Transfer Impact Assessment
Updated: June 20, 2023
Mersive Technologies, Inc. (branded “Mersive”) is a U.S.-based software company that offers a training enterprise software product. Mersive collects personal data directly from its European customers, and to legalize such data transfers under EU law, Mersive has been executing Standard Contractual Clauses (“SCCs”). However, a recent decision from the European Union Court of Justice (“ECJ”) has called into question the validity of relying on SCCs to transfer data out of Europe. Accordingly, in the wake of this recent decision, Mersive investigated its data transfers and processing activities. Based on its investigation, it considers the risk to European data subjects to be relatively low, and it can likely continue to rely on the SCCs to lawfully transfer data out of the EU for the time being.
After a thorough investigation of its IT infrastructure and security protocols, Mersive determined that it has a number of technical and administrative controls in place that mitigate the risks of European data subjects with respect to U.S. surveillance laws.
On July 16, 2020 the ECJ in Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (“Schrems II”) invalidated Commission Decision 2016/1250 underlying the EU-U.S. Privacy Shield framework, finding that privacy protections in U.S. law relating to intelligence agencies’ access to data does meet EU legal standards. The Court also upheld the SCCs as a lawful basis for transferring personal data from the EU to countries located outside of the EU, but indicated that companies transferring data to the United States under the SCCs are now responsible for undertaking their own independent analyses of all relevant and current U.S. law relating to intelligence agencies’ access to data, as well as the facts and circumstances of data transfers and any applicable safeguards, in assessing whether the data transfers offer adequate protection under EU law.
In Shrems II, the ECJ examined issues stemming from the concern that U.S. intelligence agencies might access transferred data under two U.S. laws: (1) Executive Order 12333 (“EO 12333”), a general directive organizing U.S. intelligence activities, which does not include any authorization to compel private companies to disclose data, and (2) Section 702 of the Foreign Intelligence Surveillance Act (“FISA 702”), a federal statute establishing a judicial process authorizing a specific type of data collection. Pursuant to FISA 702, a court may authorize the government to conduct targeted surveillance of foreigners located outside of the United States, with the required assistance of U.S. electronic communication service providers, to acquire foreign intelligence information. The U.S. government uses the information collected to protect the U.S. from foreign adversaries such as terrorists, weapons proliferators, and spies.
In the wake of Shrems II, the European Data Protection Board (“EDPB”) published guidance outlining the steps to take to assess and protect cross-border data flows in accordance with EU law. An analysis of each of these steps is set forth below.
The Omnibus Crime Control and Safe Streets Act of 1968 (the “Wiretap Act”) prohibits the interception and disclosure of wire, oral and electronic communications, and the manufacture, distribution and possession of such interception devices. Originally the Wiretap Act only applied to oral and wire communications, but the Electronic Communications Privacy Act of 1986 (“ECPA”) broadened the application of the statute by expanding the types of communications to which the statute applied to cover electronic communications.
The Wiretap Act and ECPA require law enforcement authorities to obtain a judicial order authorizing interception of oral, wire, and electronic communications, based on a showing of probable cause that particular communications evidencing one of the crimes covered by the statute (consisting of serious felonies) will be obtained. Such a showing requires a full and complete statement of the facts and circumstances, including details underlying the alleged offense and a description of the nature and location of the facilities or place to be wiretapped, the types of communications to be intercepted, and the persons committing the offense and whose communications are to be intercepted.
Law enforcement authorities must also describe all other investigative techniques that have been tried and failed or explaining why such techniques are likely to be unsuccessful or too dangerous. The court must determine, prior to granting the order, that normal investigative procedures have been or would be unsuccessful or excessively dangerous. The government’s application must also show that the surveillance will be conducted with procedures in place to minimize the interception of communications irrelevant to the investigation.
The Wiretap Act applies to the live interception of communications and the Stored Communications Act (“SCA”) applies to the collection of stored communications maintained by third-party service providers. The SCA generally prohibits the unauthorized access of a facility through which an electronic communication service is provided, and sets forth requirements that law enforcement authorities must meet in order to require a third-party service electronic communications or remote computing service provider to disclose stored electronic communications. The SCA generally requires law enforcement authorities to obtain a search warrant in order to compel such a provider to disclose the contents of stored electronic communications.
FISA establishes the standards and procedures for conducting electronic surveillance for foreign intelligence purposes in the U.S. For foreign intelligence surveillance directed at persons located within the United States, FISA generally requires the government to obtain an order on an individualized basis and demonstrate probable cause, similar to the type of order required under the Wiretap Act, except that instead of showing that there is probable cause to believe that the surveillance will yield evidence of a crime, the government must show probable cause to believe that the target of the surveillance is a foreign power or an agent of a foreign power (which can include a foreign terrorist group).
In 2008, FISA was amended to authorize intelligence authorities to conduct foreign intelligence surveillance of non-U.S. person targets located outside the U.S. by compelling electronic communications service providers to disclose the communications of such a target. This does not require individual warrants issued by the Foreign Intelligence Surveillance Court (“FISC”) because the targets of such surveillance are not U.S. citizens and as such are not protected by the Fourth Amendment of the U.S. Constitution. Nonetheless, the exercise of this authority is subject to multiple layers of oversight from the executive branch, the FISC (which is made up of independent judges), and congressional intelligence committees with multiple levels of internal review and technological controls over access to the data.
EO 12333 was signed by Ronald Reagan in 1981 and was intended to expand the powers and responsibilities of U.S. intelligence agencies and direct the leaders of U.S. federal agencies to fully cooperate with CIA requests for information. Unlike FISA, surveillance under EO 12333 does not rely on the compelled assistance of electronic communications service providers. The technical details remain classified and obscure, but the NSA has confirmed it involves exploiting vulnerabilities in telecommunications infrastructure. Based on reports, there is a high likelihood that the EO 12333 surveillance consists primarily of the NSA and its confederates opportunistically collecting unencrypted data collected from the Internet Backbone. As a result, the use of well-deployed Transport Layer Security (TLS) or IPSec to encrypt data in transit is likely sufficient to defeat this type of collection under EO 12333.
There are controls around how U.S. government agencies can obtain signals intelligence. In 2014, President Obama issued Presidential Policy Directive 28 (PPD-28) which directed US intelligence agencies to review their policies regarding the treatment of non-U.S. persons in connection with signals intelligence programs. Effectively, PPD-28 imposes restrictions on signals intelligence activities, including those conducted under FISA 702 and EO 12333, regardless of the target’s nationality or location. Because of the way in which EO 12333 is used in practice, it appears that it could and may be being used to intercept all data that is coming into the U.S., which could theoretically include personal data transferred to the U.S. by Mersive.
In order for U.S. surveillance measures to be considered to provide an “essentially equivalent” level of protection provided by EU law, they should comply with the following four “European Essential Guarantees”:
(a) Processing should be based on clear, precise and accessible rules
Necessity and proportionality with regard to the legitimate objectives pursued need to be demonstrated
(b) An independent oversight mechanism should exist
(c) Effective remedies need to be available to the individual
The ECJ in Shrems II found that FISA 702 and EO 12333 failed all four of these tests and thus any entity that may be subject to FISA 702 or EO 12333 could not be said to be providing an essentially equivalent level of protection to that found under EU law.
However, a concern the ECJ raised in Schrems II with respect to FISA 702 is whether the FISC supervises whether individuals are properly targeted. However, the FISC is, in fact, actively involved in supervising whether individuals are properly targeted. Under the FISA 702 targeting procedures that are approved annually by the FISC, the National Security Agency (“NSA”) analysts are required to provide a written explanation of their targeting rationale, which is reported to attorneys in the Department of Justice (“DOJ”) for compliance with the applicable legal standards set forth in the targeting procedures. The DOJ is then required to report compliance incidents to the FISC, which can impose remedial action. Accordingly, the FISC does supervise the NSA’s assessments that individuals have been properly targeted for purposes of acquiring foreign intelligence information.
Another concern the ECJ had with FISA 702 in Shrems II was whether U.S. law provides individual redress for violations of FISA 702. Several U.S. statutes authorize individuals (including EU citizens) to seek redress in U.S. courts through civil lawsuits for violations of FISA, including Section 1810 of FISA, Section 2712 of the Electronic Communications Privacy Act (18 U.S.C. § 2712), and Section 702 of the Administrative Procedure Act (5 U.S.C. § 702). Notably, FISA allows anyone who has been subject to surveillance and whose communications are used or disclosed unlawfully to seek damages (both compensatory and punitive) and attorney’s fees, and the Electronic Communications Privacy Act also provides for compensatory damages and attorney’s fees against the U.S. government for willful violations of FISA. Indeed, U.S. courts have reviewed the legality of governmental data collection under FISA in various lawsuits.
Finally, additional privacy safeguards have been added to FISA 702 since the Privacy-Shield framework was first implemented and were therefore not considered by the ECJ in the Shrems II decision. For example, in January 2018 former President Trump signed into law the FISA Amendments Reauthorization Act of 2017 which added additional protections and safeguards with respect to FISA 702.
See U.S. Department of Commerce September 2020 White Paper: Information on U.S. Privacy Safeguards Relevant to SCCs and Other EU Legal Bases for EU-U.S. Data Transfers after Schrems II, https://www.commerce.gov/sites/default/files/2020-09/SCCsWhitePaperFORMATTEDFINAL508COMPLIANT.PDF.
According to the EDPB, subjective factors such as the likelihood of public authorities’ access to a company’s data in a manner not in line with EU standards should not be considered as part of the transfer impact assessment. However, the European Commission appears to believe that these subjective factors should be relevant to the assessment. In line with the European Commission, Mersive takes the position that the assessment of the risks associated with any foreign surveillance law should take into account of subjective factors applicable to the specific transfers in question.
As described above, Mersive provides software services to businesses and the data it collects and transfers across borders is limited to European customer data. Such data is inherently of limited national security value. In addition, Mersive has never received a request from intelligence and security services to provide data in the past, and it is unlikely to have data intercepted by U.S. intelligence based on their nature. Finally, Mersive is much smaller compared to other organizations that appear likely to be subject to FISA 702 (e.g. Facebook, Google, AWS), and as discussed above, Mersive encrypts data in transit and such encryption should withstand any attempt of U.S. government authorities to gain access to it.
Expect updates, guidance, and more
You accept and agree to Mersive’s Privacy Policy.
