The New Trans-Atlantic Data Privacy Framework Is Not Enough

On Oct. 7, the Biden administration released a new executive order, “United States and European Commission Announce Trans-Atlantic Data Privacy Framework.” Long awaited, this order sets some rules around government surveillance and consumer privacy between the U.S. and the European Union. It implicates critical issues such as legal standards for terrorist investigations globally and carves out another “privacy shield” for the United States, which has unique privacy laws by comparison to developed countries around the world. This order, while an important start, raises more issues than it answers, however. It marks a revitalization of information policy that could go much further in addressing vital issues both home and abroad.

In the area of government surveillance alone, five principal issues emerge from this order.

1. The distinction between a U.S. person, i.e. anyone in in the U.S. versus noncitizens outside the U.S. in international government surveillance;
2. The need for a reworking of the technical specifications that undergird the integrity of Fourth Amendment communications law;
3. A renewed critique of the Foreign Intelligence Surveillance Act (FISA) with an eye toward revoking “secret courts”;
4. Reform of our grossly antiquated wiretapping law, the Electronic Communications Privacy Act (ECPA); and the
5. Harmonization of government surveillance standards among democratic countries.

The first one should be a relatively simple fix. In the aftermath of Russia’s invasion of Ukraine, the United States and democratic countries (led by the E.U.) should agree on government surveillance principles. That agreement would end legal distinctions between U.S. and non-U.S. persons that complicate information sharing and could generate a more trusted relationship with our allies.

Outdated standards that map technology to the law must be revised. Internet protocols antiquated the old, telephony-based distinctions between “call records” and “content” embedded in midcentury wiretapping acts. The USA–Patriot Act further exploited that problem, the effect of which was to throw civil rights and government surveillance out of balance. Probable cause and judicial overview remains a sound legal standard. How law enforcement meets that standard in electronic communications requires a deeper consideration on how the internet, not telephones, operates. Data scientists might well be consulted extensively with statutory framers to synchronize the law with 21st-century communication technologies.

FISA and its secret courts should be abolished. Secret courts belie democratic values. Moreover, abolition of that law could occur in combination with the first issue. Extending search and seizure rights in electronic communications to non-U.S. persons in democratic countries would level the legal playing field, closing the Fourth Amendment gap that FISA creates for U.S. persons and generate an international foundation for due process. In our country, Title III criminal procedure can be amended to accommodate the confidentiality required for ongoing investigations. It is time to vanquish this troublesome law and its legal tactics that undermine Fourth Amendment protections and stoke potential abuse of our civil rights.

Congress passed the Electronic Communications Privacy Act of 1986—seven years before the internet was even public! The misalignment between technology and Fourth Amendment electronic communications law noted above is deeply embedded in it. Members of Congress who do not want to reveal how inadequate they are in making sense of the relationship between technology and the law have long avoided meaningful revision of this law. Reworking of legal and technical standards on the international stage would immediately implicate the need to fix our own domestic wiretapping law.

Finally, the United States needs its democratic allies. Russia’s invasion of Ukraine and China’s saber-rattling over Taiwan underscore the importance of democratic countries working together at many levels. In the area of government surveillance, harmonized legal standards and processes among democratic countries would be a great start toward building the quality of allegiance necessary to counteract powerful and belligerent nondemocratic countries. This process would also put the United States on a better trajectory in keeping with its democratic principles domestically.

After an administration that failed to respect our democratic allies and allowed rules around data transfer to languish, the Oct. 7 executive order should be regarded as an important improvement in international information policy. But it is equally vital that we recognize this order is a start and not the conclusion to myriad concerns around both government surveillance and consumer privacy. About government surveillance, this order at least acknowledges the significance of data in a global economy and the need for agreements in the international surveillance landscape. It is an opportunity to update our own communication laws, reset the balance between civil rights and national security, and demonstrate to the world that the United States can still be a leader in setting standards that honor our common humanity.