Road to Adequacy, Part II: Can California Apply Under the U.S. Constitution?

Since it took effect in 2018, the General Data Protection Regulation (GDPR) has become one of the toughest data privacy regimes in the world. The regulation imposes strict obligations on how entities process, control and transfer personal data originating in the European Economic Area (EEA). Importantly, Chapter V of the GDPR authorizes only three methods for legal data transfers from the EEA to a third country, such as the United States: adequacy decisions, appropriate safeguards or limited enumerated exceptions (“derogations”). Noncompliance carries steep fines and penalties—up to 4 percent of global revenues. Just this month, the U.K. data protection agency announced its intent to fine British Airways $232 million; this would dwarf the current $57 million record fine against Google in January 2019.

Previously, I examined whether the state of California could apply for an adequacy decision even though it is not a country. Adequacy decisions originate from the EU finding that the third country’s domestic privacy laws provide sufficient protection. These decisions reduce the regulatory burden on individual businesses by allowing unimpeded data flows between the EEA and a third country. California recently enacted its own data privacy scheme, the California Consumer Privacy Act (CCPA), set to take effect in 2020. This sparked speculation on whether the state would apply for adequacy under the GDPR. As the CCPA takes effect next year, and companies comply with two different regulatory burdens—the GDPR and the CCPA—the additional CCPA compliance costs in conjunction with existing GDPR data transfer compliance costs may tip the balance in favor of business support for a potential adequacy decision. I concluded that EU law does not appear to categorically prohibit California from applying for adequacy under the GDPR.

But, while the GDPR may not prohibit California from applying for adequacy, the state faces a more significant issue at home: the U.S. Constitution. The constitutional scheme circumscribing the foreign affairs powers of states has been called a constitutional “fog.” Against this background of uncertainty, however, states regularly engage and cooperate with foreign powers: From 1955 to 2010, at least 41 states have entered into more than 340 foreign-state agreements (FSAs) without any congressional oversight. California leads the way with 36 FSAs.

The question of whether California could apply for adequacy must be considered in conjunction with the empirical evidence of states engaging with foreign powers. Alongside this evidence, this post considers three specific constitutional doctrines that could limit or preempt California’s ability to apply for an adequacy decision under the GDPR: the limits imposed by Article I, Section 10; the (dormant) foreign affairs preemption doctrine; and the dormant foreign commerce clause.

The Compact Clause

Article I, Section 10, of the U.S. Constitution contains two distinct prohibitions that touch on California’s ability to engage with foreign powers. Clause 1 contains a categorical prohibition: States cannot enter into a “Treaty, Alliance or Confederation.” Clause 3 (the Compact Clause) imposes a congressional consent requirement: States cannot enter into “any Agreement or Compact” with another state or foreign power without congressional consent.

The treaty prohibition does not apply to adequacy decisions. These decisions, likely even the recent reciprocal Japanese decision under which the EU and Japan each produced adequacy decisions to ensure two-way data flows, are not treaties. Under both international law and federal law, treaties are between two independent nations—so an agreement between California and the EU would obviously not fit the definition. Further, international law requires the existence of a legal obligation governed by international law. Adequacy decisions are unilateral reviews, by the EU, of the domestic laws of the applicant. California, of course, is not an independent nation, and an adequacy decision neither is governed by international law nor imposes mutual legal obligations on the EU and the applicant.

The Compact Clause poses more of a problem. California could seek congressional consent to satisfy the Compact Clause and insulate an adequacy decision from any legal challenge. But seeking this consent would grant Congress the power to amend the terms of the agreement, which California might not want. Congressional consent might not even be necessary at all, given that no agreement between two states or an FSA has ever been invalidated for lack of congressional consent. What’s more, while the Compact Clause cannot be easily dismissed, it also likely does not apply.

Today, the Supreme Court uses the terms “agreement” and “compact” interchangeably, because the Constitution does not define “agreement” or “compact” and the original distinction between these terms (if it existed) has been lost. Read literally, the Compact Clause prohibits any agreement between a state and a foreign power without congressional consent. So how did 41 states enter into more than 340 FSAs over the course of 55 years without Congress’s consent? The short answer is that the Supreme Court has interpreted “any” to mean “some” and carved out a category of agreements that are not subject to congressional approval because the agreements do not encroach on federal supremacy. But one important assumption should be highlighted. The states, the executive, § 302 of the Restatement (Third) of Foreign Relations Law and most academics have historically presumed that the Compact Clause is uniform—that is, an FSA is treated identically to a domestic agreement between two or more states. This assumption against foreign affairs exceptionalism anchors the existing academic and administrative legal analyses on FSAs because the Supreme Court has examined an FSA only once—in 1840—but has opined on domestic compacts with more regular frequency.

There are two initial descriptive points in favor of California’s ability to apply for adequacy. First, the historical federal inaction on the overwhelming majority of FSAs seems to suggest that the universe of FSAs in effect is larger than the set of FSAs that require congressional approval (Congress has never sought to review an FSA that had not been sent to it by the states). Second, in every instance when the Supreme Court has considered whether an interstate agreement required congressional consent, it has never held so.

The doctrinal framework also likely favors California. The modern treatment of the Compact Clause is a two-part test. First, a court inquires whether the agreement has the “classic indicia” of a compact. If the agreement does, the court considers whether it encroaches on federal supremacy. The Supreme Court has noted that “classic indicia” of compacts include reciprocal obligations, cooperation between the state(s) and the foreign power, the existence of a joint body/organization to oversee the agreement, conditional implementation in statutes, and an inability to unilaterally repeal or amend the implementing statute. While the high court has not explicitly noted whether this list is exhaustive, it has not added any other indicia.

Adequacy decisions have never created a joint body, had conditional implementation, or restricted either party’s ability to repeal or amend their domestic laws. While the Supreme Court has never indicated how many factors are necessary to tip the balance in favor of a compact, it has found that agreements did not meet the definition of a compact in several instances where multiple indicia, including cooperation, were present. For that reason, an application for an adequacy decision is likely not an agreement subject to the Compact Clause.

Assuming a court were to find that an adequacy decision is a compact, the court would likely find it does not require congressional consent. In evaluating whether the consent of Congress is necessary, courts consider three factors: (1) Does the compact allow states to exercise power they could not exercise in the compact’s absence? (2) Is there a delegation of sovereignty to the commission or other institution created by the compact? and (3) Is there any restriction on the states to leave the compact?

Here, none of these factors would likely be relevant. A successful adequacy decision would not grant California any new power—the state’s ability to regulate data flows under the CCPA would remain the same. A request for adequacy, or the subsequent grant, would not change the underlying statutory scheme of the CCPA or California’s sovereign power. Further, prior adequacy decisions have not created commissions or institutions and have never restricted either parties’ ability to leave the agreement. Ultimately, the adequacy decision process is the EU applying its own law to determine whether an existing statutory scheme is sufficiently related to the GDPR.

So, what does this mean for California? Requesting an adequacy decision under the GDPR is unlikely to fall within the scope of Article I, Section 10—because the request and resulting decision either is likely not an agreement within the meaning of the Compact Clause or is likely not the type of agreement that requires congressional approval.

Until now, I have considered a hypothetical adequacy decision that takes the form of a review by the EU of California’s statutory scheme. But what if the EU required additional assurances? For example, the Japanese adequacy decision included supplemental rules—additional restrictions to help bridge the differences between the two privacy regimes of Japan and the EU. Prior to the adoption of the adequacy decision, the Japanese government incorporated these rules into the country’s own statutory scheme. One in particular may be problematic for California: stricter cross-border data transfer requirements for EU data than for domestic data flows. This arose out of Japan’s recognition of the Asia-Pacific Economic Cooperation (APEC) Cross Border Privacy Rules (CBPR) system as a valid method of cross-border data flows under its domestic privacy scheme. But, unlike the Japanese privacy regime, the GDPR does not recognize the APEC CBPR mechanism for data transfers to third countries. Thus, the adequacy decision required a supplemental rule to ensure EEA data transferred from Japan to another third country must comply with GDPR-like transfer requirements rather than utilizing the APEC CBPR mechanism.

California’s difficulty here would arise from federal supremacy. Congress is currently considering whether to ratify the latest version of the North American Free Trade Agreement—the United States-Mexico-Canada Agreement (USMCA)—which contains an identical APEC CBPR provision. Should the USMCA be ratified, California will be preempted from adopting a rule similar to Japan’s.

But this is not a categorical bar to request or obtain an adequacy decision. As I mentioned previously, the existing CCPA regime has several gaps that California will need to address to increase its chances of obtaining an adequacy decision under the GDPR. There is space for California and the EU to develop creative solutions. For example, the EU could tailor the decision to apply only to businesses that voluntarily impose additional safeguards, such as binding corporate rules and model contract clauses, to prevent cross-border data transfers from California to a lower privacy regime. This may avoid any federal supremacy issues since adequacy decisions, including their scope, are determined under EU law, rather than the third country’s domestic law. In addition, the USMCA would apply in equal force to the Privacy Shield framework, the existing U.S. partial adequacy decision—meaning that California could also wait to see if the EU pressures the Department of Commerce to modify the Privacy Shield prior to applying for adequacy.

(Dormant) Foreign Affairs Doctrine

California’s second potential constitutional hurdle is the dormant foreign affairs doctrine.

The Constitution delegates primacy over foreign affairs to the federal government and imposes restrictions on the states’ ability to conduct foreign affairs. But whether the Constitution entrusts to the federal government exclusively all power over foreign affairs, or whether these powers are concurrent with state powers, is a matter of scholarly debate.

Under the exclusive control view, any state action touching on foreign affairs may be preempted irrespective of federal action—a type of field preemption (i.e., the whole field of foreign affairs is exempt from state legislation). This is the basis of the foreign affairs doctrine. Under the concurrent view, however, state action is preempted only in instances when there is a clear expression of federal policy in foreign affairs, traditionally through a statute or treaty. This view aligns more closely with conflict or statutory (express) preemption. The Supreme Court has preempted state action touching on foreign affairs under all three preemption doctrines: express when there was a federal statute, conflict when there was an executive agreement, and field preemption in the absence of any federal action. The more recent decisions, however, indicate that in the area of foreign affairs, the Supreme Court has moved away from field preemption in favor of conflict or express preemption.

Express preemption is uncontroversial and not relevant to this instance. Federal statutes generally preempt conflicting state action, but there is no comprehensive federal law or self-executive treaty on data privacy (though different bills have been introduced in 2017 and 2018).

The courts have applied conflict preemption to allow the executive branch to speak with “one voice” when dealing with foreign powers. In American Insurance Assn. v. Garamendi, the Supreme Court utilized conflict preemption to hold that a California insurance statute conflicted with executive agreements between the United States and Germany to establish a restitution fund and encourage its use for settling claims. This view has also been called the “bargaining chip theory”—the executive has less to negotiate with foreign powers in the face of conflicting state action. But two key factors present in Garamendi are absent here.

First, there is likely no executive agreement on data privacy between the U.S. and the EU. The Privacy Shield framework is a self-certification program overseen by the Department of Commerce. While the EU Commission helped design the program in 2016 and then found the program adequate under the Directive (the precursor to the GDPR), the Privacy Shield principles (the framework of the program) were issued solely by the Department of Commerce. Lastly, while not definitive, there is no mention of any 2016 agreement with the EU in the State Department’s online TIAS (Treaties and Other International Acts Series) database, which contains the full texts of treaties and executive agreements to which the U.S. is a party. However, TIAS is not exhaustive.

In addition, unlike Garamendi, there is no state action at issue. California does not need to pass legislation to request adequacy. Rather, the governor can make a nonbinding request. An adequacy decision is substantially similar to the process of linking economies to reduce greenhouse gas emissions. Whereas California reviews Quebec’s environmental framework to ensure sufficient similarity with its own enforcement initiatives, here the EU would review California’s data privacy law—the CCPA—to ensure substantial similarity with the GDPR.

Regarding field preemption, in 1968 the Supreme Court relied on the dormant foreign affairs doctrine to strike down an Oregon probate statute that “establish[ed] its own foreign policy” in the absence of any federal law, making it more difficult for residents of Communist or authoritarian nations to inherit in Oregon than other foreign residents. Notably, the federal government did not oppose the statute at the time. But the court was disturbed by state judges making value judgments about the governmental structure of other nations. This case, Zschernig v. Miller, was the first, and only, formal use of the dormant foreign affairs doctrine by the Supreme Court to strike down a state statute. More than 30 years later, in Garamendi, Justice Souter suggested a two-part inquiry to clarify for lower courts when they should apply the field preemption framework of Zschernig instead of conflict preemption. Souter wrote that courts should consider whether the state statute touching on foreign affairs is within the traditional responsibility of the state, such as health and safety or welfare. This suggestion has caused some confusion given that the statute in Zschernig was about probate, traditionally within the purview of state law. Some lower courts now look beyond the statute, seeking the “real purpose” of the law.

Several factors would likely favor California here. First, unlike the Oregon probate statute, California would not need to pass a statute requesting an adequacy decision; the request alone would not have legal effect. Even obtaining an adequacy decision from the EU would not categorically require any legislation by California. Second, there are no state judges making value-laden judgments of foreign policy in this instance. Rather, California would be seeking for a foreign power to pass judgment over its statutes. Since the state here is not seeking to “establish its own foreign policy” through normative judgments of other nations, it’s unlikely that courts would find the concerns animating the original Zschernig decision present here.

Today, globalization has allowed states to engage with foreign powers in commerce, culture, human rights, the environment and investment. In 1995, Rudy Guliani, as mayor of New York, kicked out Yasser Arafat from a concert for world leaders at the Lincoln Center. This embarrassed the Clinton administration, which had stressed that Arafat was to be invited to local events in the city. In 2008, California, contrary to federal policy, recognized the Armenian genocide—and today the state has established its own trade office in China. Even scholars who support the need for “one voice” in foreign affairs recognize that the view on foreign affairs federalism today permits states to act on the international stage (though the exact boundaries on state action are uncertain).

This acknowledgment is bolstered further by empirical evidence. As a practical matter, individual states have been entering into a variety of political arrangements with foreign cities, territories and nations with little or zero federal response. These agreements include benign sister-state (or -city) agreements encouraged after World War II by the federal government, environmental agreements to cooperate on climate change, and less benign attempts by foreign powers to influence U.S. federal law. Two examples are illustrative. In 2003, Kansas committed to encourage a repeal of the federal trade and travel sanctions on Cuba in return for Cuba buying $10 million worth of agricultural products from the state. Then, in 2005, a Kansas congressman introduced federal legislation that would repeal the sanctions, and the Kansas lieutenant governor expressed support. While the bill did not advance, the underlying agreement was not publicized by Kansas and came to light only because of an announcement on Cuban state radio. In another example, since 2014, California and Quebec have generated billions of dollars for climate change efforts through a linked cap-and-trade auction. This cooperation was premised on a nonbinding “harmonization” agreement—a signed document that outlined a framework for how the respective programs could be integrated. When Ontario joined in 2018 for one year, the three linked economies represented the fourth largest economy in the world.

This does not imply that all of these state actions in foreign affairs are in fact permitted by the Constitution. But as a practical matter, congressional and executive inaction has emboldened states to push the boundaries of what is politically and practically possible.

Dormant Foreign Commerce Clause

The dormant foreign commerce clause doctrine, like the dormant commerce clause doctrine (its domestic counterpart), arises from the Commerce Clause in Article I, Section 8—Congress’s power to regulate commerce with foreign nations. The Supreme Court has fashioned this doctrine to preserve the federal government’s ability to speak with “one voice” in regulating foreign commerce, similar to the concerns animating the dormant foreign affairs doctrine. Under the dormant foreign commerce clause doctrine analysis, however, state action will be preempted if it “implicates foreign policy issues” within the purview of the federal government or “a clear federal directive.” Importantly, the Supreme Court has distinguished between state regulations that have “foreign resonances” and state action that implicates foreign affairs, finding that state laws will implicate foreign affairs when there is a high threat of retaliation by foreign powers. In addition, unlike the dormant foreign affairs analysis (which looks to congressional or executive action), the Supreme Court looks only to congressional action to determine whether there is a clear federal directive. Inaction by Congress can be viewed as assent to state action.

Because there is no comprehensive federal law on data privacy, there would likely be insufficient “clear federal directive” by Congress to preempt any action by California on data privacy under this doctrine. Further, retaliation by foreign powers in response to California seeking an adequacy decision under the GDPR seems highly unlikely.

***

Perhaps it should be unsurprising that California could likely request an adequacy decision without violating the structure of the Constitution. The Supreme Court has previously carved out a space for states to enter into agreements without obtaining congressional approval and signaled in recent decisions that foreign affairs federalism remains strong. Combined with a lack of congressional action on interconnected issues that touch on both local and foreign affairs, such as climate and data privacy, states have become emboldened to act and fill in the federal policy gaps.

If California chooses to take the lead—as it often does—and seeks an adequacy decision, there appear to be no categorical barriers preventing this choice under either U.S. or EU law. Any barriers to obtaining a decision will likely be political rather than legal.