The Jurisdiction of the New Data Protection Review Court

It seems odd to say, but at least in one sense, Europeans are now more likely to be able to substantively challenge American intelligence community collection practices than Americans themselves are. To be sure, this may not make much of a difference in practice, as European challenges may still fail on the substance of their complaints—but, in many ways, a substantive loss on the merits is superior to a loss based on a process argument. From that perspective, it is striking that European access to substantive dispute resolution about data privacy and intelligence community collection may be superior to American access, even here in the United States. 

The answer to this conundrum lies in the significant set of concessions to the European Union that President Biden has made throughout his term in an effort to resolve long-simmering disputes about trans-Atlantic data exchanges and privacy. During a March 2022 trip to Europe to bolster support for Ukraine, Biden tried to calm the privacy waters by committing to a Trans-Atlantic Data Privacy Framework. Late last year, he issued an executive order (and the Department of Justice issued accompanying regulations) intended to implement his commitment.

Lawfare has already provided an excellent summary of the provisions of the new executive order, and I have written about the overarching politics of the effort. In this article, I focus on one practical aspect of the Biden proposal: the creation of a Data Protection Review Court (DPRC) and its authority to hear complaints from European data subjects who allege that they have been unfairly affected by the intelligence community’s data collection practices. 

The DPRC addresses a long-standing grievance among Europeans, who for years have said that they lack an adequate review and redress process for alleged privacy violations by the U.S. government and, most particularly, by the intelligence community. Though many think those complaints overstated, Biden’s executive action nonetheless constituted an effort to mitigate the charge. 

A preliminary note of clarification: The regulations discussed below define a “qualifying complaint” as one alleging that “a covered violation has occurred that pertains to personal information of or about the complainant, a natural person, reasonably believed to have been transferred to the United States from a qualifying state.” In other words, the new process allows for complaints about data that is collected within Europe (assuming that the EU is eventually designated as a qualifying state) and then transferred to the United States. Notably, this definition might by its terms apply to collection that is related to the data of Americans, Africans, or Asians, in addition to that of Europeans, so long as the information was collected within Europe. It is nonetheless clear that the president issued this direction with the overarching intent to benefit Europeans in response to their critiques of American practice. Thus, for simplicity’s sake, I will refer specifically to Europe and Europeans in this article.

Biden’s executive order allows individuals to file complaints when they believe that the U.S. intelligence community has improperly accessed their personal data. It then creates a two-layer review process for adjudicating individual cases. For individual complaints from qualifying countries, the intelligence community’s civil liberties and privacy officer will conduct an initial review. His or her conclusions will then be subject to further review by a newly created Data Protection Review Court (to be housed within the Justice Department). The DPRC’s review is intended to be both plenary and binding on the intelligence community, which means that the intelligence community will be obliged to follow the court’s orders and directions.

This may not satisfy some European critics for whom only truly independent judicial review could be viewed as adequate. Max Schrems, one of Europe’s most prominent privacy activists, has already indicated that he thinks the order will not satisfy European requirements for independence. Others, however, have taken a more generous approach, arguing that executive-created independence is essentially equivalent and thus will satisfy the European need for effective redress.

Of course, the criticism of a lack of independence is, at one level, trivially correct. As an executive creation, the DPRC is an Article II court and can be dissolved by the next executive (though there is probably a limit on that possibility, given the requirement that the recission of a regulation not be “arbitrary and capricious” and that there are also some Appointments Clause issues that are worthy of discussion in another article). But that doesn’t tell the whole story.

A fair assessment of the DPRC must also recognize that, in at least one way, its status as an executive body may be a net benefit to European complainants. This is because Europeans will have standing to bring their challenges and have them heard on the merits. Americans in American courts will not.

The concept of “standing” may be foreign to some, hence, a brief summary: U.S. federal courts are courts of limited jurisdiction. They don’t hear every case or complaint—only ones that are authorized to be heard either by a statute or by the U.S. Constitution. Critical to that limitation is that the Constitution restricts Article III courts (that is, the courts that are part of the independent judiciary) to hear only those cases that involve a live “case or controversy.” American federal courts will not issue advisory opinions or hear hypothetical cases. One critical way in which that limitation is enforced is through the requirement that litigants establish that they have standing to bring the case—that is, they must be able to allege facts demonstrating that the case is real and applicable to them personally, and that they are not seeking to address some general or nebulous idea of wrongful conduct.

This means that for allegations of injuries relating to actions of the intelligence community, complaints filed by Americans and Europeans in the Article III court system will probably be dismissed for a lack of standing. In this context, courts have said that the Constitution requires plaintiffs to allege an “injury in fact.” In other words, they have to be able to say, “I know that what the defendant did has hurt me, and this is how I know that.”

For allegations relating to covert activities, it is highly unlikely that a plaintiff will have the knowledge to be able to make such a claim with sufficient specificity. The Supreme Court’s decision in Clapper v. Amnesty International is illustrative. 

Amnesty International, along with a number of other public interest groups and nongovernmental organizations, challenged the implementation of Section 702 of the Foreign Intelligence Surveillance Act of 1978, 50 U.S.C. § 1881a, which authorizes the surveillance of individuals who are not “United States persons” and who are reasonably believed to be located outside the United States. (In other words, the very same statute that is likely at the heart of most, if not all, European privacy concerns.) The challengers were attorneys and human rights, labor, legal, and media organizations claiming to be Americans who engaged in sensitive international communications with foreigners that were the likely targets of Section 702 surveillance. Thus, they argued, it was highly likely that as part of a Section 702 surveillance program, their own protected communications with the targets had been subject to collection by the American intelligence community.

At one level this seems correct: At least some portion of the affected American cohort was likely to have been in communication with individuals outside the U.S. whose communications were subject to collection. Given a large enough sample size, one might think the probability of such an interception would be very high.

That kind of probabilistic thinking was not, however, sufficient for the Supreme Court. Rather, the Court reiterated that in order to establish Article III standing, an injury must be “concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling.” As the Court put it, a “threatened injury must be certainly impending to constitute injury in fact,” and “[a]llegations of possible future injury” are not sufficient. In the Supreme Court’s view, the possibility of surveillance at the heart of Amnesty’s complaint was built on a house of cards —a speculative chain of possibilities. Indeed, because the claimants had no actual knowledge of the government’s targeting practices under Section 702, the only thing they could do was guess and hypothesize. This, the Court said, was not sufficient to show the imminent and impending injury required to establish standing. 

But what is true of Amnesty and its co-claimants would be equally true of Europeans suing in American Article III courts. In the absence of a requirement that the government disclose the fact of surveillance to interested persons—a highly unlikely scenario—no plaintiff will ever likely be able to colorably allege an injury in fact that is sufficient to satisfy constitutional requirements. Thus, when Europeans complain that they do not have access to America’s independent judiciary, they are almost certainly complaining about something that is of no practical value. Even were Congress to grant foreign citizens a statutory right to seek redress in an Article III court, in the context of intelligence surveillance, that victory would be pyrrhic indeed.

All of which brings us back to the new DPRC. As an Article II court created by executive order, it is not constrained by the Article III “case or controversy” limitation. Instead, the DPRC has exactly as much jurisdiction as the president chooses to give it—nothing more, but also nothing less. 

And here, the DPRC has jurisdiction to independently review the appeal of any decision involving a “qualifying complaint.” Such a complaint (as Section 4(k)(i) of Biden’s order provides) requires an allegation that “a covered violation has occurred that pertains to personal information of or about the complainant, a natural person, reasonably believed to have been transferred to the United States from a qualifying state.” Provided that the complaint has enough detailed information to allow adjudication, is made by an individual, is transmitted by a qualifying country, and is not deemed vexatious or frivolous, the DPRC will review it on the merits.

The DPRC does not require a direct allegation that surveillance of the complaining individual actually occurred. Indeed, the Justice Department’s regulations (see § 201.9(c)) explicitly contemplate the possibility that an investigation will demonstrate that no surveillance occurred at all: If a “DPRC panel finds no evidence in the record indicating that signals intelligence activities occurred involving personal information of or about the complainant, the DPRC panel shall render a decision to that effect.” Thus, the regulations implicitly make clear that concrete allegations of signals intelligence activity involving personal information about the claimant are not a precondition to bringing a complaint.

To be sure, the caveat that one “reasonably believes” the information to have been transferred to the United States provides some practical limitation on the scope of allegations that the DPRC can review. And exactly what that phrase means will likely be the subject of litigation before the court itself. But whatever its ultimate interpretation, it is almost certainly the case that alleging a “reasonable belief” is a more practical possibility than is alleging that surveillance is “certainly impending” (as an Article III court would require). 

And that, in turn, leads to an interesting conclusion: Europeans are more likely to have their complaints heard on the merits by the DPRC than they are to have them be resolved on the merits by an Article III court. This means that under the new executive order they are actually better off—at least in getting a substantive answer—than they would be if their wish for access to American courts had been fulfilled. From this perspective, the DPRC may wind up having a significant and wide-ranging impact. Indeed, it may well transform how privacy complaints are resolved within the context of American intelligence activities by providing access to an adjudicative system globally.