Access Alert: US Department of Commerce Publishes White Paper in Response to Schrems II

Access Alert: US Department of Commerce Publishes White Paper in Response to Schrems II

On September 28, in response to the Schrems II ruling, the US Department of Commerce, Department of Justice, & Office of the Director of National Intelligence published a White Paper on the US privacy safeguards relating to intelligence agencies’ access to data. According to Deputy Assistant Secretary James Sullivan, “While the White Paper can help organizations make the case that they should be able to send personal data to the United States using EU-approved transfer mechanisms, it is not intended to provide companies with guidance on EU law or what positions to take before EU regulators or courts.”

The White Paper, Information on US Privacy Safeguards Relevant to Standard Contractual Clauses (SCCs) and Other EU Legal Bases for EU-U.S. Data Transfers after Schrems II, notes that:

  1. Most US companies do not deal with data of any interest to US intelligence agencies and are not engaging in data transfers that present the type of privacy risks raised in Schrems II.
  2. Companies transferring personal data from the EU to the US may choose to rely on SCCs, which the Court of Justice of the European Union expressly upheld in Schrems II, with the caveat that companies determine whether the law of the US ensures adequate protection as afforded under EU law.
  3. The US Foreign Intelligence Surveillance Court’s role in authorizing and supervising Section 702 of the Foreign Intelligence Surveillance Act (FISA) targeting decisions compares favorably with intelligence programs in the EU.
  4. Unlike Section 702 of FISA, however, Executive Order 12333 does not authorize the US government to require any company or person to disclose data. Any requirement that a company in the United States disclose data to the government for intelligence purposes must be authorized by statute and must be targeted at specific persons or identifiers.
  5. Numerous additional privacy safeguards have been added to Section 702 of FISA since Decision 2016/1250, which approved the Privacy Shield framework for US-EU personal data transfers, was issued in July 2016.
  6. Several US statutes authorize individuals of any nationality to seek redress in US courts through civil lawsuits for violations of FISA, including violations of Section 702.

Related Articles

Access Alert: Pioneering Pakistan’s Space Future: PSARB and Access Partnership Host High-Level Week of Engagements in Islamabad

Access Alert: Pioneering Pakistan’s Space Future: PSARB and Access Partnership Host High-Level Week of Engagements in Islamabad

Last week, the Pakistan Space Activities Regulatory Board (PSARB), together with Access Partnership in its role as appointed consultant, organised...

30 Jun 2025 Opinion
Access Alert: CEPT advances innovative spectrum use for IoT satellite connectivity

Access Alert: CEPT advances innovative spectrum use for IoT satellite connectivity

This week, the CEPT has adopted a new decision (ECC/DEC(25)02) that allows for an innovative use of spectrum in Europe,...

27 Jun 2025 Opinion
Access Alert: European Commission Releases Proposal for the EU Space Act

Access Alert: European Commission Releases Proposal for the EU Space Act

On 25 June 2025, the European Commission published its proposal for a new Space Act. The wide-ranging piece of legislation...

26 Jun 2025 Opinion
Access Alert: ANATEL is revising rules around numbering resources and call identification

Access Alert: ANATEL is revising rules around numbering resources and call identification

The National Telecommunications Agency of Brazil (ANATEL) is moving forward with the implementation of Resolution No. 768/2024, which will redefine...

25 Jun 2025 General