1. The European Union as Global Information Regulator & Other Policy Topics
Peter Swire
Engage CISO Roundtable with the
GT Institute for Information Security & Privacy
Atlanta
December 3, 2018

2. Overview Swire background Research highlights:
Intelligence agency oversight
Cross-Border Data Forum
Non-code aspects of cybersecurity
The EU as global regulator of information
You know about GDPR
Irish standard contract clause case going to European Court of Justice – could massively cut off flows of personal data from EU to U.S.

3. Swire Activities Today
Professor GT, privacy and cybersecurity
Associate Director for Policy, GT Institute for Information Security and Privacy
Senior Counsel, Alston & Bird (Jim Harvey, David Keating, etc.)
2018 Andrew Carnegie Award for “Protecting National Security and Human Rights in the New Era of Data Localization”

4. US, EU, and Global Data Flows
1998 book from the Brooking Institution
on US/EU privacy disputes

5. Background President Clinton’s Chief Counselor for Privacy
Negotiation of US/EU “Safe Harbor” for privacy
Chaired White House Working Group on updating wiretap and intelligence law for the Internet
President Obama’s Review Group on Intelligence and Communications Technology (2013) (“NSA Review Group”)

6. The Situation Room: December 2013

7. U.S. Intelligence Oversight & Reform Since 2013
Review Group: 46 recommendations
White House in 2014 reported 70% had been adopted
More since then, notably USA Freedom Act (2015)
I remain active in this area: was the U.S. speaker last Friday in Malta at International Intelligence Oversight Forum
GT Professor Annie Antón announced last month as one of the first technology amicus curiae for the Foreign Intelligence Surveillance Court, and the only academic.

8. MLA & Cross-Border Government Access to Data
Technology/market changes
Before, evidence for serious crime in Paris was in Paris
Now, , social network, and other content often held in a different nation
EU E-Evidence report: 55% of cases have evidence across borders
We need to build a new international system as cross-border law enforcement requests become the norm

9. Cross-Border Developments
GT project since 2015:
US passed CLOUD Act in March, 2018
New system of “executive agreements” first announced in our research
EU proposed E-Evidence rules as well
US/EU negotiations slated for January
US/UK agreement may be made public in January

11. Goals of Cross-Border Data Forum
Fulfill legitimate law enforcement requests for data relevant to the investigation of serious crimes.   
Protect and promote privacy and human rights as essential to new legal approaches. 
Provide a workable regime for the companies holding data of interest to law enforcement. 
Safeguard the internet by resisting calls to localize data and splinter the internet. 

12. Non-code Aspects of Cybersecurity
October 2018, Communications of the ACM
“A Pedagogic Cybersecurity Framework: A Proposal for Teaching the Organizational, Legal, and International Aspects of Cybersecurity”
New framework for organizing and emphasizing the non-code aspects of cybersecurity
OSI stack has 7 layers
Layer 8: organizational
Layer 9: legal/government
Layer 10: international

13. EU as Global Information Regulator
EU Data Protection Directive in effect since 1998
GDPR went into effect this year
The spread of privacy laws to > 120 countries
Most are based on the EU approach
GDPR enforcement is just beginning
New, serious challenges to online advertising on claim that no “consent” to third-party advertising tracking
CNIL Vectuary
Privacy International complaint about Experian, Acxiom, and others

14. 1998 Privacy Laws
Comprehensive
Proposed
Sectoral
None

15. 2018 Privacy Laws
Comprehensive
Proposed
Sectoral
None

16. Will the EU Create the Great Firewall of Europe?
2000: Safe Harbor agreement
October 2015: European Court of Justice struck down Safe Harbor in Schrems decision
One concern – strict enough commercial privacy rules
Major concern -- scope of US surveillance activities; may not be “adequate” if NSA and other surveillance takes place once the data gets to the US
December 2015: Swire testimony about safeguards and reforms in US surveillance law
July 2016: final approval of EU/US Privacy Shield to replace Safe Harbor

17. The Legal Challenges
European Court of Justice in Schrems did not (quite) find that US surveillance made transfers “inadequate”
It did strike down Safe Harbor, expressing detailed concerns that NSA surveillance is so pervasive that data of EU citizens cannot be safe in the US

18. Case Headed to European Court of Justice
Current Schrems v. Facebook case:
Challenge in Ireland to “standard contract clauses” that are used as lawful basis to send data to US and elsewhere
Irish privacy commissioner – SCCs seem as legally weak as Safe Harbor
300-page Swire testimony on actual U.S. law and practice:
Irish judge: agreed with the privacy commissioner, and has referred broad questions to the ECJ

19. What if the ECJ Rules the US is Not Adequate?
If ECJ says SCCs are illegal, no good way to over-rule that
Binding legal effect of ECJ decision
No mechanism for constitutional amendment
Would require change to Lisbon Treaty
What will happen?
ECJ briefing in early 2019
Result is unclear
If the court remains strict, may need large data separation between EU and US operations
Consider that possibility as you establish your systems

20. Questions and discussion?
Intelligence oversight
Cross-Border Data Forum
Non-code aspects of cybersecurity
EU and online advertising
EU and may block transfers to US