Redress and U.S. Constitutional Constraints
Explore the intersection of redress and U.S. constitutional constraints within the Data Privacy Framework, addressing issues of standing, independence, foreign affairs, and national security. Proposals for individual redress mechanisms, including the role of the Data Protection Review Court, are discussed in the context of EU/US adequacy negotiations.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Redress and U.S. Constitutional Constraints Peter Swire JZ Liang Chair, College of Computing, Georgia Tech Transatlantic Data Transfers Max Planck Institute Luxembourg September 15, 2023
Overview U.S. Constitutional Constraints Relevant to the DPF Rule of law in the EU and U.S. Many non-EU lawyers have learned a great deal about EU fundamental rights law, such as in the Schrems cases With Data Privacy Framework, reasons for EU lawyers to learn more about U.S. constitutional constraints 3 U.S. constitutional constraints, with recent U.S. Supreme Court cases Standing Independence Foreign affairs & national security
The long and winding road to a redress proposal Schrems II (July 2020) Propp & Swire, After Schrems II: A Proposal to Meet the Individual Redress Challenge (August 2020) Swire, Statutory and Non-Statutory Ways to Create Individual Redress for U.S. Surveillance Activities US Senate Commerce testimony (December 2020) But, EO 12333 (international collection) issues do not go to the Foreign Intelligence Surveillance Court Respond to public and private comments Christakis, Propp & Swire, EU/US Adequacy Negotiations and the Redress Challenge: Whether a New U.S. Statute is Necessary to Produce an Essentially Equivalent Solution (January 2022) Christakis, Propp & Swire, EU/US Adequacy Negotiations and the Redress Challenge: How to Create an Independent Authority with Effective Remedy Powers (February 2022) After Biden EO, C/P/S The redress mechanism in the Privacy Shield successor: On the independence and effective powers of the Data Protection Review Court EU Commission draft adequacy decision, 12/22 EDPB (mostly) approved the redress approach, 3/23 EU Commission final adequacy decision, 7/23
New Redress Procedure Data subject in the EU makes complaint to data protection authority Complaint goes to Civil Liberties and Privacy Officer in the Office of the U.S. Director of National Intelligence Thorough investigation, can direct all intelligence agencies to comply Appeal to the new Data Protection Review Court created by a U.S. Department of Justice regulation DPRC has independent authority to add to the investigation DPRC makes independent judgment, binding on all intelligence agencies E.g., to correct or delete records about the individual Independent advocate participates in front of the DPRC, on behalf of data subject Once decision is complete, and any correction/deletion made, the individual is told We have investigated and either there was no violation or the violation has been corrected. This neither confirm nor deny approach is the practice for EU intelligence agency redress
U.S. Constitutional Constraints Relevant to the Data Privacy Framework Part 1: Standing and access to U.S. federal courts Art. 47 Charter: individual right to an effective remedy before an independent and impartial tribunal One proposed solution: redress claims decided by U.S. federal courts U.S. constitutional constraint: standing and Article III DPF solution: independent adjudication, but not in Article III courts
U.S. standing doctrine Article III of U.S. constitution permits federal courts only to hear cases or controversies Injury-in-fact is a required element to be a case or controversy Ramirez v. Trans-Union (2021), Claim under a statute (Fair Credit Reporting Act), right to sue for inaccurate credit history Facts thousands were erroneously listed as being on the terrorist watch list Held, injury in fact for those who had this error communicated to third parties Held, no injury in fact (no standing) for those where the mistake was in the individual s credit history, but no such communication to third parties Summary: Constitutional requirement of standing to sue in U.S. courts Even a violation of the statute not enough to create injury in fact
Possible to fix the lack of standing? My conclusion there is no proposal I have seen that fixes the standing problem and enables redress claims to be filed in U.S. federal court One proposal by the ACLU Individuals who have taken steps to avoid government surveillance suffer an injury On this approach, perhaps those individuals can sue if a legal violation However, Art. 47 requires every individual to have a remedy before the tribunal Most people in the EU have not taken the required steps to avoid surveillance Therefore, the ACLU proposal does not meet EU legal requirements DPF solution: Create a new tribunal by actions of the President and the Attorney General Redress claim available to every individual
Part 2: Is a New Statute Needed? Christakis, Propp, Swire: EU/US Adequacy Negotiations and the Redress Challenge: Whether a New U.S. Statute is Necessary to Produce an Essentially Equivalent Solution (Jan. 2022) Article 13 of the ECHR requires an effective remedy for rights violations Article 47 of the Charter requires an effective remedy and a hearing must be by an independent and impartial tribunal previously established by law If there is a statute, the tribunal is established by law Can a tribunal be established by law without a statute passed by the legislature? Our article documents EU legal reasons for saying that it can Two apparent constraints on the role of a statute for redress Part 2A: U.S. constitutional limits on creating independence by statute Part 2B: U.S. constitutional limits on Congress power (competence) over national security/foreign affairs DPF solution Part 2A: create independent tribunal by Dept. of Justice regulation Part 2B: create binding effect of the tribunal on agencies by Executive Order, where the President binds agencies to follow the legal requirements of the EO
Part 2A: Independence of tribunal Limits on Congress power to create independent tribunals U.S. v. Arthrex (2021) Statute created patent judges, independent of the Patent Office or the Secretary of Commerce Held unconstitutional Executive branch decision must have recourse to a politically accountable official An example of the unified executive approach taken by this Supreme Court The puzzle how to create an independent tribunal with recourse to a politically accountable official The DPF answer the officials (President, Attorney General) voluntarily yield some of their discretion/power, in a legally binding way
Part 2A: Independence of Tribunal The DPF answer the officials (President, Attorney General) voluntarily yield some of their discretion/power Attorney general issues regulation, yielding his discretionary power to the Data Protection Review Court President issues EO, yielding his power to the binding decisions of the DPRC Note they can take back their power, but EU would have notice and cancel an adequacy decision Supreme Court precedent for this discretionary-yet-binding yielding of power U.S. v. Nixon DOJ regulation by AG, giving powers to independent prosecutor AG and President objected to a subpoena Supreme Court upheld the subpoena independence existed so long as the regulation was in effect U.S. v. Accardi DOJ regulation by AG, giving powers to immigration court AG tried to overturn a deportation decision Supreme Court upheld the regulation and decision of the immigration court DPF answer: Independence of DPRC is based on established U.S. legal doctrines
Part 2B: Role of President for Foreign Affairs & National Security EU law Schrems II says EO 12,333 must be included in redress One proposed solution: new statute for EO 12,333 surveillance U.S. constitutional constraint: President s unique competence for foreign affairs and national security DPF solution: Biden s new EO provides redress for EO 12,333 surveillance
Part 2B: Role of President for Foreign Affairs & National Security (2) Whether collection is in the U.S. FISA 702 collection is done within the U.S. Important Congressional role in drafting statute EO 12,333 collection is done outside of the U.S. Long history of Presidential discretion, and Congress not writing a statute Zivotofsky v. Perry (2015) Congress passed statute on details of foreign affairs, recognition of countries Held unconstitutional the President has that power Conclusion: Constitutionality of redress for EO 12,333 is clear under an Executive Order With current Supreme Court, substantial doubt about a statute
Conclusion on Redress To date, EU courts have not found the constitution of a third state to violate requirements of EU law (including data protection law) There are serious U.S. constitutional constraints on how to build the redress system required by EU law The Data Privacy Framework provides redress, respecting the substance of EU fundamental rights protections To the extent the form of the legal institutions differs, then that becomes the issue of essential equivalence under EU law There is literally no other published approach to redress that meets the requirements of both EU fundamental rights law and U.S. constitutional law If this approach to redress is struck down in Schrems III , that may be equivalent to saying the U.S. must amend its constitution to have data flows with the EU But, adequacy decisions for South Korea, Japan, and the United Kingdom have recognized the possibility of different legal frameworks in other rule of law democracies
