EPIC Urges European Commission to address surveillance gaps in First Periodic Review of EU-US Data Privacy Framework

EPIC filed comments with the European Commission urging the Commission to address surveillance gaps in the EU-US Data Privacy Framework and protect the privacy rights of EU residents.

The Commission adopted an adequacy decision for the EU-US Data Privacy Framework in July 2023 despite the US Intelligence Community’s ability to engage in mass surveillance of EU residents. The adequacy decision provides a period of public review to take place within one year of the decision. Congress’ recent passage of the Reforming Intelligence and Securing America Act (“RISAA”) reauthorizing and expanding FISA Section 702 and the Biden Administration’s Executive Order 14086 implementing the Privacy Framework continue to undermine EU residents’ privacy rights under the GDPR.

RISAA increased surveillance gaps in the Privacy Framework by expanding businesses subject to surveillance under FISA Section 702, codifying and expanding travel vetting, and broadening the scope of collectible “foreign intelligence.” Despite these expansions, RISAA lacks any meaningful new safeguards for non-US persons. The Biden Administration’s implementation of the Privacy Framework via Executive Order 1408 continue to shortchange EU residents by memorializing prior collection restrictions that have already been stuck down by the Court of Justice of the European Union and provide no mechanisms for redress. EPIC called on the Commission to address these structural failures in the EU-US Data Privacy Framework.

EPIC has long advocated for robust safeguards to protect consumers from exploitative data collection, use, distribution, and retention practices, both in the United States and abroad. Recently, EPIC signed onto a coalition letter to the European Data Protection Board condemning pay or okay schemes, commented on an ICO consultation regarding research provisions in the UK GDPR, and responded to the European Commission’s call for input on regulations around emerging virtual worlds. EPIC has also published a blog series focused on explaining Section 702 and the need to reform it. EPIC and a bipartisan coalition of civil society groups have called for broad reform to Section 702 and related surveillance authorities.