A 2016 deal between the U.S. government and the European Union that was meant to ensure the safe transfer of personal data between U.S. and European companies is in danger of falling apart, raising questions about the stability of a quarter of a trillion dollars in cross-Atlantic trade.
At issue is the slow resurrection of a key U.S. watchdog agency charged with making sure companies on both sides are adequately protecting customers' personal data from breaches.
Under the agreement between the two governments known as Privacy Shield, companies such as Google or Twitter must comply with a set of rules to ensure their data is secure when it's being transferred between the two continents. The two governments also play a key role in upholding privacy principles and reviewing consumer complaints.
Privacy Shield was established in 2016 after the European Court of Justice struck down an earlier agreement called Safe Harbor in 2015 as a result of former National Security Agency contractor Edward Snowden's revelations about U.S. electronic surveillance programs.
This new framework sought to bolster protections for Europeans by adding an ombudsperson who would monitor government use of consumer data and coordinate with Europeans on consumer complaints. Privacy Shield also designated an independent watchdog to evaluate concerns referred by the ombudsperson.
And herein lies the problem. The independent, U.S.-based review body, known as the Privacy and Civil Liberties Oversight Board, has been largely dormant for more than a year. And the longer it stays dormant, the more nervous the E.U. becomes.
The five-member board was formed based on legislation passed in 2007, and is charged with upholding civil liberties amid government counterterrorism efforts. Because of Senate confirmation issues, it wasn't fully operational until 2013, and it then briefly played a leading role vetting classified surveillance programs exposed by Snowden.
A White House official said last July, "We are very supportive of the Privacy Shield and are seeking to ensure that these positions are filled as quickly as possible."
Without the PCLOB up and running, there's no independent watchdog available to ensure all the parties are compliant.
The stakes of leaving the board in its current state are high, and the Trump administration knows it, as lawsuits in Europe claim insufficient protections and foreign bureaucrats vet U.S. compliance. The Commerce Department said in a report last year that "[t]his framework is essential to supporting the more than $260 billion in cross-Atlantic digital services trade occurring annually."
In April, the E.U.'s parliament passed a resolution alleging shortcomings with the Privacy Shield, including the board’s “current non-quorate status.”
What's next for the agreement may become clearer in March, when a European Commission delegation returns to the U.S. after having issued a report with 10 compliance recommendations in October. The report requested new legal protections for non-U.S. data and heavily stressed oversight, including raising awareness of how to lodge complaints and “swift appointment of members to the PCLOB.”
“European Data Protection Authorities have called upon the U.S. to resolve these points by 25 May,” European Commission spokesperson Christian Wigand told the Washington Examiner. “EU Justice Commissioner [Vera] Jourová will travel to the U.S. in March and follow up on this with the U.S. authorities.”
What's taking so long?
The reason for the slow revival of PCLOB appears to be related in part to the hectic changeover in presidential administrations. The White House has had to nominate hundreds of people to various posts across the federal workforce and has struggled to keep up the pace.
President Trump nominated Adam Klein, a former clerk for Antonin Scalia on the Supreme Court, in August to serve as PCLOB chairman. The Senate Judiciary Committee held a confirmation hearing for Klein, whose views are considered hawkish by privacy advocates, on Jan. 24. Few senators showed up to question Klein.
Klein’s confirmation would allow the PCLOB to again hire staff, but one more member would be needed to take official actions.
Former president Barack Obama did not nominate a new chairman during his last year in office, and two PCLOB vacancies are reserved for Democrats. The White House is expected to defer to names supplied by Senate Minority Leader Chuck Schumer, D-N.Y., for those positions.
It’s unclear if Schumer’s office provided the White House with Democratic names. A spokesman did not respond to a request for comment on whether Schumer has provided Democratic names to the White House, nor did a White House official who has been involved in the board’s revival.
Michelle Richardson, deputy director of the Freedom, Security, and Technology Project at the Center for Democracy & Technology, said progress on Klein's nomination is a step in the right direction, but that continued PCLOB dormancy could help sink the major economic agreement.
“The government representatives in Europe who are reviewing Privacy Shield have said they want independent and outside overseers of intelligence programs," Richardson said. “It’s certainly one of the factors they are considering.”