Redress and U.S. Constitutional Constraints
Redress and U.S. Constitutional
Constraints
Peter Swire
JZ Liang Chair, College of Computing, Georgia Tech
Transatlantic Data Transfers
Max Planck Institute Luxembourg
September 15, 2023
•
U.S. Constitutional Constraints Relevant to the DPF
•
Rule of law
in the EU and U.S.
•
Many non-EU lawyers have learned a great deal
about EU fundamental rights
law, such as
in the Schrems cases
•
With
Data Privacy Framework
, reasons for EU lawyers to learn more about
U.S.
constitutional constraints
•
3 U.S. constitutional constraints, with recent U.S. Supreme Court cases
•
Standing
•
Independence
•
Foreign affairs & national security
Overview
•
Schrems II (July 2020)
•
Propp & Swire, “After Schrems II: A Proposal to Meet the Individual Redress Challenge” (August 2020)
•
Swire, “Statutory and Non-Statutory Ways to Create Individual Redress for U.S. Surveillance Activities”
US Senate Commerce testimony (December 2020)
•
But,
EO 12333
(international collection)
issues do not go to the Foreign Intelligence Surveillance
Court
•
Respond to public and private comments
•
Christakis, Propp & Swire, “EU/US Adequacy Negotiations and the Redress Challenge: Whether
a New
U.S. Statute
is Necessary to Produce an ‘Essentially Equivalent’ Solution” (January 2022)
•
Christakis, Propp & Swire, “EU/US Adequacy Negotiations and the Redress Challenge: How to
Create an
Independent Authority with Effective Remedy Powers
” (February 2022)
•
After Biden EO, C/P/S “The redress mechanism in the Privacy Shield successor: On the independence
and effective powers of the Data Protection Review Court”
•
EU Commission draft adequacy decision, 12/22
•
EDPB (mostly) approved the redress approach, 3/23
•
EU Commission final adequacy decision, 7/23
The long and winding road to a redress proposal
•
Data subject in the EU makes
complaint to data protection authority
•
Complaint goes to
Civil Liberties and Privacy Officer
in the Office of the U.S. Director of National
Intelligence
•
Thorough investigation, can direct all intelligence agencies to comply
•
Appeal to the new
Data Protection Review Court
created by a U.S. Department of Justice
regulation
•
DPRC has independent authority to add to the investigation
•
DPRC makes
independent judgment, binding
on all intelligence agencies
•
E.g., to correct or delete records about the individual
•
Independent advocate
participates in front of the DPRC, on behalf of data subject
•
Once decision is complete, and any correction/deletion made,
the individual is told
“We have
investigated and either there was no violation or the violation has been corrected.
•
This “neither confirm nor deny” approach is the practice for EU intelligence agency redress
New Redress Procedure
•
Part 1: Standing and access to U.S. federal courts
•
Art. 47 Charter: individual right to an effective remedy before “
an independent and
impartial tribunal
”
•
One proposed solution: redress claims decided by U.S. federal courts
•
U.S. constitutional constraint: standing and Article III
•
DPF solution: independent adjudication, but not in Article III courts
U.S. Constitutional Constraints Relevant to the Data
Privacy Framework
•
Article III of U.S. constitution permits federal courts only to hear
“cases” or
“controversies”
•
“Injury-in-fact” is a required element
to be a case or controversy
•
Ramirez v. Trans-Union
(2021),
•
Claim under a statute (Fair Credit Reporting Act), right to sue for inaccurate credit
history
•
Facts – thousands were erroneously listed as being on the “terrorist watch list”
•
Held, injury in fact for those who had this error communicated to third parties
•
Held,
no injury in fact
(no standing) for those where the mistake was in the
individual’s credit history, but no such communication to third parties
•
Summary:
•
Constitutional requirement of standing to sue in U.S. courts
•
Even a violation of the statute not enough to create “injury in fact”
U.S. standing doctrine
•
My conclusion –
there is no proposal I have seen that “fixes” the standing problem and enables
redress claims to be filed in U.S. federal court
•
One proposal by the ACLU
•
Individuals who have
taken steps to avoid
government surveillance suffer an injury
•
On this approach, perhaps those individuals can sue if a legal violation
•
However, Art. 47 requires
every individual
to have a remedy before the tribunal
•
Most people in the EU have not taken the required steps to avoid surveillance
•
Therefore, the ACLU proposal does not meet EU legal requirements
•
DPF solution:
•
Create a new tribunal
by actions of the President and the Attorney General
•
Redress claim available to
every individual
Possible to ”fix” the lack of standing?
•
Christakis, Propp, Swire: “EU/US Adequacy Negotiations and the Redress Challenge:
Whether a
New U.S. Statute is Necessary
to Produce an “Essentially Equivalent” Solution” (Jan. 2022)
•
Article 13 of the ECHR requires “an effective remedy” for rights violations
•
Article 47 of the Charter requires “an effective remedy” and a hearing must be “by an independent
and impartial tribunal previously established by law”
•
If there is a statute, the tribunal is “established by law”
•
Can a tribunal be “established by law” without a statute passed by the legislature?
•
Our article documents EU legal reasons for saying that it can
•
Two apparent
constraints on the role of a statute
for redress
•
Part 2A: U.S. constitutional limits on creating “independence” by statute
•
Part 2B: U.S. constitutional limits on Congress’ power (competence) over national
security/foreign affairs
•
DPF solution
•
Part 2A: create independent tribunal by
Dept. of Justice regulation
•
Part 2B: create binding effect of the tribunal on agencies by
Executive Order
, where the
President binds agencies to follow the legal requirements of the EO
Part 2: Is a New Statute Needed?
•
Limits on Congress’ power to create independent tribunals
•
U.S. v. Arthrex
(2021)
•
Statute created patent judges, independent of the Patent Office or the Secretary of
Commerce
•
Held unconstitutional
•
Executive branch decision must have recourse to a “politically accountable official”
•
An example of the “unified executive” approach taken by this Supreme Court
•
The puzzle
– how to create an “independent tribunal” with recourse to a “politically accountable
official”
•
The DPF answer
– the
officials
(President, Attorney General)
voluntarily yield some of their
discretion/power
, in a legally binding way
Part 2A: Independence of tribunal
•
The DPF answer
– the
officials
(President, Attorney General)
voluntarily yield some of their
discretion/power
•
Attorney general issues regulation, yielding his discretionary power to the Data Protection
Review Court
•
President issues EO, yielding his power to the binding decisions of the DPRC
•
Note – they can take back their power, but EU would have notice and cancel an adequacy
decision
•
Supreme Court precedent
for this discretionary-yet-binding yielding of power
•
U.S. v. Nixon
– DOJ regulation by AG, giving powers to independent prosecutor
•
AG and President objected to a subpoena
•
Supreme Court upheld the subpoena
– independence existed so long as the regulation
was in effect
•
U.S. v. Accardi
– DOJ regulation by AG, giving powers to immigration court
•
AG tried to overturn a deportation decision
•
Supreme Court upheld
the regulation and
decision of the immigration court
•
DPF answer: Independence of DPRC is based on established U.S. legal doctrines
Part 2A: Independence of Tribunal
•
EU law –
Schrems II
says EO 12,333 must be included in redress
•
One proposed solution:
new statute
for EO 12,333 surveillance
•
U.S. constitutional constraint:
President’s unique competence
for foreign affairs and
national security
•
DPF solution:
Biden’s new EO provides redress
for EO 12,333 surveillance
Part 2B: Role of President for Foreign Affairs & National
Security
•
Whether collection is in the U.S.
•
FISA 702
collection is done
within the U.S.
•
Important Congressional role in drafting statute
•
EO 12,333
collection is done
outside of the U.S.
•
Long history of Presidential discretion, and Congress not writing a statute
•
Zivotofsky v. Perry
(2015)
•
Congress passed statute on details of foreign affairs, recognition of countries
•
Held unconstitutional
– the President has that power
Conclusion:
•
Constitutionality
of redress for EO 12,333
is clear
under an Executive Order
•
With current Supreme Court, substantial doubt about a statute
Part 2B: Role of President for Foreign Affairs & National
Security (2)
•
To date,
EU courts have not
found the constitution of a third state to violate requirements of EU
law (including data protection law)
•
There are
serious U.S. constitutional constraints
on how to build the redress system required by
EU law
•
The Data Privacy Framework provides redress, respecting the
substance
of EU fundamental
rights protections
•
To the extent the
form
of the legal institutions
differs
, then that becomes the issue of
“essential equivalence” under EU law
•
There is literally
no other published approach to redress
that meets the requirements of both
EU fundamental rights law and U.S. constitutional law
•
If this approach to redress is struck down in “Schrems III”, that may be equivalent to saying
the U.S. must amend its constitution to have data flows with the EU
•
But, ”adequacy” decisions for South Korea, Japan, and the United Kingdom have
recognized the possibility of different legal frameworks in other rule of law democracies
Conclusion on Redress
Explore the intersection of redress and U.S. constitutional constraints within the Data Privacy Framework, addressing issues of standing, independence, foreign affairs, and national security. Proposals for individual redress mechanisms, including the role of the Data Protection Review Court, are discussed in the context of EU/US adequacy negotiations.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Redress and U.S. Constitutional Constraints Peter Swire JZ Liang Chair, College of Computing, Georgia Tech Transatlantic Data Transfers Max Planck Institute Luxembourg September 15, 2023
Overview U.S. Constitutional Constraints Relevant to the DPF Rule of law in the EU and U.S. Many non-EU lawyers have learned a great deal about EU fundamental rights law, such as in the Schrems cases With Data Privacy Framework, reasons for EU lawyers to learn more about U.S. constitutional constraints 3 U.S. constitutional constraints, with recent U.S. Supreme Court cases Standing Independence Foreign affairs & national security
The long and winding road to a redress proposal Schrems II (July 2020) Propp & Swire, After Schrems II: A Proposal to Meet the Individual Redress Challenge (August 2020) Swire, Statutory and Non-Statutory Ways to Create Individual Redress for U.S. Surveillance Activities US Senate Commerce testimony (December 2020) But, EO 12333 (international collection) issues do not go to the Foreign Intelligence Surveillance Court Respond to public and private comments Christakis, Propp & Swire, EU/US Adequacy Negotiations and the Redress Challenge: Whether a New U.S. Statute is Necessary to Produce an Essentially Equivalent Solution (January 2022) Christakis, Propp & Swire, EU/US Adequacy Negotiations and the Redress Challenge: How to Create an Independent Authority with Effective Remedy Powers (February 2022) After Biden EO, C/P/S The redress mechanism in the Privacy Shield successor: On the independence and effective powers of the Data Protection Review Court EU Commission draft adequacy decision, 12/22 EDPB (mostly) approved the redress approach, 3/23 EU Commission final adequacy decision, 7/23
New Redress Procedure Data subject in the EU makes complaint to data protection authority Complaint goes to Civil Liberties and Privacy Officer in the Office of the U.S. Director of National Intelligence Thorough investigation, can direct all intelligence agencies to comply Appeal to the new Data Protection Review Court created by a U.S. Department of Justice regulation DPRC has independent authority to add to the investigation DPRC makes independent judgment, binding on all intelligence agencies E.g., to correct or delete records about the individual Independent advocate participates in front of the DPRC, on behalf of data subject Once decision is complete, and any correction/deletion made, the individual is told We have investigated and either there was no violation or the violation has been corrected. This neither confirm nor deny approach is the practice for EU intelligence agency redress
U.S. Constitutional Constraints Relevant to the Data Privacy Framework Part 1: Standing and access to U.S. federal courts Art. 47 Charter: individual right to an effective remedy before an independent and impartial tribunal One proposed solution: redress claims decided by U.S. federal courts U.S. constitutional constraint: standing and Article III DPF solution: independent adjudication, but not in Article III courts
U.S. standing doctrine Article III of U.S. constitution permits federal courts only to hear cases or controversies Injury-in-fact is a required element to be a case or controversy Ramirez v. Trans-Union (2021), Claim under a statute (Fair Credit Reporting Act), right to sue for inaccurate credit history Facts thousands were erroneously listed as being on the terrorist watch list Held, injury in fact for those who had this error communicated to third parties Held, no injury in fact (no standing) for those where the mistake was in the individual s credit history, but no such communication to third parties Summary: Constitutional requirement of standing to sue in U.S. courts Even a violation of the statute not enough to create injury in fact
Possible to fix the lack of standing? My conclusion there is no proposal I have seen that fixes the standing problem and enables redress claims to be filed in U.S. federal court One proposal by the ACLU Individuals who have taken steps to avoid government surveillance suffer an injury On this approach, perhaps those individuals can sue if a legal violation However, Art. 47 requires every individual to have a remedy before the tribunal Most people in the EU have not taken the required steps to avoid surveillance Therefore, the ACLU proposal does not meet EU legal requirements DPF solution: Create a new tribunal by actions of the President and the Attorney General Redress claim available to every individual
Part 2: Is a New Statute Needed? Christakis, Propp, Swire: EU/US Adequacy Negotiations and the Redress Challenge: Whether a New U.S. Statute is Necessary to Produce an Essentially Equivalent Solution (Jan. 2022) Article 13 of the ECHR requires an effective remedy for rights violations Article 47 of the Charter requires an effective remedy and a hearing must be by an independent and impartial tribunal previously established by law If there is a statute, the tribunal is established by law Can a tribunal be established by law without a statute passed by the legislature? Our article documents EU legal reasons for saying that it can Two apparent constraints on the role of a statute for redress Part 2A: U.S. constitutional limits on creating independence by statute Part 2B: U.S. constitutional limits on Congress power (competence) over national security/foreign affairs DPF solution Part 2A: create independent tribunal by Dept. of Justice regulation Part 2B: create binding effect of the tribunal on agencies by Executive Order, where the President binds agencies to follow the legal requirements of the EO
Part 2A: Independence of tribunal Limits on Congress power to create independent tribunals U.S. v. Arthrex (2021) Statute created patent judges, independent of the Patent Office or the Secretary of Commerce Held unconstitutional Executive branch decision must have recourse to a politically accountable official An example of the unified executive approach taken by this Supreme Court The puzzle how to create an independent tribunal with recourse to a politically accountable official The DPF answer the officials (President, Attorney General) voluntarily yield some of their discretion/power, in a legally binding way
Part 2A: Independence of Tribunal The DPF answer the officials (President, Attorney General) voluntarily yield some of their discretion/power Attorney general issues regulation, yielding his discretionary power to the Data Protection Review Court President issues EO, yielding his power to the binding decisions of the DPRC Note they can take back their power, but EU would have notice and cancel an adequacy decision Supreme Court precedent for this discretionary-yet-binding yielding of power U.S. v. Nixon DOJ regulation by AG, giving powers to independent prosecutor AG and President objected to a subpoena Supreme Court upheld the subpoena independence existed so long as the regulation was in effect U.S. v. Accardi DOJ regulation by AG, giving powers to immigration court AG tried to overturn a deportation decision Supreme Court upheld the regulation and decision of the immigration court DPF answer: Independence of DPRC is based on established U.S. legal doctrines
Part 2B: Role of President for Foreign Affairs & National Security EU law Schrems II says EO 12,333 must be included in redress One proposed solution: new statute for EO 12,333 surveillance U.S. constitutional constraint: President s unique competence for foreign affairs and national security DPF solution: Biden s new EO provides redress for EO 12,333 surveillance
Part 2B: Role of President for Foreign Affairs & National Security (2) Whether collection is in the U.S. FISA 702 collection is done within the U.S. Important Congressional role in drafting statute EO 12,333 collection is done outside of the U.S. Long history of Presidential discretion, and Congress not writing a statute Zivotofsky v. Perry (2015) Congress passed statute on details of foreign affairs, recognition of countries Held unconstitutional the President has that power Conclusion: Constitutionality of redress for EO 12,333 is clear under an Executive Order With current Supreme Court, substantial doubt about a statute
Conclusion on Redress To date, EU courts have not found the constitution of a third state to violate requirements of EU law (including data protection law) There are serious U.S. constitutional constraints on how to build the redress system required by EU law The Data Privacy Framework provides redress, respecting the substance of EU fundamental rights protections To the extent the form of the legal institutions differs, then that becomes the issue of essential equivalence under EU law There is literally no other published approach to redress that meets the requirements of both EU fundamental rights law and U.S. constitutional law If this approach to redress is struck down in Schrems III , that may be equivalent to saying the U.S. must amend its constitution to have data flows with the EU But, adequacy decisions for South Korea, Japan, and the United Kingdom have recognized the possibility of different legal frameworks in other rule of law democracies
