A High Court judge has raised issues with lawyers for the US government about the effect on EU citizens of findings of non-compliance by US intelligence agencies with restrictions on surveillance of personal data.
Ms Justice Caroline Costello raised the issues when hearing submissions about the significance for the Data Protection Commissioner’s case concerning the validity of EU-US data transfers of recently announced restrictions on collection of a certain category of personal data by the US National Security Agency.
While the NSA has historically been authorised to acquire communications to, from, or “about” a target under Section 702 of the Foreign Intelligence Security Act through its Upstream internet surveillance programme, it will no longer collect communications “about” a target.
The judge last March reserved judgment on the case but Eileen Barrington SC, for the US government, subsequently asked the judge to factor in the new developments when preparing her judgment.
The judge agreed to receive the information, formally provided by Facebook Ireland as a party to the case. She also agreed to allow experts for the sides provide brief reports of their views on it and to hear short oral submissions on Thursday from the sides. She will give her judgment later on an unspecified date.
In her proceedings, Commissioner Helen Dixon wants the judge to ask the Court of Justice of the EU to decide the validity or otherwise of European Commission decisions approving data transfer channels known as standard contractual clauses (SCCs).
Her case is against Facebook Ireland – because Facebook's European headquarters are here – and Austrian lawyer Max Schrems who for different reasons oppose referral. The US government is among several parties joined as amici curiae, assistants to the court on legal issues.
The developments raised by the US government are a decision of the US Foreign Intelligence Surveillance Court (FISC) of April 26th last which addressed the failure of US agencies to comply with surveillance restrictions imposed by the FISC and restraining collection of “about” data.
Another development was a decision by the US Court of Appeals for the Fourth Circuit that Wikimedia, but not several other plaintiffs, had the necessary legal standing to challenge the Upstream surveillance programme.
On Thursday, Brian Murray SC, for the Commissioner, argued the new material was not significant to the core issues the High Court has to decide. The FISC opinion mainly relates to US persons while the Wikimedia decision does not affect the Irish court’s analysis, he said.
Eoin McCullough SC, for Mr Schrems, argued the FISC opinion was essentially about the protection of US persons and did not alter the position concerning retention of personal data of non-US persons. The experts who analysed the decisions considered it did not materially alter their evidence to the court, he said.
Paul Gallagher SC, for Facebook, disagreed and argued the FISC opinion is significant. The opinion is binding and showed a functioning supervision system independent from the US government, he said. The decisions meant collection of “about” communication has stopped and indicated “a sea change” in how information is collected which does affect content of foreign communications, he argued.
Colm O’Dwyer SC, for the Washington-based Electronic Privacy Information Centre, said the FISC opinion and the fact the NSA has eliminated “about” searches was significant but the impact was limited because of the degree of agency non-compliance and institutional “lack of candour” referred to by the FISC. The FISC had also not ruled the NSA could not reintroduce “about” searches.
Eileen Barrington SC, for the US government, said the FISC opinion is a significant legal development which illustrates “effective judicial oversight” and also has an impact of EU citizens. The FISC opinion provided for additional safeguards and any future introduction of about comms would require fresh approval from the FISC, she added.
The judge observed the FISC opinion appeared to disclose a “history of disquiet” concerning how “about” communications were handled rather than the principle of collecting “about” communications.
Ms Barrington agreed “about” data collection could be reintroduced but said FISC would have to be satisfied to certify that. It was “distorting” to look exclusively at the issue of formal judicial remedies and the court should have regard to the totality of the “systemic protections”.
Asked by the judge about the position of EU citizens whose data was collected without authorisation and who are unaware of that, counsel said it is now unlawful to have “about” data collected under Upstream and that was a direct benefit for non-US citizens.
