Transcripts For CSPAN2 Discussion On Digital Privacy 20151019

Were going to get started. Good afternoon. Im with the internet education foundation. I want to welcome you to our briefing. This event is cohosted by the Congressional Internet Caucus Advisory Committee in cooperation with the congressional internet caucus. The cochairs are representatives Bob Goodlatte and anna eshoo on the house side, and on the senate side, senators john thune and patrick leahy. We thank them for their support of educationallal events like this. And just a little bit of housekeeping before we get started, the twitter hashtag is e. U. Safe harbor, and all of our twitter accounts, the panelists information is on your program. We also have a few upcoming events, both of which are listed. On october 21st, therell be a happy hour with the Facebook Team and october 22nd the Second Annual congressional app challenge will kick off. For more information about how to get your office involved, visit our web site or talk to our executive director. Im now going to turn it over to mary ellen call a hand callahan, former chief privacy officer for the department of homeland security. Thank you very much, rachel. Thanks for coming. I want to thank my panelists who ill degreely introduce. Briefly introduce. From my far right, damian levy is the head of the trade section of the European Union to the United States. Adam. Losser is the director for the center for Global Regulatory Cooperation International at the u. S. Chamber of commerce. Gayle slater is the Vice President of the Internet Association and Amy Stepanovich is u. S. Policy manager at access. I want to thank them all for coming, and fest lets talk about what are we talking about here today, right . Were talking about boat, all sorts of sinking, that doesnt sound very good. Im going to ask my panelists to tell me whether or not im right and where were going in the future. So the safe harbor decision that was decided by the European Court of justice on october 6, 2015, actually has its origins 20 years earlier. In 1995 the European Union passed a Data Protection directive which has rules and regular rations regulations and general standards by which e. U. Member states have to adhere to Data Protection or privacy regulation. Theres a prohibition in the directive about allowing the crossborder transfer of personal data, which is very broadly defined and it pretty much is all electronic information. You cannot be have crossborder transfer unless the country to whom youre transferring the information has adequate Privacy Protections or, alternatively, some other sorts of protections. The United States has a sectoral approach to privacy and is not considered to be adequate under the european regime. It wasnt in 95, and to this day it is still not considered to have an adequate privacy regime. So whats a u. S. Company to do . From 19982000 the u. S. Department of commerce negotiated with the European Commission and created something called the u. S. e. U. Safe harbor. The u. S. e. U. Safe harbor is a regime and it basically follows the e. U. Standards, the e. U. Privacy principles. And if companies go and make a public problem that mission, i, company, adhere to the u. S. e. U. Safe harbor, theyre listed on the department of commerces web site which i believe currently disabled but they go and make a promise, and they say i agree to adhere to these standards. The federal trade commission has the authority to investigate whether or not people have the ability to whether or not they are actually keeping that promise. And you have to renew that promise every year in a public statement, and the list is about 4500 Companies Currently have safe harbor regime. That safe harbor was considered to be an adequate Legal Process under the European Commission. And theres been some questions, and there have been throughout from 2000 on there had been a lot of questions, is safe harbor sufficient, is this public promise sufficient, shouldnt there be stronger e. U. Guidance on this and so on. Kind of came to and by the way, that deal, the u. S. e. U. Safe harbor deal is an executive branch decision, so there was no congressional approval over it. It was the u. S. Department of commerce directly with the European Commission from a legislative per pebtive perspective for those in the room n. 2013 we had the unauthorized disclosures colloquially known as snowden. I try to call them the unauthorized disclosures of 2013 to not personalize this. But after those disclosures, an austrian law student went to the ireland Data Protection commissioner and said i think facebook is violating e. U. Privacy law even though they are safe harbor certified. The eye spanish dpa irish dpa said i cant decide this. The i ooh rich high court Irish High Court concurred with the Data Protection authority, then it was appealed to the European Court of justice. The European Court of justice, first, the advocate general came out with a decision late in september that said based on the u. S. systemic failures in Privacy Protection and particularly pointing out the june 2013 disclosures associated with surveillance and wholesale collection of particularly European Union citizen databased off of the reporting, that the advocate general recommended invalidating safe harbor. The European Court of justice concurred and invalidated safe harbor as of october 6th. Its a long way to get there, but i thought itd be helpful with some framing. My question to you, damian, is what did the court decide on, and whats scope of the decision . Thank you very much for this great summary. The court of justice was actually asked by the high court in dublin actually, its the firstlevel court that concur with the the dpa, and the high court did not rule against, but actually asked the court a question to court of justice asking whether or not we have this safe harbor decision of the commission of 2000. The irish Data Protection authority is telling that it doesnt have any duty to investigate this case. Is that right under e. U. Law, or is it the case that despite this decision of 2000 by the commission that rules on this side or privacy principles are equivalent to the rules on the european side . Is it the case that Still National Data Protection authorities have a duty to in fact a claim when a person to investigate a claim when a person says i think my rights have been violated . The short answer is the court is basically saying, yes, indeed. The National Authorities retain a duty to investigate a claim by citizens. And the reason why the court takes that decision is to say under e. U. Law and european charter for fundamental rights, you need the right of redress. And you need to be and so also the right to privacy of the protection of personal data is a fundamental right in our european be charter and, therefore, National Authorities have also a duty to enforce compliance of that right, if you want. And so by combining in the directive and european charter, the court comes to that conclusion. But to come to that conclusion, the court also says since the claim was the safe harbor decision of the commission of 2000 is invalid and the high court in dublin seems to go along with that decision, i mean, its not i havent read the irish court decision, i only read the European Court of justices decision. Its kind of interesting to say that the European Court said, yeah, indeed that irish court seems to go along with the things, therefore, i need to invest this issue of validity or invalidity of the safe harbor decision under e. U. Law and primary law, what we call the e. U. Treaty, if you want. Which is, anyway, equivalent to your constitution. And so the court looks at the safe harbor decision of 2000, article i and then article iii, and shecks whetherw3 itc consis that the Commission Decision remains valid under the law given the fact, given what, what has appeared since then. But also from day one. It looks at how the safe harbor arrangement is constructed. Its not a commitment by United States government. Its a system of certification by american companies, and the court says, well, thats okay. Its better that the laws protect the data of private individuals, but till its okay. And then looks at how its enforced, how its organized and enforced and comes to the conclusion i dont need to go into the details now that basically its not a sufficient protection and, therefore, the rights of the citizens are not sufficiently protected and, therefore, the Commission Decision is invalid. Im doing a very short summary of that. And so, therefore, not only the answer to the irish court is, yes, you have to tell the irish Data Protection authority, you need to investigate this case on facebook, but its also ruling [inaudible] and this ruling is binding within European Union including commission and all the national Data Protection authorities. Actually, that decision of 2000 is not valid. So the decision that the safe harbor is not valid, amy, i have a question for you. Do you think that this is a decision thats related to sur is vail lance surveillance and the unauthorized disclosures of 2013, or is it related to commercial data privacy decision . Thank you, mary ellen. So i think at its heart we have to say this is a surveillance decision. The impetus for the entire case are the 2013 revelations by the Washington Post and in the guardian about surveillance conducted specifically under section 702 of the fisa amendments act and more specifically, a program called prism. So that was these revelations were what really motivated the case to ask for an investigation, to ask for the Irish National authority to look is into safe harbor. So everything that has come out of that initial decision has come out because of surveillance. And the European Court of justices opinion really spent a lot of time looking at surveillance and looking at what the u. S. Allows and what standards the uses in order to judge what surveillance is necessary. So the rest of the world really uses International Human rights standards to guide their surveillance programs. They say that surveillance was only appropriate if it is necessary or it is proportionate. Thats a standard that the e. U. Uses, its a standard under the iccpr, the International Covenant of civil and political rights, and its a standard that kind of was incorporated into safe harbor. Theres a huge exception for National Security in safe hard hard harbor. Only if that surveillance conducted in the name of National Security or Law Enforcement or Public Safety is necessary. And so the u. S. Really, what the court of justice found is that the u. S. Practices are not necessary, and they do not insure this very high level of protection that is adequate for european data. Now, all of that said, the but is coming. Its a surveillance decision, but safe harbor is about commercial data practice. It is primarily a commercial data mechanism. And if you read through the court of justices decision, they actually spend a fair amount of time talking about the inadequacies of safe harbor, about the fact that its a selfcertified mechanism so that theres no independent audit that say if an entity is complying, that theres not enough transparency, accountability. So you have to look at the entirety of the decision and realize that anything that flows out of it also has to meet kind of these deficiencies that the court is identifying in the safe harbor mechanism also from a commercial perspective. So you really have to kind of dual consider what do we need to do from a surveillance perspective to make sure that the United States law and practice is in line with the International Standards that the e. U. Thinks it should be in line with, and also what do we have to do from a commercial privacy perspective to make sure that whatever new mechanism comes in and we will certainly talk about new mechanisms in a bit actually complies with what the court of justice thinks it should comply with. Because now that the court of justice has said that national norths have a basketball National Authorities have a ability to review decisions from the commission, we can expect any new mechanism can a also go up to the court of justice, and so you dont want another period of indecision following this where an inadequate mechanism can get struck down a couple years from now. Adam, im going to ask you the same question which is, is this a surveillance decision or a commercial pryce decision, and regardless of the answer, if you could let our audience know why transborder data flows are so important and whats the impact of this decision. Sure. Well, first, id like to add a point of clarification about the actual ruling by the court of justice. So in the ruling there was no examination of the commercial practices. It was examination of the National Security side, and it wasnt even based on an investigation. It was based on allegations and powerpoints and guardian articles. So it would be very helpful moving forward if the European Court of justice, if the Data Protection authorities could conduct a thorough investigation examining the changes to United States law made since 2013. The discussion in the ruling was based on practices as understood when safe harbor was created. And that also brings us to the point that the ruling is a process ruling. So the decision is based on the tact that when safe harbor was agreed upon, the commission, according to the court, didnt do a thorough investigation of the National Security side of how the exemption in the safe harbor would be used by the United States and what our practices were in the year 2000 when it was agreed upon. So while safe harbor was invalidated on process grounds, there is no examination yet on the commercial be side. And, in fact, the United States department of commerce, ftc and the commission have been undergoing a review and an enhancement of safe harbor for the past two years. So there are some changes in place. There was a report that was put out by the Commission Two years ago, and both seeds of the atlantic have been work both sides of the atlantic have been working very hard to satisfy the decision conditions in that report. To your question, it was a surveillance decision. Is so i think that, hopefully, answers that. The other piece is on the commercial side, the United States is has a really strong system of enforcement. If you violate your selfcertification, the ftc will carry out an enforcement action. Theres nothing like that anywhere else in the world. And the European Commission, when they conduct adequacy determinations, often do not take the enforcement side into account. So while in the United States our commercial privacy practices arent exactly in line with the european rules on paper, in words, in many areas we go above and beyond what the europeans do. In fact, some of the other governments that are deemed adequate include argentina, and im sure they have a robust system of enforcement in their own way, but im willing to bet in the United States we have stronger privacy practices how it works in reality, not just on paper. But getting to your second question about why is this whole issue important, why are we here, why do we care . Its not just spam and advertising, its the backbone of the Global Economy and the transatlantic economy. At the u. S. Chamber, we represent the interest over f of over three Million Companies in every single sector, every single size. Energy companies, manufacturing, consumer goods, hospitally, plus the internet and technology the side. Every company you can think of relies on the internet today, and you need to be able to transfer data. Something very tangible, very easy is credit cards. You travel around the world, you go to europe, you can use our credit card. Yes, you have money in your account, it goes to other companies to verify that, yes, youre you, and the purchase is satisfied within mere seconds. On the businesstobusiness side, its any company that might have business around the world, its transferring that Employee Data globally, its keeping track of a Global Customer base. Its, say, for an airplane manufacturing business, its having data on their engines while the plane is in the sky being able to troubleshoot and fix problems on the fly, literally. So theres a variety of uses for crossborder day flows, and theres an unlimited amount of reasons why it is essential to the Global Economy. Thank you. Have. Thank you very much. And were going to get back to how the safe harbor decision is impacting companies a little bit later in the program. But first, adam raised the question, amy, about whether or not the decision accurately described the u. S. Surveillance and National Security procedures both in 2000, 2013 and today. Could you tell us a little bit what your opinion is . Sure. So there have been significant changes made in u. S. Surveillance practices since 2013, and i think you have to start with recognizing that. Earlier this year we passed the usa freedom act which access and most of the other groups we work with were in sport of. Its actually the biggest restriction placed on the nsa and surveillance since the 70s. So it was a huge win. One of the things it didnt really speak to is section 702 and other sections which, as i started out saying, is what this case was filed under. So it has small steps forward on transparency in regard to those surveillance authorities, but it doesnt really change any of the practices or have substantive modifications of those surveillance authorities. So big win but doesnt touch what were talking about in this case. The question was, does the case accurately describe surveillance. So, actually, the European Court of justice decision only mentioned prism once. But they do mention this discriminate type of surveillance that is happening in the u. S. So from a perspective that youre not looking at a specific program, youre looking at 702, executive order 12333, yes, that is happening. Will they say that is exactly technically proper in regards to section 703 . There were some inaccuracies in regard to how surveillance was being conducted but the overall general programs can happen, are happening, and its because the u. S. Doesnt recognize any rights for people outside of the United States. And so this indiscriminate surveillance that they really key into absolutely is going on. I may take a little bit of a moderators liberty here which is the point that amies making is executive order 12333 makes the distinction between Domestic Intelligence and foreign intelligence. And that distinction is that there were different types and more robust types of intelligencegathering activities that can take place outside the United States as well as against foreign citizens. And so the section 702 that amie is talking about from the fisa Amendment Act has that theme within it, and section 702 does talk about Foreign Residents controls, the privacy and Civil Liberties Oversight Board did a report on 702 as did the president s review group. So i point you to those for more detailed discussions of 702. Gayle, i want to ask you a question which is, you know, damian did a great job of summarizing the decision, and as amie pointed out, consistent with u. S. Surveillance activities. Do you think that the court should have looked at e. U. Surveillance and National Security issues as well as as a comparison . So, thank you. First of all, i want to thank is your mic on . Yes. Okay, cool. I want to thank tim and [inaudible] for having me here today. My name is gayle slater. [inaudible] lights on. Let me just a moment, folks. Can you hear me now . Okay. So to reiterate, wanted to say thanks to the net caucus for having me. My name is gayle slater, im from the Internet Association. So to answer your question, i think absolutely yes is the short answer. I can explain why, and i think id like to invoke a create shy here to cliche to explain why i think the court absolutely should have looked at e. U. Surveillance at the time of the opinion. And the cliche is people in glass houses shouldnt throw stones. So look at, weve talked about this decision, and as i see it, its based on various snap snots, okay . So one of the snapshots is u. S. Surveillance in 2013 at the moment in time that the snowden revelations happened, okay . Another snapshot is u. S. Commercial privacy enforcement i think at the moment in time when the first safe harbor was entered into in the year 2000. So thats the second snapshot. And then they didnt take a third snapshot, and that was a snapshot of e. U. Surveillance through the member state intelligence agencies in 2013 also around the time of the noden revelations snowden revelations. And so i think these three snapshots are important because they all go to this question of adequacy. So the Safe Harbor Foundation is a decision taken that the u. S. System of privacy was inadequate in the year 2000 versus the e6789 e. U. s system, okay . And then they made some incremental changes, agreed to make incremental changes to the u. S. Privacy regime such that they could close the gap between the e. U. System and the u. S. System. Is so that was back in the year 2000. And then the decision comes along, and the court says that because of mass surveillance in the u. S. As revealed by Edward Snowden in 2013, the safe harbor was no longer in valid because of this inadequacy. But you have to ask yourself inadequate compared to what . And so the comparison here if were looking both at surveillance and commercial privacy has to be usurveillance. We also know from Edward Snowden also in 2013 that many e. U. Member state intelligence agencies were engaged in mass surveillance of their own citizens at that time. And the list is pretty extensive. My computer just turned off, so im going to have to log back in. [inaudible] he did. So the list includes the germans, the french, the spanish, the swede spanish the british swedish and the British Intelligence agencies. Ironically, it did not include the irish agency. Im not even sure there is an irish Intelligence Agency [laughter] but this is significant because this is, of course, where the case originated from that went to the European Court of justice. So what the snowden revelations with regard to the e. U. Member states said was that there was extensive, mass surveillance going on also in 2013 of internet traffic and phone traffic of e. U. Citizens. And so what the, what the guardian did was it revealed documents, particularly a document produced by gchq which is the British Intelligence agency, and essentially it was a scorecard across the a number of dimensions of their sister intelligence agencies. And just to give you some context here, in my experience the british are never likely to give the french a compliment unless they really deserve it. And heres what gchq had to say about the french. They described the French Agency as highly motivated, technically competent partner who have shown great willingness to engage on internet protocol issues and to work with gchq and cooperate and share with us. So that means that france is sharing surveillance information with england. Okay. Just wanted to make sure i got that. Both internet and telephoneny data. So i think this is important. I think its also important that the second snapshot i talked about which is surveillance in this country postsnowden revelations and the significant reforms that have been put in place since 2013 were not taken into account by the court. Again, this goes to this adequacy finding. And i think had the court taken into account both e. U. Surveillance and u. S. Reforms post2013 and also the sort of marketbased solution to surveillance which has increased adoption of Encryption Technologies by Association Members but also by other technology companies, the delta, the inadequacy delta well call it between the u. S. And the e. U. Systems would, i think, have declined significantly. I think its come on leaps and bounds since then. I think we can say with some confidence is probably the leading privacy Enforcement Agency in the world, and has a track record thats very significant, and a truly something thats left out of this opinion. Just to underline what gale said. Its the National Security practices on the eu, their federal level but also their member state level. Theres two pieces and damien will explain in more detail in the second, but the Member States have the competency for National Security and Law Enforcement largely in the European Union. I say we to examine the practices its their federal level and also below that. One jus his quick example of how that works in practice. Last year the court of justice reached a decision on a daily retention case Data Retention. The rule written violate i visit much like the outcome of the safe harbor case. However, it was, it is up to the Member States to government that decision. So there was no required white our set will have the decision is about. Some states got rid of their rules. Some states such as france expanded it. So thats why its important to examine the practices as they stand today on the Member States level. When we travel internationally, their seller countries where we have to get special funds because of security concerns. One of them is france. So its very interesting. I think we are reading too much into the judgments. I think we need to step back and understand what rules the court of justice has to follow in this procedure. Its procedure in terms of national court, where the high court has eu law here come safe harbor decision 2000 its only answering a question from the high court and its relying on the facts as explained or summarized in the high court decision. I would note that no americans took part in a judicial proceeding in ireland. Facebook, nor anyone else. So thats the reason why the court of luxembourg is relying on what it hears from the high court. It doesnt decide on other grounds. I think fundamentally its about the judges in luxembourg seeing at austin student has had a right of redress. He wants to have austrian he wants a court listening to his case come into decision was denying that right. I think its not more than the speed and we will talk about redress but i have a followup question based off of tales and patterns, and this is for you, damien. As you pointed out European Court of justice decided that individual member state have the authority to investigate adequacy or whether not there is sufficient protections in each of these scenarios. Do those same member state Data Protection authorities have the Oversight Authority over member state surveillance and National Study issues as adam pointed out . National security as a member state authority. I was wondering do they have that authority in their own right, visavis their own Member States . Depends. Some countries is the case sometimes it is not. Ive no doubt after this judgment all the dbas will review and Government Authority in general review their own laws and practices to make sure they are complying with the new judgment. For the Member States had a thing for handful of Member States that do have authority, oversight over National Security. Have the been any Enforcement Actions in those scenarios, do you know this because i dont know. You need to check country by country. I cannot answer that question. Thats great, thank you. Damien was a we are reading too much into the judgment. I guess my question is regardless of what we are reading into the judgment whats happening on the ground . What are companies doing as a result of the judgment . From a policy standpoint its always fun to read the judgment and speculate at sessions like this but the company we work with, to have a Legal Department and the compliance department. Its their job to make sure the company follows the law. They have to redo the judgment and read the tea leaves about whats happening around the rest of europe. And reaction to the judgment. So the first order of business is to just do a data mapping exercise and what type of data do we have thats being transmitted, what were the safe harbor bein been used for Many Companies is there a large multinational they have hundreds of vendors. An example is a hotel company. They of hotels in every Single Member state. They have the staff there. They have restaurant staff there. They have food that supplies the rest of the they have reservation list so youre looking at hundreds of individual agreements for hundreds of different entities within the one company. So its a very, very extensive and timeconsuming process to figure out what are we using the Safe Harbor Program for now, and in what to use as a substitute. Some of the suggestions are extremely complex and difficult. One suggestion was binding corporate rules. Back to take over 1 million, up to 18 months. It was over 18 months prior to the decision was going to be hundreds of Companies Seeking out approval for the. Another mechanism that had been accepted with something called model Contract Clauses, said clauses approved by authorities that companies can use to prove that they are in compliance with the law. Recently there was one german state that sent we may not think these are valid anymore. Its up to five, five, german state Data Protection authorities. The equivalent of our United States hefted their questioning whether any Data Transfer is sufficient in light of the decision from last week. Week. And without a thorough investigation so that would be helpful in providing some heft. If youre a company and you hearing this, what do you do courtship customers that rely on you, employees that rely on you. The decision isnt just about u. S. Companies. Its about companies and consumers and end users in europe come in the United States, that is something important to consider as we move forward on this issue. How is this affecting transport of data flows right now . Again, short answer to that question is, we are still in the early stages. I think its fair to say people including her son are absorbing this opinion and counseling clients as quickly as possible and steering them in the safest in the right direction. In many cases thats the eu dpas who are known to have good processes in place with regard to reviewing and giving their approval to these binding corporate rules. And also as adam said people are doing audits. So how is this affecting transport of data flows but i think its too soon to say but what we can say with certainty is this great legal uncertainty. We can also say that this is impacting we believe small businesses, mediumsize businesses more than Large Companies which includes the Large Companies which would include members of the Internet Association. The Larger Companies could see the writing on the wall and they were able to take steps and contingency plans for this. Somsummit of them already have n place binding corporate rules and theyve resorted to model contract. They have sophisticated lawyers and the resources to pay for these other instruments. For Smaller Companies i think its fair to say many of them are in a state of disarray and they dont have the resources to spend 1 million invest 18 months of manhours in getting a binding corporate rule through a european gpa. I think we can say that much. And i think there are also depend on Business Models scenarios where there literally is no alternative to the safe harbor and so that every Data Transfer but one Data Transfer weve heard about is, for example, the are not model clauses that apply for to indiabased processor of the data transmitting to a noneubased cell processor. Theres an example of where theres a gap in the law right there. Im sure youre being asked questions about that scenario. So what businesses are looking for is legal certainty, looking for quickly. There turning to the european dpas in particular we have noticed article 29 working part of which is kind of a trade association of european dpas and theyre looking for that group, they are looking, turning to them for federal guidance. Because right now we have a scenario where you could have 28 different interpretations depending on the dpas and then in addition to the 20 a plethora of german dpas at the local level interpreting the opinion in their own different ways which would obviously splinter the european the data flows before you even get to transatlantic data flows. And so thats a concern. So companies are looking for titans from all of the eu dpas to the article 29 working party and theyre looking for in a timely way. Speak at tonic the article 29 working party is meeting right now trying to figure out how to deal with this, what advice to give, i could have a de facto period of transition, have a gentlemens agreement with another phrase i heard about during a transition. And as of the time we started this session the article 29 working party had not come out with guidance yet but it may come out while we. No, and so as divisive as the trade association for the Data Protection authority. In terms of giving guidance on what they think its ugly the European Commission has made general statements in terms of looking at this. Im trying to figure out what to do. Consecutive commerce yesterday in a speech said obviously not surprising the sector was disappointed with the decision and is looking to work with the commission to figure whether safe harbor to mac can work. But i guess my question to the panelist and i t to the panelist and i will start with you, amie but it was love to hear from each one is what can congress do . Want to do Things Congress should be looking at is the fact that it was mentioned that the uk, that the eu Data Retention directive was also struck down recently. In response the uk passed another Data Retention law in order to fill that void. Recently that also was struck down. So they attempted to pass a law that would fill the void left by an eu court action and immediately, not immediatel immt quickly construct and an attitude, that theyr there bace drawing board drawing another provision that they think they need no to fill this void again. What i think the u. S. Should be trying to avoid is being in thae same situation where we take action and then are told that action was similarly not sufficient and that we have to go back again. So we should become the u. S. Congress should be looking at what it can do now. I know yesterday several members of congress both the house and senate said other to the ftc and the department of commerce asking for them to enter into new safe harbor for quickly. I think that maybe the wrong path to take because until the u. S. Congress passes comprehensive surveillance reform, you can count on the eu court of justice saying that nothing is going to be adequate enough. And so when you as so when you see freedom act that passed earlier, many members thought it was done with surveillance reform. Members of the Civil Society community were looking ahead to december 2071 of fisa in an act is set to sunset and singer not going to be done but we dont know if we can weasel and more surveillance reform until the sunset two years from now. I think we should wait those two years. We should be engaging on the fisa amendments act right now. We should be engaging substantively on executive order 12333 and try to figure what limitations and what protections we can put into place for that authority as well trying to make sure again that we are comply with International Standards that every other country that the signatory complies with. In regards to necessity and proportionality of surveillance. The final thing we should be looking at is trying to come again i think theres a necessity to read the tea leaves about what the court was saying on the commercial aspect of safe harbor and looking towards potentially a comprehensive privacy law in the United States, something that many Civil Society groups capital pushing for an trying to put into place protections so that a next time the court of justice revisited the subpoena they dont strike it out under Consumer Protection elements as well. For congress does have a huge role to play here i think. Going to turn to adam and gail to see if any thoughts. Damien, i figure you dont want to give guidance on u. S. Congress so i will give you passed. Other thoughts on how congress can help control, particularly given our audience today . So i would just go back and respond to amies position on this by saying i do feel strongly that regardless of, and damien says the ecg look at what it had in front of it and these are comments tuesday these are confusing dana point out that in the case, before the ecj it was an extensive factfinding and discovery done. And so thats what youre looking at what i saw these three snapshots and i believe all three were inaccurate. But i think that its a very, very important regardless of what the ecj has done and the court has spoken that in political conversations and negotiations Going Forward we did keep going back to this inadequacy delta and these inaccurate snapshots. Because i think what amie has mapped out is a very tall order for any congress i also dont know exactly what is needed when you look at the state of surveillance in the eu when you look at the robust enforcement by the ftc. And w when you look at the not insignificant surveillance reforms since 2013. One thing we do know for sure because damien and his colleagues at the Eu Delegation havhad said this was many times that congress can pass the redress act, and thats something that we understand going to the floor of the house soon your yes, and so that would be a significant step for because what he would do is extended eu Citizens Rights enjoyed by u. S. Citizens under the privacy act of 1974. And that is a significant step forward as we understand from the Ec Commission but also from the dpas themselves and a step forward in the right direction. The chamber, Internet Association, several others around town and companies all signed a letter supporting the judicial redress act and calling for to come to vote soon. One piece that i see report in the press all the time, its not just tech help it is, its again all businesses, a Broad Spectrum of businesses. If we had a bit more time come if theres more time to others signed a letter i know theres plenty of other countries that wouldve joined on as well. Its a big base of companies and associations that support the act. Thats one thing we can do help answer the concerns of the europeans. Out when it comes to any other changes in congress, theres things we should do for americans can ourselves not just for the europeans. If it makes sense to look at a privacy bill that maybe simplifies the rules and has a right balance between innovation and privacy, thats something we could do for america and not just for europeans. I think the immediate step to answer the courts ruling would be the judicial redress act. Anything beyond that is for the United States i think and it should be to ba borrow a word fm our european colleagues, proportional, whatever that may be. Thank you. Older gail and adam have mentioned the redress act and the judicial redress act as gail pointed out with provide all citizens the right to redress interned under a 1974 privacy act. The 1974 privacy act of are near and dear to my heart when i said homeland security. I had to enforce it. And what was, it is about the governments collection and use of personal information that you to say what you do, how to record retention policy and have the ability to provide redress to u. S. Citizens and legal permanent residents. So why was that carved out, is a question my colleagues and i asked all the time. It could be we did have a transport data flow that turn 11 has spoken so passionate about it could be that they did want to redress rights gail and adam. Asking for visas to come to u. S. Could a whole bunch of different things. It could be that when you think about filing cabinets is different when you think about the internet, the internet of things. So the judicial redress act is proposed and as gail said is moving to the house would give redress rights to european citizens are basically to given that the judicial redress act as we have described only addresses, collection and use of personal information, and even in the privacy act is preconstructed theres an exception for National Security. Does the judicial redress act solve this problem . I think we all agree that the Current Situation where we are in is in consideration of severe legal and certainty uncertain. Judicial redress act would be a big step forward to reducing the legal uncertainty. So from european perspective weve been saying this two years, officials believe he had been saying this for six years access i was negotiating with the European Commission. I think it would be very important to take this decision. But broadly i wanted to just intervene and save what government does not on the european side. What the commission is doing. First of all its our National Authorities to they need, the trade association this group of government officials representing sovereign states. The European Commission is also there to help them come to a single point of view. Thats what theyve been doing last week, yesterday and today. And everybody realized we need to give guidance to companies. Also reassure citizens on whats going on with data. So thats the number one priority. It may take a while. We need to be a bit patient. Also dont forget that three weeks ago we proposed a fundamental overhaul our whole regime have much better regime with less of urgency of applications. We really hope that the council and parliament and legislation will adopt these rules as soon as possible. Thank you. Amie come to think the the judicial redress act helps solve this problem . We support the judicial redress act but its an incremental step forward and i want to be very clear. Its a small step forward. It does give, and not necessarily eu citizens, it gives a certain countries who are certified by u. S. Authorities, so the coach are not named, not message of the country into you or only countries in the you. Certain rights under the privacy act. But again as mary ellen pointed out there are huge exceptions to it and many of the programs were talking about are not going to be covered by judicial redress. I would have at least in the senate it has been proposed as an amendment to the cybersecurity information sharing act, which many Civil Society groups both in the u. S. And abroad have outright opposed because it creates huge new surveillance loopholes for more personal information to go to the government which i think runs directly contrary to the Court Opinion were looking at now. So it is passing a law that goes and if criminal support in the name of rights to a bill that actually takes a huge step backward, is a net loss. I was wondering if you thought, damien has been focusing on thi this redress ise to get something out when i was talking to the europeans when i was at oakland security. Is redress the panacea for these data flows from her perspective on the commercial side . As edwin said its a step in the right direction but at this point its unclear what a tennessee would look like to the european side. Again, they would be panacea would look like it would be helpful to see where the current rights, not just on paper but in practice at the European Union level and at the member state level. The United States should provide or should only be asked to provide equivalent rights to those of the europeans. We shouldnt be asked to go above and beyond what is actually the practice on the ground over there. And just real quick, on the cyber information sharing act, something we support we think its very useful in helping deter bad actors. We dont see it or the act is not a loophole for more surveillance. Thats the case where his and other entities can share information with those who deter the bad actors pic its not going to give bad actors more information but instead stop. If theres a breach in one area, companies and those in charge of Information Security can Work Together to stop the same breach from happening again. Im going to ask the panel to look in their crystal ball, do a little gazing and talk about whats next for safe harbor if so, safe harbor to point out that if they negotiated between the department of commerce and the European Commission 2. 0. Is that dead on arrival . Does that add you like with what we think will go on without . What it out the u. S. The relationship . Or are we thinking were going with this . I would ask you to think the short term, whats going to happen as all kind of work out this legal uncertainty i think was a danish phrase and secondly a mediumterm what do we think the relationship should trend towards in the future. I think i will start with amie and then work down the line, please. I cant i dont know if any new mechanism is going to work in love comprehensive surveillance reform. I just dont know if we can find a mechanism that complies with this courts opinion is lou of changing the standard under which the United States conduct surveys. I agree with the deal theres a problem with surveys indicate that the public surveillance around the world. Theres a problem with surveillance. And recut to get as much authority as they possibly can to conduct and we need to start looking seriously and holistically out all of these countries practices in pulling it back. Right now we need to look at the United States practices because thats what stand in way of a new mechanism. Axis have supported the model Contract Clauses that were mentioned but we called it model Contract Clauses plus because we think they need to include more robust mechanism for transparent to end for Data Security in order to protect against unauthorized access to data. Such as whats happening, for example, in the nsa was tapping into the backbone between google or yahoo data centers but we think thats not necessarily a good thing for surveillance agencies to be doing so we think that that it needs be protected or wisely. Were looking forward to engaging more thoroughly at least in the short term on that as a new mechanism and then looking longerterm out how to engage on protecting privacy from a very holistic point of view. The model contract currently proposed by the commission can be added to think amies comments about model contract plus would have to get folded into any sort of provision on the European Commission site. It is a pretty frustrating contract, if i could have a little discretion to say that the its a very rigid in terms of the opportunities. Gail what you think is next for safe harbor and the transatlantic relationship . The first of all i have to say just for the record, the unit associate supports surveillance reform but we are also aware that congress has a lot on its plate and so we have to be realistic in this context. The other thing i would say by the relationship with you. I dont know some elder statesman used to say the problem with the eu is theres no one phone line. Who are going to pick up the phone to talk to the eu . In this scenario we have many different stakeholders within the eu. I think in talking to the commission, damien is representing the commission, he can speak for them, i think theres a sense in which the Commission Wants to do the right thing. Their decision was invalidate the bad egg on their face and want to try to turn this one. They been negotiating in good faith with the Commerce Department here. They were close to signing safe harbor, safer harbor 2. 0. Lets hope it comes to pass in but i know that people within the Commission First have to look at this opinion and take a close look at it and decide what the new parameters their operating under are. We also to parliament that is very vocal depend on where you go in the Eu Parliament on this issue. Thats a constraint on the commission. The commission has been mindful and then we have atpase in which we now know there are 28 plus 15 in germany. And so theyre all going to have to want to Say Something about a safer harbor 2. 0. These are all checks and balances the commission has been mindful of Going Forward. And so thats the eu. Thats a lot of different stakeholders at the dont pretend to speak for any of them but they are all important voices. Look at come in the meantime i said already, i cant say it often enough and were looking to the eu dpas working through their trade association, the 29 working party to issue guidance thats helpful to businesses. Businesses who signed up for the safe harbor, there are 4500 of them, did so in good faith. They complied with the safe harbor for the most part it if it didnt the ftc went after them. There was backstop enforcement. So then i look at this legal vacuum at the tokyo theyre done anything wrong. The government did it but they need guidance. Whats next . The relationship between the United States and the European Union is just too important to we transfer 15 terabytes of information a second. Its a gigantic number. Were literally trillions of investment those going back and forth. The safe harbor decision to go just the one program. If we cant share information from if we cant carry on and monitor our investment, that is a gigantic loss not just . Guest politically but around the globe. To paraphrase a quote Vice President joe biden, its its really important speed what does that spell, adam . Big friendly discussion. Speaks ritually important that the governments on both sides of the atlantic get together and work on finding a solution quickly, not dealing. We need to preserve the relationship Going Forward. And what we need is responsible governments, having a conversation build connections got not to tear them down. Ascended Congress Committee sent a letter urging quick action. I would like to see more in the Congress Getting involved, talking to the counterparts on the other part of the lady. Theres over well encouraging a swift resolution to the issue at hand. And damien, what do you think is next . Whats next, i hope the redress action is fast and together were working on new safe harbor arrangements, taking into account what the court has said. Nobody has an interest in having a new safe harbor 2. 0 in a couple months time. We needed take a deep breath and make sure the new arrangement is as solid as we can. Thank you. Great. With that said were at the top of the outfit i want to thank my 10 for actual discussion and want to thank all of you. Thanks, have a good night. [applause] [inaudible conversations] later today will get a look at the syrian refugee crisis with officials from the state department and the u. N. They will discuss the Global Response so far and other humanitarian issues that still need to address. That is being hosted by the Bipartisan Policy Center and we have it live at 11 a. M. Eastern on cspan. This afternoon were live from capitol hill for hearing on pending legislation that would create a new mandatory minimum sentence for those caught aiding terrorists and reduce other sentences for nonviolent crimes. That is being held by the Senate Judiciary committee. We get underway at 3 00 eastern with live coverage on cspan. Tonight on cspans new series landmark cases, by 1830 the Mississippi River iran new orleans had become a breeding ground for cholera and yellow fever partly due to slaughter houses in the area dumping a byproduct into the river. To address this problem louisiana allowed only one government run the slaughterhouse, Crescent City come to operate in the City District and the other houses to into corporate all the slaughterhouse cases of 1873. Be sure to join the conversation as we take your calls, tweets and Facebook Comments during the Program Using the hashtag landmark cases, live tonight on cspan, cspan3 and cspan radio. For background on each case what you watch order your copy of the landmark cases companion book. It is available for 8. 95 plus shipping at cspan. Org landmarkcases. Next editorial cartoonist from the Washington Post, the lancet journal constitution and other Media Outlets discuss their work during the george w. Bush presidency. They spoke about their methods for detecting serious issues and extent they go into adequate wiseacre subject. Is the part of a threeday conference on the Bush Administration hosted by Hofstra University india. India. 0te minutes. Ur and 2 welcome to political cartoe political cartoonists and the george w. Bush presidency. My name is lawrence levy, and def