How Both the Eu and the U.s. Are "stricter" Than Each Other for the Privacy of Government Requests for Information
| Jurisdiction | European Union,United States,Federal |
| Publication year | 2017 |
| Citation | Vol. 66 No. 3 |
Law enforcement access to personal data presents a paradox at the heart of debates between the European Union (EU) and the United States about privacy protections. On the one hand, the comprehensive privacy regime in the EU contains many requirements that do not apply in the United States—the EU is "stricter" than the United States in applying requirements that do not exist in the latter. On the other hand, the United States also sets requirements that do not exist in the EU, such as the Fourth Amendment requirement that a warrant be signed by a judge upon a finding of probable cause. Thus, both are stricter in important ways when setting standards for law enforcement access to personal data. The fact that both sides are stricter in significant respects is important to two distinct topics: how to reform the system of Mutual Legal Assistance (MLA), and whether the United States provides "adequate" protection for personal data under EU law, and thus is an appropriate destination for data flows from the EU.
The relative strictness of standards for law enforcement access is central to understanding current obstacles to reforming the MLA system, the mechanism for sharing law enforcement evidence held in one country for use in criminal investigations in a different country. Our research team has been writing a series of articles about MLA reform.1 The topic has become increasingly important in
[Page 618]
recent years—globalized communications mean that e-mails, social network data, and other evidence for criminal investigations are often held in a different country. In the course of studying obstacles to effective reform, we have come to believe that the fact that both the EU and the United States provide stricter privacy protections is salient but little understood—each side is reluctant to compromise on a new approach to the extent that there would be a weakening of some specific safeguards that currently exist in their respective jurisdictions. We hope that a fuller understanding of the relative strictness of both sides will enable a more fruitful discussion of possible paths to MLA reform.
The relative strictness of both the EU and the United States is also important to a second topic, the current litigation and debates about whether the United States provides "adequate" protection of privacy, and thus is a lawful destination for flows of personal data from the EU.2 Under the EU Data Protection Directive, which went into effect in 1998,3 transfers of personal data from EU Member States to other countries, such as the United States, are generally permitted only if the recipient jurisdiction has "adequate" protections.4 From its negotiation in 2000 until 2015, a major legal basis for such transfers was the EU/U.S. Safe Harbor, under which participating companies could lawfully send personal data to the United States.5 In 2015, the European Court of Justice struck down the Safe Harbor for lacking adequacy in Schrems v. Data Protection Commissioner.6 A related transfer mechanism, the standard contract clause, is now facing a similar legal challenge in Ireland, and the Irish Data Protection Commissioner has preliminarily found the challenge to be "well founded."7 In
[Page 619]
addition, the EU has recently approved two instruments that will go into full effect in 2018 and strengthen existing privacy protections: the General Data Protection Regulation (GDPR),8 which applies predominantly to private-sector processing of personal information, and a new Police and Criminal Justice Directive that governs law enforcement access to personal data.9 Both the GDPR and law enforcement directive have similar "adequacy" requirements for transfers of personal data.10 An accurate assessment of the adequacy of U.S. law enforcement access to information is thus vital to multiple aspects of current EU data protection law.
Part I of this Article provides background for both MLA reform and the current adequacy debates. Part II highlights ways that the EU's comprehensive data protection regime creates privacy protections, including for law enforcement access, that are stricter than those applied to the United States. Part III highlights ways the United States has stricter rules governing law enforcement and other government access to information. We introduce the term "plus factors" as a way to highlight how specific provisions of U.S. law and practice provide greater protection than the EU approach. Some of these plus factors are structural, such as the assurances of lawfulness provided by over two centuries of the U.S. independent judiciary and operation of a written constitution of checks and balances. Other plus factors are more specific, such as the probable cause standard and specific provisions of statutes, such as the Electronic Communications Privacy Act (ECPA), which provide higher standards for access to some categories of information than is required in the EU. Part IV focuses on the implications for MLA reform. Based on our study of both the EU and U.S. systems, we believe there are generally effective rule-of-law protections against excessive law enforcement surveillance in both the U.S.
[Page 620]
and EU Member States. We therefore conclude that these generally effective safeguards provide a promising basis for MLA reform, even where details of the systems differ and specific safeguards on one side do not have precise counterparts on the other.
The first section of this Part describes our ongoing research project into MLA reform and explains the distinctive task of this Article in relation to our previous work. It also describes the new urgency of MLA reform, in light of the Second Circuit's 2016 decision in Microsoft v. United States (Microsoft Ireland),11 and the 2016 announcement of proposed legislation to reform the MLA process between the United States and United Kingdom. The second section then provides background on current data protection controversies between the EU and the United States both for new EU legal instruments and in ongoing litigation that quite possibly will reach the European Court of Justice.
A. Why Mutual Legal Assistance Matters Now: The Research Project
This Article is part of a larger research project examining the current state of international MLA and builds upon those previous articles. This section first highlights key findings from our team's previous work on MLA. It next describes the 2016 Microsoft Ireland case and the 2016 proposal for a new U.S./U.K. framework for MLA. It concludes by outlining what this Article adds to the overall MLA reform debate.
1. Previous Research Findings
A simple example shows how the globalization of data is affecting even routine criminal investigations. Consider a burglary that takes place in Paris with a French suspect and a French victim. In investigating the crime, French law enforcement find that the suspect was using a U.S.-based e-mail service, and the e-mails can only be retrieved from the relevant e-mail server located in the United States. Under the current regime, to access the e-mails, French law enforcement would need to file a MLAT request with the U.S. Department of Justice (DOJ).12 The request would need to show "probable cause" of a crime—
[Page 621]
the U.S. legal standard13 —despite the crime having no connection to the United States (other than the physical location of an e-mail server). This example shows how MLA issues increasingly arise for routine criminal investigations. The need for MLA requests is even more pervasive for cybercrime, drug smuggling, money laundering, and other categories of crime where the criminal activity itself often crosses borders.
The first article in the research project introduces the international MLA regime,14 explaining the origins of MLATs and how electronic evidence requests have come to overwhelm these systems.15 One important source of current challenges is how the increased use of encryption has made many local wiretaps ineffective, pressing law enforcement to seek evidence by alternate means.16 The article examines the risks of failing to adequately reform the system.17 It provides a number of potential administrative reforms that could reduce the current average response time of ten months for MLA requests to the United States. The article stresses an innovative way to avoid reliance going forward on mutual legal assistance treaties; instead, reform may be more achievable and effective through mutual legal assistance statutes.18 The article is thus entitled, Mutual Legal Assistance in an Era of Global Communications: The Analogy to the Visa Waiver Program.19 The Visa Waiver Program (VWP) was a response to the globalization of travel—for the thirty-eight countries that participate today, individuals can travel to and from the United States without the need for an individualized visa interview.20 Similarly, a new MLA statute can respond to the globalization of evidence—countries that meet strict standards would use a streamlined system to share evidence for criminal investigations. Since the article was written, the United States and the United Kingdom have announced one such proposal for an MLA statute,21 consistent in structure with the VWP model supported by our research.
[Page 622]
The second article identifies the various stakeholders in this international MLA regime, and their respective incentives and goals for reform.22 That article, Stakeholders in Reform of the Global System for Mutual Legal Assistance, looks to the interests of the U.S. government, non-U.S. governments, technology companies, and public interest groups both in the United States and abroad.23 The article seeks to accurately describe the interests of these stakeholders to better inform the debate...
To continue reading
Request your trial