per Article 70(1)(s) of the GDPR. Subsequently, on 28 February 2023, the EDPB issued its opinion 3 (the ‘Opinion’) on this draft adequacy decis ion. 3. S. Data Privacy Framework 4 (the ‘Decision’). S. Data Privacy Framework (‘DPF’). Article 3 of the Decision requires the Commission to regularly review the Decision, with the first periodic review to take place after one year from the date of the notification of the adequacy decision to the Member States 5 . As under the Privacy Shield, the Decision states that the “participation in this meeting should be open to representatives of the members of the European Data Protection Board” 6 . C. on 18 and 19 July 2024 . 1 See judgment of the CJEU of 16 July 2020, Data Protection Commissioner v. Facebook Ireland Limited and Maximillian Schrems, C - 311/18 (‘Schrems II’), §§ 184 - 185.

2 Idem, § 192. S. Data Privacy Framework, adopted on 28 February 2023. S. 2023. 5 Idem, Article 3(4). 6 Idem, Recital 212. Adopted 7 4. e. S. for the purposes of law enforcement and national security. Considering that the review was carried out after the first year of operation of the DPF, the EDPB focused in particular on verifying whether all elements provided for in the framework have been put in place and whether they function effectively in practice. 5. The Commission published its report of the first periodic review on 9 October 2024 7 . 6. The EDPB’s main findings from this first periodic review, stemming from written submissions as well as from oral contributions, are presented in this report. S. 1 Self-certification process; oversight and supervision of compliance with the Principles 7. S. Department of Commerce (‘DoC’) has been on implementing the self-certification process, including developing a new website, updating procedures, engaging with companies, and other outreach/awareness-raising activities.

The EDPB welcomes the efforts of the DoC in this regard, which contributed to clarifying certification requirements for companies and increased the trust of increasing numbers of companies certifying under the DPF 8 . 8. S. S. Department of Transportation (‘DoT’), as regards substantial compliance of certified organisations with all DPF Principles is, as it was under the previous Privacy Shield, a point of concern for the EDPB. The EDPB considers it important that the tools foreseen already by the Privacy Shield and now the DPF to monitor compliance, such as spot checks, compliance review questionnaires, and the possibility to request information from certified companies, are used by the DoC 9 . The EDPB welcomes the plans of the DoC to build tools that will perform automated compliance checks. However, the EDPB considers that automated means may complement but cannot substitute individual investigations and assessments of concrete cases.

The EDPB stresses the importance of carrying out ex officio compliance monitoring activities and will devote significant attention to this aspect during the next review of the DPF. 10 The same goes for enforcement action by the FTC and the DoT. The EDPB notes that there are typically very few complaints by concerned individuals that might trigger enforcement action 11 . Therefore, the EDPB sees the need for proactive enforcement action for example by checking compliance with specific DPF Principles by certified companies of specific industry sectors. S. pdf. 8 COM(2024) 451 final, p. 2. 9 For instance, DPF Principle 3(b) allows the DoC to request from certified companies a summary or representative copy of the relevant privacy provisions of their contracts for onward transfers. S. Privacy Shield - Third Annual Joint Review, adopted on 12 November 2019, para. 7 of the Executive Summary and para.

59. 11 Idem, paras. 7 and 66. Adopted 8 9. While there were more than 2800 organizations listed as active participants under the DPF at the time of the review, there were also more than 1100 that had withdraw n from the DPF and 2600 listed as inactive because those participants had let their certification lapse. The DPF foresees that the DoC verifies whether organizations that actively withdraw from the DPF or let their certification lapse return, delete or ret ain the personal data received under the DPF. If the organization retains the data, it is obliged to continue to apply the DPF Principles and identify a contact point for further contacts. So far, the website of the DPF does not display if the inactive org anizations have chosen to return, delete or retain personal data. Also, for those cases where the organizations have let their certification lapse, it is unclear if they have responded to the DoC and clarified whether the data received was returned, delete d, or retained.

12 The few eligible complaints appeared to concern mainly requests for deletion of or access t o personal data. 11. The first Annual IRM reports under the DPF were published shortly after the review meeting, confirming the overall very low number of eligible complaints received. 13 The reports were not presented in a standardised format and did not alway s include an explanation of how conflicts of interest were precluded. To ensure better comparability in the future, the EDPB would like to reiterate its recommendation that the DoC introduces a standardized template format for the Annual IRM report which i ncludes explanation on how possible conflicts of interest are precluded. 14 12. Neither the EU DPAs nor the DoC had received any complaints from EU individuals concerning non - compliance with the DPF Principles at the time of the review, although comprehensive gu idance on the complaint procedure had been published on both sides of the Atlantic 15 .

S. Privacy Shield - Third Annual Joint Review, adopted on 12 November 2019, para. 68 . eu) . S. DPF FAQ for European individuals , which were published on the websites of the national DPAs. The DoC also published guidance for European individuals on their rights under the DPF, includin g on the complaint procedure. Adopted 9 with the DPF Principles. However, they had not yet concluded any investigations or reached a decision in these cases. 13. S. DPF Panel. In addition, the arbitration rules for the Panel and a code of conduct for arbitrators had been updated and adopted. 16 The arbitration mechanism had not been invoked at the time of the review. 14. The EDPB takes positive note of the significant efforts made to update and implement the many redress avenues available under the DPF and welcomes the awareness-raising and accessible guidance published on both sides of the Atlantic for the purpose of facilitating EU individuals’ right to complain about certified organisations’ non-compliance with the Principles.

S. authorities on certified organisations’ compliance with the substantial elements of the Principles 17 . 3 Guidance and cooperation 15. S. importers 18 . S. data importers. 16. The EDPB would like to incentivise the DoC to work on and publish practical guidance for US importers on the Accountability for Onward Transfer Principle of the DPF. This topic was covered in the FAQs issued by the DoC on the Privacy Shield. At the time, such guidance was highly demanded by participating organisations, and the EDPB welcomed its adoption 19 . However, at the time of drafting this Report, the DoC had not included this topic in the guidance it has issued on the DPF. The EDPB takes note that DPF-certified companies would greatly benefit from practical guidance of the DoC on this topic, in particular concerning the concrete steps they have to take to comply with the Accountability for Onward Transfer Principle.

S. importers may not be aware of the requirements for lawful transfers of personal data received from EU exporters to third countries that have not been considered adequate by the Commission under Article 45 GDPR. org). S. Privacy Shield - Third Annual Joint Review, adopted on 12 November 2019, para. 67. eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us- data-transfers en. S. Privacy Shield - Second Annual Joint Review, Adopted on 22 January 2019, paras. 41 and 42. Adopted 10 show that certain DPF - certified companies may be relying on tools to carry out onward transfers that do not provide the same level of protection for the onward transferred personal data as t he one guaranteed by the DPF Principles 20 . Any guidance of the DoC on the Accountability for Onward Transfer Principle should clarify that the safeguards imposed by the initial recipient on the importer in the third country must be effective in light of thi rd country legislation, prior to an onward transfer in the context of the DPF 21 .

The EDPB remains available to provide inputs to draft guidelines of the DoC on this matter. 17. During the review, the EDPB stressed the need to settle the longstanding issue conc erning the interpretation of the notion of ‘ HR Data ’ under the DPF. S. authorities (and its practical consequences) has been repeatedly mentioned by the EDPB in its reports concerning the annual reviews of the DPF’s predecessor, the Privacy Shield. While the DoC has long taken view that only the processing of data of employees within the same corporate group falls within the category of ‘HR data’ under the DPF, the EDPB always regarded ‘HR data’ as any perso nal data concerning an employee in the context of an employment relationship, irrespective of whether the data is transferred within a corporate group or to a different commercial operator 22 . S. importers that have an active HR Data certification and that conform to the requirements set forth in the Supplemental Principles set out in Section III (9) of the DPF .

S. importer does not have a direct or indirect relationship with the data subject nor access to his or her personal data ‘in the clear’. However, the EDPB stresses the importance of ensuring the competence of EU DPAs in all scenari os where HR Data is transferred under the DPF, as provided under Section III (9)(d) of Annex I of the DPF. 18. S. companies on the topic of HR Data in the months following th e review to settle this interpretative divergence, which has important practical consequences. g. ) and explain for each scenario which DPF obligations would be relevant. Among the goals of the guidance , the DoC has also underlined the need to prevent any potential enforcement gaps of DPF Principles. S. authorities. S. 19. S. in the area of privacy. This includes legislative and regulatory developments, as well as new 20 See recital (38) of the Decision. 21 EDPB Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU - US Data Privacy Framework , Adopted on 28 February 2023, paragraphs 58 and 59.

S. Privacy Shield – First annual Joint Review (WP 255) , Adopted on 28 November 2017, p. 9. S. Privacy Shield (SWD(2019) 390 final), p. 17 and 18. 23 Section III (9)(a)(i) of Annex I of the DPF. Adopted 11 jurisprudence, which are outlined in detail in the European Commission’s report on the first periodic review of the DPF 24 . 20. S. States have enacted comprehensive privacy laws as of J uly 2024, of which nine have entered into application, namely California, Colorado, Oregon, Virginia, Connecticut, Utah, Montana, Texas and Florida. S. National Telecommunications and Information Administration (‘NTIA’) present at the review meeting, seem to be low. S. S. 21. S. legal system provide specific legal guarantees to individuals whose personal data are transferred from the EU under the Decision and who are then subject to decisions which produce legal effects concerning or significantly affecting them and which are based solely on the automated processing of their personal data.

S. Federal law in specific areas 25 , the EDPB takes positive note that the FTC has recently increased the use of it s enforcement powers against discrimination and bias in automated systems in cases of substantial injury to consumers 26 . S. States have adopted legislation addressing the automated processing of personal data (or, at least, some forms of it) and generally allowing opt - outs for certain types of decision - making based on “profiling” 27 . 22. S. Supreme Court in Loper Bright Enterprises v. Raimondo (of 28 June 2024), which overrules previous case law on the so - called Chevron doctrine . Under this doctrine, courts were bound to apply the principle of deference to a regulatory agency’s reasonable interpretation of the law in case of ambiguity in a law e nforced by that agency. During the review, EDPB representatives echoed concerns expressed by NGOs that the recent judgment could affect the powers of the FTC to enforce privacy cases and to issue regulations in the area of privacy 28 .

In response, the FTC ex plained that the ruling does not affect its enforcement powers and that it generally exercises rulemaking powers under the Magnuson - Moss Warranty Act 29 , and not under the Administrative Procedures Act (which is the one affected by the Loper Bright Enterpris es v. Raimondo judgment). S. authorities competent for the oversight of law enforcement and national security agencies also confirmed that the Loper Bright Enterprises v. Raimondo judgment does not affect their competences to supervise compliance with th e safeguards applicable to personal data processing in those contexts. 24 COM(2024) 451 final, p. 8 - 10. 25 Recital (35) of the Decision. gov/legal - library/browse/cases - proceedings/2023190 - rite - aid - corporation - ftc - v . It is noteworthy that, in this decision, the FTC requires the company to provide several phases of notice to affected consumers and to grant them the ability to challenge automated decisions.

27 COM(2024) 451 final, p. 9. org/blog/chevron - decision - will - impact - privacy - and - ai - regulations/ . gov/legal - library/browse/statutes/magnuson - moss - warranty - federal - trade - commission - improvements - act . S. PUBLIC AUTHOR ITIES 23. S. S. S. signals intelligence acti vities (‘EO 14086’ or ‘EO’). EO 14086 is effectively meant to address and remedy the deficits identified by the CJEU in its Schrems II ruling, which invalidated the previous adequacy decision, called the Privacy Shield. S. legal framework on signals intelligence and establishing a new redress mechanism for individuals in the area of signals intelligen ce activities. 24. In the Opinion, the EDPB recognized significant improvements compared to the former Privacy Shield framework while also noting points for further attention or for concern. Taking these points into account, the EDPB’s focus in the first peri odic review one year after the adoption of the Decision was on the effective implementation of the safeguards foreseen in EO 14086 as well as on new developments concerning government access to personal data for national security purposes.

On that basis, the EDPB understands that the updated policies and procedures are intended to operationalize the safeguards set forth in EO 14086 at agency level. They are therefore critical to assessing whether the se safeguards, in particular the principles of necessity and proportionality, 30 See EDPB Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU - US Data Privacy Framework, adopted on 28 February 2023, p. 5. Adopted 13 effectively function in practice. The PCLOB’s representatives - namely, the PCLOB’s Chair and three Board Members - , stated during the periodic review that the PCLOB expects to u ndertake its review of the internal policies and procedures in the near term. 28. The EDPB recognizes that the agencies’ policies and procedures have been updated and also published on the website of the Office of the Director of National Intelligence (‘ODNI’) , thus complying with the aforementioned obligation under Section 2(c)(iv) of the EO.

The internal policies and procedures do not and cannot authorize IC elements to deviate from the EO and the sa feguards contained therein. 32. Despite this assurance, the EDPB would like to better understand the nature of such amendments and departures and their possible practical implications. gov/ic - on - the - record - database/results/oversight/1278 - odni - releases - ic - procedures - implementing - new - safeguards - in - executive - order - 14086 , where the policies and procedures are also available. 32 See, for example, Section 1(4) National Security Agency (NSA) Procedures. 33 See, for example, Section G(3) Central Intelligence Agency (CIA) Procedures. Adopted 14 practical examples of such amendments and departures, in order to assess their actual impact on the protection of personal data. It is unclear to the EDPB how, in practice, a deviation from the general rules in policies and procedures of IC agencies would still fulfil the requiremen ts of EO 14086.

35. Hence, the EDPB assumes that the ODNI CLPO, through their capacity in the validation process, would in principle also assess those intelligence priorities that would pursue a covertly added objective. , th e broader notion of "foreign intelligence information" referred to in Section 702 of the Foreign Intelligence Surveillance Act (‘ FISA’), the EDPB stresses the importance of subjecting the possibility of establishing secret objectives to further and indepen dent oversight mechanisms. From discussions with the PCLOB during the periodic review, the EDPB has learned that the PCLOB may be able to review secret updates of the list of legitimate objectives following a request for classified information. The EDPB welcomes this possibility and would like to encourage the PCLOB to consider this issue for future oversight projects. 3 Prior independent authorisation of bulk collection 36. S.

Adopted 15 jurisprudence of the European C ourt of Human Rights (‘ECtHR’), nor for a systematic independent ex post review by a court or an equivalently independent body. 36 37. The first periodic review did not provide any new information or developments that affect the EDPB’s previous analysis in this respect. The EDPB therefore maintains its concern as raised at the time . Moreover, the EDPB considers that recent case law of the ECtHR further supports its standpoint, as the Court has once again emphasized the importance of independent prior authorisatio n of secret surveillance measures. 2 Re - authorisation of Section 702 FISA 38. S. persons who are reasonably believed to be outside of the United States to obtain foreign intelligence information. Due to a “sunset” clause, Section 702 FISA was scheduled to cease having legal effect on 31 December 2023, unless re - authorised by Congress.

On 19 April 2024, Congress passed the Reform Intelligence and Securing America Act (‘RISAA’) 38 , which extends Sectio n 702 FISA for two years from the date of its enactment, introducing several amendments. The EDPB takes positive note of the legislative changes increasing privacy protections, such as the statutory prohibition of “abouts” collection, expedited declassific ation of Foreign Intelligence Surveillance Court (‘FISC’) decisions as well as additional accountability, oversight and reporting requirements, which the Commission’s report on the first periodic review highlights in more detail 39 . This report focuses on th e changes to Section 702 FISA that the EDPB deems to be particularly important for the Decision and that were discussed extensively during the periodic review. 39. 2, the EDPB wis hes to draw attention to some more general issues. e. also after the amendments made by RISAA.

This understanding of the interplay bet ween the EO and the statutory provisions governing the collection of data by the IC was confirmed during the periodic review. As a further general remark, the EDPB regrets that RISAA did not incorporate the PCLOB's recommendation to codify certain safeguar ds of EO 14086 in Section 702 FISA , thus not taking the opportunity to introduce additional safeguards as also previously recommended by the EDPB 40 . In its report on the surveillance programme operated pursuant to Section 702 FISA, released on 28 September 2023, the PCLOB in particular proposed that Congress should codify the twelve legitimate objectives for signals intelligence collection as laid out in EO 14086 41 . The PCLOB elaborated that such codification would align the definition of foreign intelligence in the EO and Section 702 FISA and confer explicit jurisdiction to the FISC to enforce the EO when evaluating Section 702 FISA collection practices.

It would thus allow the FISC to use the standards for foreign intelligence under the EO in FISA - related ru lings and court 36 See EDPB Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate prote ction of personal data under the EU - US Data Privacy Framework, adopted on 28 February 2023, p. 5 and 33, 34. 37 See judgment of the ECtHR of 28 May 2024, Pietrzak and Bychawska - Siniarska and Others v. int/eng#{%22itemid%22:[%22002 - 14333%22]} . gov/bill/118th - congress/house - bill/7888#:~:text=%2F09%2F2024) - ,Reforming%20Intelligence%20and%20Securing%20America%20Act,on%20surveilla nce%20under%20Section% 20702 . 39 COM(2024) 451 final, p. 12 et seq. S. Privacy Shield – First annual Joint Review, p. 3. pdf . Adopted 16 procedures. Against this background, the EDPB invites the Commission to continue monitoring developments with respect to Section 702 FISA, including in the context of its renewal after two years.

“electronic communication service provider” 40. e. the entities that may be required to disclose personal information under Section 702 FISA. In addition to the previous wording, the definition now also covers “ any other service provider who has access to equipment that is being or may be used to transmit or store wire or electronic communications ” 42 . S. business to assist with Section 702 FISA surveillance 43 . 41. S. authorities explained to the EDPB that this amendment stems from a legal dispute before the FISC and the Foreign Intelligence Surveillance Court of Review (‘FISCR’). S. authorities, the objective of extending the notion of ECSP is, in response to said litigation, to include a certain class of companies that was ruled to fall outside the previous definition as interpreted by the FISC and FISCR. S. Department of Justice (‘DoJ’) stressed during the periodic review that the modification, despite its broader wording, was thus merely aimed at addressing the specific scenario encountered in the relevant FISC and FISCR decisions and would only be applied narrowly.

Thus, both RISAA and the draft bill leave secret an element of the legal parameters for Section 702 FISA surveillance. 43. C. § 1881 (b)(4)(E), with exceptions for public accommodation facilities, dwellings, community facilities and food service establishments. pdf. 44 As far as the EDPB understood, this was also due – and the subsequent change effectively meant to address – changes in electronic communications and internet technology since Section 702 FISA was initially passed. pdf. inline. gov/bill/118th-congress/senate-bill/4443/text#toc- H704B2609C40F4870A02125404F3FF3B7. Adopted 17 on clear, precise and accessible rules”. 48 In accordance with the settled case law of the CJEU, any limitation to the right to the protection of personal data must be provided f or by law and the legal basis which permits the interference with such a right must itself define the scope of the limitation to the exercise of the right concerned.

“ foreseeability cannot mean that an individual should be able to foresee when the a uthorities are likely to intercept his communications so that he can adapt his conduct accordingly ” 50 , clear rules on secret surveillance measures are essential to prevent the risks of arbitrariness and abuse where a power vested in the executive is exercis ed in secret. In that sense, the “ law must be sufficiently clear to give citizens an adequate indication as to the circumstances in which and the conditions on which public authorities are empowered to resort to any such measures ” 51 . 44. The EDPB is concerned that the new subset of the ECSP definition as incorporated by RISAA does not, and the envisaged provision of the draft Intelligence Authorisation Act for Fiscal Year 2025 would not meet the requirement of clear, precise and accessible law – both for indivi duals whose personal data may be accessed and for companies now subject to Section 702 FISA.

With regard to the latter, questions also arise in relation to legal remedies against FISA disclosure directives: in particular, the EDPB would welcome clarificati on concerning the information that will be available to those companies now falling within the revised definition and, accordingly, on what basis they would have to decide whether to challenge such a directive before the FISC. Notwithstanding the safeguard s of EO 14086, which, as stated, continue to apply, the current definition of ECSP creates uncertainty about the actual reach of Section 702 FISA surveillance, also considering that the FISC lacks statutory jurisdiction to enforce the EO’s safeguards. 45. In t his context, the EDPB moreover observes that – although the newly inserted subset of the definition may only cover an “extremely small” number of companies – the amount of personal data potentially in scope of a collection under Section 702 FISA could be s ignificantly increased.

For instance, if such limited number of companies processes large volumes of personal data or accounts for a large percentage of the respective market. 46. As already indicated above, the EDPB considers that it is important for the Com mission to follow up on future developments concerning Section 702 FISA, including in particular the application of the broadened ECSP definition in practice. S. Attorney General will report to Congress within 6 months of the entry into force of RISAA on how the new definition of ECSP is being applied in practice. The EDPB would also like to encourage the PCLOB to monitor these developments, bearing in mind that its recent recommendation on the codification of the safeg uards contained in the EO has not been implemented by RISAA. S. privacy reforms. As an independent body, the PCLOB is an essential element of the oversight structure. 2 Changes regarding the role of amici curiae 47.

In addition, RISAA introduced changes regarding the role of the so - called amici curiae before the FISA courts. Amici curiae are non - governmental experts appointed to inform the court about specific legal 48 EDPB Recommendations 02/2020 on the European Essential Guarantees for surveillance measures, adopted on 10 November 2020, p. 8. 49 See judgment of the CJEU of 16 July 2020, Data Protection Commissioner v. Facebook Ireland Limited and Maximillian Schrems, C - 311/18, §§ 174 - 175. See also judgment of the CJEU of 6 October 2020, Privacy International v Secretary of State for Foreign and Commonwealth Affairs and Others, C - 623/17 Privacy International, § 65. 50 ECtHR, Zakharov v. Russia, 4 December 2015, § 229. 51 Idem. Adopted 18 or technical iss ues. As the FISC and FISCR consider FISA applications in secret in the interest of protecting national security, amici curiae serve an important role.

They provide external perspectives before the FISC and FISCR that help address the one - sided nature of th e ex parte proceedings ( meaning the data subject is not a party to the proceedings before the court ). 48. While RISAA positively foresees the routine appointment of an amicus curiae in cases in which a Section 702 FISA certification is at issue, RISAA also imp osed certain limitations to their role. Whereas the former law required that amici curiae had expertise in privacy and civil liberties, intelligence collection, communications technology or other relevant areas, RISAA requires expertise in both privacy and civil liberties and intelligence collection. RISAA also bars amici from raising issues that the court has not asked it to address. Amici curiae are now “ limited to addressing the specific issues identified by the court ” 52 . 49. The EDPB observes that, even if the rationale that might underlie the latter amendment is commendable, namely to improve the efficiency in FISA court proceedings, the principle of fairness and equality of arms behind the legal instrument of amici curiae ca rries significant weight.

Even if, according to the information available to the EDPB, this change could be reversed by pending legislation, the EDPB invites the Commission to monitor future developments and ensure that the ability of the amici curiae to a dvise on the privacy interests of the public is not hampered. 50. Finally, but importantly, the EDPB notes that the aforementioned legislative changes have no impact on the status and role of the special advocates appointed in proceedings before the DPRC. S. authorities have clarified that the relevant provisions of EO 14086, complemented by AG regulation 28 CFR Part 201, are independent from the re - authorisation of Section 702 FISA. 3 Redress mechanism 51. On effective redress, the EDPB recognised in the Opinion significant improvements concerning the then newly established mechanism, especially relating to the powers of the DPRC and its enhanced independence compared to the Ombudsperson under the Privacy Shield.

S. 55. All these developments are decisive steps towards making the redress mechanism operational. The EDPB considers that the elements of the redress mechanism provided for in EO 18046 are in place. At the time of the review, however, no complaint had been filed under the new framework 58 . The redress mechanism had therefore not yet been triggered and put to the test in practice. Also, the annual review of the redress mechanism carried out by the PCLOB pursuant to Section 3(e) of EO 14086 is still pending. The PCLOB confirmed that the Board plans to start the review process soon. In the absence of complaints at the time of the review, the review focussed on the set-up of the mechanism in accordance with the legal requirements. It is against this background that the EDPB wishes to renew its call to the Commission to monitor the practical functioning of the different safeguards designed to ensure an essentially equivalent level of protection based on Article 47 of the Charter.

Recently, there has also been increased media coverage of personal data for sale and resulting risks for both individual privacy rights and national security interests. It is clear that the volume and sensitivity of commercially available data have expanded over the past years due to the advancement of digital technology, including location tracking of smartphones and other devices as well as data collection for advertising purposes when using online services. It is also clear that such information can provide critical intelligence value. The EDPB believes this form of government access to personal data raises a number of privacy concerns. For the purposes of this report on the first periodic review of the DPF, the ED PB wishes to make the following observations. 59. S. S. intelligence agencies does not fall under EO 14086, as the EO’s scope is limited to signals intelligence activi ties.

Consequently, the safeguards provided in the EO, including the redress mechanism, are not applicable to other forms of government access to personal data. S. authorities explained that there is nevertheless a legal framework establishing standards for how intelligence agencies acquire and use commercially available information, including Executive Order 12333 and a binding Intelligence Community Policy Framework 61 recently issued by the ODNI (the Policy Framework). 60. gov/opa/pr/attorney - general - merrick - b - garland - announces - judges - data - protection - review - court . 60 See Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU - US Data Privacy Framework, adopted on 28 February 2023, p. 5 and 52. According to Section 3(d)(i)(H) of EO 14086, t he Data Protection Review Court shall inform the complainant that “the review either did not identify any covered violations or the Data Protection Review Court issued a determination requiring appropriate remediation”.

The framework further provides that agencies must assess the original source and quality of the data, manage and periodically review their implementation of safeguards, and provide appropriate transparency to the public and relevant oversight entities on their policies and procedures. Without assessing the Policy Framework in detail, the EDPB observes that it sets out several strong standards reflecting priva cy interests. However, unlike EO 14086, it does not provide for the principles of necessity and proportionality, nor does it address legal remedies. S. persons. With regard to Executive Order 12333, the EDPB recalls the findings of the CJEU in its Schrems II decision, according to which Executive Order 12333 does not provide an essentially equivalent level of protection. Overall, the acquisition o f commercially available data appears to be less strictly regulated than government access to data through signals intelligence activities.

62. The EDPB considers this does not constitute a shortcoming of EO 14086, precisely because this form of data collecti on and processing is outside its scope. However, the acquisition by intelligence agencies of commercially available data could have the effect of EO 14086 and its safeguards being circumvented and thus practically watered down or undermined. From this pers pective, the commercial acquisition of personal data by the IC and its practical use cases should be further assessed and monitored by the Commission. e. including with regard to the possibility of this particular form of government access. In this respect, the Commission’s report on the periodic review refers to the Accountability for Onward Transfer Principle of the DPF, which self - certified organizations must comp ly with 64 . While it is true that the Accountability for Onward Transfer Principle is applicable in the case at hand, the EDPB considers that how this Principle is observed in practice in this specific context requires attention by the Commission .

In particu lar, in the present scenario, it may be challenging to contractually require the third party to provide the same level of protection as the one guaranteed by the DPF. 63. The EDPB considers a report by the PCLOB on this issue particularly important, as it coul d provide recommendations on how the acquisition of commercially available personal data by intelligence agencies could be further addressed from a regulatory perspective. The EDPB positively notes that these matters are on the agenda of the PCLOB, as its representatives informed the EDPB during the periodic review. S. Federal Bureau of Investigation’s use of data purchases 65 . 62 Idem, p. 1. 63 Idem, p. 2. 64 COM(2024) 451 final, p. 16. gov/OversightProjects . Adopted 22 4 CONCLUSIONS & RECOMM ENDATIONS 64. S. authorities and the Commission to implement the DPF, especially in relation to the redress avenues for EU individuals under the DPF Principles , as well as the appointments of the DPRC judges and special advoca tes.

However, the EDPB still has identified during the first periodic review a number of points for additional clarifications, for attention or for concern. 65. Concerning the commercial aspects of the DPF, given that the certification process under the DPF generally seems to be running smoothly, the EDPB would expect the DoC to increase in the near future its ex officio oversight and structural enforcement action s as regards the substantial compliance of certified organizations with all DPF Principles. The Principles have remained largely unchanged compared to the Privacy Shield, and the need for more oversight activity in this area was previously identified by th e Commission and the EDPB during the Joint Reviews of the Privacy Shield. The first periodic review of the DPF also points to a lack of monitoring activities in what concerns substantive compliance with the Principles. The need for proactive compliance mon itoring becomes particularly clear in light of the very low number of complaints received in the first year of the DPF.

The EDPB stresses the need for the Commission to carefully monitor this aspect, including in future reviews of the DPF. 66. Moreover, the EDPB would like to incentivise the DoC to work on and publish practical guidance on the Accountability for Onward Transfer Principle of the DPF. The EDPB is concerned that some DPF - certified companies may not be aware of the requirements for lawful transfe rs of personal data they have received from EU exporters to third countries that have not been considered adequate by the Commission under Article 45 GDPR. The EDPB also believes that there is a need to settle the longstanding divergence in interpretation between EU and US authorities of the notion of ‘HR Data’ under the DPF, which has important practical consequences. Therefore, the EDPB equally encourages the DoC to swiftly develop guidance on this matter that acknowledges the broad definition of HR Data under the DPF and that lays out practical examples where HR Data would be processed under the DPF , explaining for each scenario which DPF obligations would be relevant.

68. The EDPB regrets that RISAA did not incorporate the PCLOB’s recommendation to codify certain safeguards of the Executive Order in Section 702 FISA, thus not taking the opportunity to introduce additional safeguards as also previously recom mended by the EDPB. The EDPB is concerned that the amendment to the definition of Electronic Communication Service Provider does not meet the requirement of clear, precise and accessible law – both for individuals whose personal data may be Adopted 23 accessed and fo r companies now subject to Section 702 FISA. The EDPB considers that it is important for the Commission to follow up on future developments concerning Section 702 FISA, including in particular the application of the broadened definition of Electronic Commu nication Service Provider in practice. The EDPB would also like to encourage the PCLOB to monitor these developments. 69. S. intelligence agencies from data brokers and other commercial entities that is not captured by EO 14086.

The Commission should further assess and monitor this particular form of government access and its practical use cases. 70. The EDPB take s note of the suggestion of the Commission to carry out the next periodic review of the Decision after three years 66 , and welcomes that the European Commission is therefore not proposing to apply the statutory maximum period of four years. This is due to th e fact that there are numerous important aspects of the Decision and the implementation of the DPF that the EDPB has recommended the Commission to closely monitor. A review within three years or less would allow the Commission and the EDPB to more swiftly obtain comprehensive information about the practical application of the DPF, notably in what concerns the monitoring by the DoC and the FTC of substantial compliance of certified organizations with all DPF Principles. During that period, authorities in the EU and US may also gather more experience with handling complaints from individuals under the DPF, both on the commercial and on the government access to data sides.

Lastly, the EDPB notes that the next re - authorisation of Section 702 FISA is due in two y ears, and that it would be important for the European Commission and the EDPB to take stock of a possible re - authorisation shortly after it occurs. This is particularly relevant given the broadening of the entities covered by FISA 702 requests in the lates t re - authorisation. The EDPB looks forward to the consultation from the European Commission in accordance with Article 3(4) of the Decision on the periodicity of future reviews of the Decision. For the European Data Protection Board The Chair (Anu Talus ) 66 COM(2024) 451 final, p. 21.