An Easy Win: Replenishing the Privacy and Civil Liberties Oversight Board (PCLOB)

With this week’s White House announcement of an intent to nominate additional leadership officials at the Department of Justice, one of whom is current Privacy and Civil Liberties Oversight Board (PCLOB) member Rachel Brand, the PCLOB is one step closer to conducting its business with a lone remaining member, Elisebeth Collins. Board members may not serve in separate U.S. government positions. The privacy and national security communities are watching to see whether new PCLOB members will be appointed and whether the board's work will continue. Replenishing the board membership of the PCLOB is an opportunity for the Trump Administration to mark an easy win.

The PCLOB is an independent government agency within the Executive Branch, created in 2007, in response to recommendations made by the National Commission on Terrorist Attacks Upon the United States (the 9/11 Commission). The board is comprised of a chair and four additional members appointed by the President and confirmed by the Senate. The board is supported by a staff of attorneys and counselors. The recent full composition of the board (whose other three remembers have concluded their service either through completion of their term or resignation) have thus far been recognized experts in legal, privacy and/or national security issues. The authorizing statute requires that future members be of sufficient qualifications, stature, experience and expertise.

The PCLOB’s statutory purpose is to:

1. Analyze and review actions the executive branch takes to protect the Nation from terrorism, ensuring that the need for such actions is balanced with the need to protect privacy and civil liberties; and
2. Ensure that liberty concerns are appropriately considered in the development and implementation of laws, regulations, and policies related to efforts to protect the Nation against terrorism. 42 U.S.C. 2000ee(c).

Whether one agrees with each of the outcomes or not, the board has produced results that have made a difference. Its January 2014 report on the bulk telephone metadata program was influential. It provided an outside assessment of legal and policy issues raised by that program that influenced Congress’s eventual passage of the USA Freedom Act, which ended that specific program and placed additional limits on the use of bulk collection for foreign intelligence purposes. Similarly, the PCLOB’s July 2014 report on Section 702 of the Foreign Intelligence Surveillance Act has and will continue to be relevant as the sunset and related legislative debate of that authority approaches at the end of this year. The board’s work has not always made the privacy advocates happy; nor has it always made the national security crowd happy - a good indicator that it is serving its intended independent and objective role.

Replenishing the PCLOB board will ensure that it can effectively chart a new agenda that is timely and prospective based on the goals, needs and activities of the U.S. Intelligence Community going forward. Because the board’s membership is comprised of Senate-confirmed members, the confirmation process enables members of both parties concerned about the privacy impact of counterterrorism policies to have a voice in shaping the board’s composition, and the confidence that independent oversight within the executive branch will continue. Of the five board members, no more than three can be of one political party, and therefore congressional democrats would be consulted in the President’s appointments of at least two board members.

The board has both an oversight and an advisory function. The oversight role supports the board’s public reports, open hearings and public-facing work. If that work continues, it will likely improve both Congressional and public confidence that terrorism-related policies and practices are considering privacy and civil liberties issues. The advisory function can serve as a confidence-building mechanism more specifically within the Executive Branch, and at the White House. By exercising its advisory function, the PCLOB can help the new administration ensure that policies and practices proposed by intelligence agencies and elements are vetted by an independent body, before they are rolled out. In this regard, the board’s independent work can be an asset to a White House that intends to operate with a leaner NSC that will not have the bandwidth to conduct the type of advisory role the PCLOB could be capable of, as long as the Administration supports the PCLOB’s mission and the board is resourced sufficiently.

Moreover, if the Administration intends to revisit, reform, or otherwise streamline the Office of the Director of National Intelligence (ODNI), the PCLOB’s work may become even more important. Over the last decade, the work of the DNI’s Office of Civil Liberties, Privacy and Transparency and other ODNI components have played a critical role in conducting both on the ground and policy-level oversight of intelligence community activities, including those related to counterterrorism and surveillance. The ODNI has also been instrumental in leading efforts to improve transparency about Intelligence Community legal authorities, policies and practices.  While the PCLOB’s limited terrorism mandate and narrow privacy focus would not be able to replace these oversight activities, in the event ODNI experiences a tightening of its budget or human resources, the use of the PCLOB’s oversight activities may become more robust, and its advisory function in higher demand.

On the issue of transparency, the new administration is assuming leadership of an Intelligence Community that has moved the needle significantly when it comes to transparency regarding the handling of information collected by the Intelligence Community. A replenished and reinvigorated PCLOB that continues its public reports, hearings and engagement could play a valuable role in enhancing public confidence about new initiatives that may be under development, and are related to counterterrorism efforts.

 

from An Easy Win: Replenishing the Privacy and Civil Liberties Oversight Board (PCLOB)

The “Interior Security” Executive Order, the Privacy Act, and Privacy Shield

Yesterday’s Executive Order on “Enhancing Public Safety in the Interior of the United States” triggered alarm among privacy advocates in the U.S. and EU about the continued viability of the economically important Privacy Shield agreement.  Extending certain rights conferred by the Privacy Act of 1974 to EU citizens was “a long-standing demand of the EU” and a key element of the deal that secured Privacy Shield.  In addition, the U.S.-EU “umbrella agreement” for law-enforcement data-sharing requires the U.S. to grant Europeans these rights.

Section 14 of yesterday’s Order, read in isolation, appears to instruct federal agencies to deny Privacy Act protections to Europeans:

Sec. 14.  Privacy Act.  Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.  

Fortunately, our preliminary analysis is that the Order does not actually deny Privacy Act protections to Europeans.  An Executive Order, of course, cannot supersede a statute—which Section 14 implicitly acknowledges with its caveat “to the extent consistent with applicable law.”

The “applicable law” here is the Judicial Redress Act of 2015, codified at 5 U.S.C. § 552a note.  The Judicial Redress Act extends the right to sue conferred by the Privacy Act to citizens of “covered countries” designated by the Attorney General.  And on January 17, 2017, in a little-noticed move, the Attorney General designated 26 countries and the European Union as a whole.  That designation takes effect on February 1, 2017, when the Umbrella Agreement enters into force.

As of today, the Attorney General’s designation remains in effect. Also continuing in effect is Presidential Policy Directive (PPD)-28, which provides enhanced privacy protections to all persons regardless of nationality, in the context of U.S. signals intelligence activities. Although we have no more to go on than the text of the Order itself, we suspect that its intent in including Section 14 was geared towards the enforcement of immigration laws, and not towards influencing the global economic activity affected by Privacy Shield.

Of course, even the suggestion that the Administration is cutting back privacy protections for Europeans could be damaging in the ongoing litigation over Privacy Shield’s validity; the Court of Justice of the EU showed in the Schrems decision that is moved less by the hard facts of U.S. surveillance policy than by a hazy sense of U.S. overreach.  To fend off another Schrems-like decision, the U.S. should work to alter prevailing misperceptions about its surveillance and privacy policies.  (One of us has proposed in a recent report various steps the United States could take to do so.)  But this Executive Order is ancillary to those debates.

from The “Interior Security” Executive Order, the Privacy Act, and Privacy Shield