2022-22234. Data Protection Review Court

AGENCY:

Department of Justice.

ACTION:

Final rule.

SUMMARY:

As authorized and directed by the Executive order of October 7, 2022, “Enhancing Safeguards for United States Signals Intelligence Activities,” this rule amends Department of Justice regulations to establish within the Department a Data Protection Review Court (“DPRC”). The DPRC will review determinations made by the Civil Liberties Protection Officer of the Office of the Director of National Intelligence (“ODNI CLPO”) in response to qualifying complaints that allege certain violations of United States law in the conduct of United States signals intelligence activities. Applications for review by the DPRC must be filed by individuals through the appropriate public authority in a designated foreign country or regional economic integration organization. To facilitate their independent and impartial review, DPRC judges will not be subject to the day-to-day supervision of the Attorney General and will be subject to removal protections. DPRC decisions, including the direction of appropriate remedial measures to be undertaken by United States intelligence agencies, will be final and binding. Individual complainants will not be informed whether they were subject to signals intelligence activities, but instead will receive a standardized notice that states that the DPRC's review has been completed and either did not identify any covered violations or the DPRC issued a determination requiring any appropriate remediation.

DATES:

This rule is effective October 14, 2022.

FOR FURTHER INFORMATION CONTACT:

J. Bradford Wiegmann, Deputy Assistant Attorney General, National Security Division, United States Department of Justice, Washington, DC 20530; telephone: [phone].

SUPPLEMENTARY INFORMATION:

I. Background

Section 3 of the Executive order of October 7, 2022 authorizes and directs the Attorney General to issue regulations to establish a Data Protection Review Court as the second level of a two-level redress mechanism. The redress mechanism will provide for the review of qualifying complaints by individuals, filed through appropriate public authorities in designated foreign countries or regional economic integration organizations, alleging certain violations of United States law concerning United States signals intelligence activities. The Executive order of October 7, 2022 implements commitments made by the United States as part of the U.S.-EU Data Privacy Framework announced in March 2022 to foster trans-Atlantic data flows. The Framework was developed in response to a 2020 ruling by the Court of Justice of the European Union that invalidated the European Commission's “adequacy decision” for the United States, which was part of the then-existing U.S.-EU Privacy Shield Framework.

The new redress mechanism established by the Executive order of October 7, 2022 will have two levels. The first level is the investigation, review, and determination by the Civil Liberties Protection Officer of the Office of the Director of National Intelligence (“ODNI CLPO”) of whether a covered violation occurred and, where necessary, the appropriate remediation in response to a qualifying complaint. As a second level, the complainant or an element of the Intelligence Community may seek review by the DPRC of the ODNI CLPO's determinations.

The DPRC will be established within the Department of Justice (“Department”), consisting of individuals chosen from outside the United States Government, to provide independent and impartial review of applications for review. Exercising the Attorney General's authority under 28 U.S.C. 511 and 512 to provide his advice and opinion on questions of law and the authority delegated to the Attorney General under the Executive order of October 7, 2022, as delegated to the DPRC in this rule by the Attorney General pursuant to 28 U.S.C. 510, the DPRC will review whether the ODNI CLPO's determination regarding the occurrence of a covered violation was legally correct and supported by substantial evidence and whether, in the event of a covered violation, the ODNI CLPO's determination as to the appropriate remediation was consistent with the Executive order of October 7, 2022.

II. Discussion of Rule

This rule establishes within the Department a DPRC. The DPRC will review, upon an application for review, the ODNI CLPO's determinations made in response to a qualifying complaint, transmitted through the appropriate public authority in a designated foreign country or regional economic integration organization, from an individual who alleged a covered violation of United States law in the conduct of United States signals intelligence activities that adversely affected the complainant's individual privacy and civil liberties interests.

The DPRC will consist of six or more judges appointed by the Attorney General from outside the United States Government. To facilitate their independent and impartial review of the applications for review, the judges will not be subject to the day-to-day supervision of the Attorney General and may not be removed or subjected to other adverse action arising from their service on the DPRC, except for instances of misconduct, malfeasance, breach of security, neglect of duty, or incapacity. The DPRC panels will have access to the classified national security information they need to conduct their reviews and make decisions. In accordance with section 3(d)(ii) and (iv) of the Executive order of October 7, 2022, those decisions, including the direction of appropriate remedial measures, will be final and binding with respect to the application for review.

Applications for review may be filed by an individual complainant after receiving notification that the ODNI CLPO has completed its review or by an element of the Intelligence Community. Applications for review by complainants must be filed through the appropriate public authority in a “qualifying state,” which is defined under the rule as a country or regional economic integration organization designated as a qualifying state by the Attorney General under section 3(f) of the Executive order of October 7, 2022.

Each application will be reviewed by a three-judge panel of the DPRC convened by the Department's Office of Privacy and Civil Liberties (“OPCL”). Once convened, the presiding judge on the DPRC panel will select a Special Advocate who, in accordance with section 3(d)(i)(C) of the Executive order of October 7, 2022, will assist the panel by advocating regarding the complainant's interest in the matter and by ensuring that the panel is well informed regarding the issues and the law. The Special Advocate will not be the agent of or have an attorney-client relationship with the complainant and, in the interest of national security, will be subject to restrictions on communications with the complainant and the complainant's counsel to ensure that classified or otherwise privileged or protected information, including whether or not the complainant was subject to United States signals intelligence activities, is not disclosed.

Each DPRC panel will review the application before it to determine whether the ODNI CLPO's determination regarding whether a covered violation occurred was legally correct under the applicable law and supported by substantial evidence and whether any appropriate remediation was consistent with the Executive order of October 7, 2022. If the DPRC panel decides that the CLPO's determination does not meet these requirements, the panel will issue its own determination, including any appropriate remediation. In conducting this review, the panel will interpret the Executive order of October 7, 2022 exclusively according to United States law and legal traditions and, more generally, will be guided by decisions of the United States Supreme Court in the same way as a court established under Article III of the United States Constitution, including decisions on the appropriate deference to be provided relevant determinations of national security officials.

The panel will conduct its review based on the record of the ODNI CLPO's review, supplemented by any information or submissions from the complainant, the Special Advocate, or an element of the Intelligence Community. The DPRC panel may also request that the ODNI CLPO supplement the record in response to specific questions from the panel. The DPRC panel's decision will be by majority vote, and the panel will issue a written decision setting out its determinations and the specification of any appropriate remediation.

The individual complainant will not be informed whether they were subject to signals intelligence activities. Instead, the individual will receive a standardized notice that states that the DPRC's review has been completed, namely that “the review either did not identify any covered violations or the Data Protection Review Court issued determinations requiring appropriate remediation,” and that the notification constitutes final agency action.

OPCL will provide administrative support to the DPRC and the Special Advocates.

III. Regulatory Certifications

A. Administrative Procedure Act

This rule involves the foreign affairs function of the United States, relates to a matter of agency management or personnel, and involves a matter relating to agency organization, procedure, or practice. As such, this rule is exempt from the usual requirements of prior notice and comment and a 30-day delay in the effective date. See 5 U.S.C. 553(a)(1), (a)(2), (b), and (d).

B. Regulatory Flexibility Act

An analysis under the Regulatory Flexibility Act was not required for this rule because the Department was not required to publish a general notice of proposed rulemaking for this matter. See 5 U.S.C. 601(2), 604(a).

C. Unfunded Mandates Reform Act of 1995

This rule will not result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year (adjusted for inflation), and it will not significantly or uniquely affect small governments. Therefore, no actions are necessary under the provisions of the Unfunded Mandates Reform Act of 1995, 2 U.S.C 1501 et seq.

D. Congressional Review Act

This rule is not a major rule as defined by the Congressional Review Act, 5 U.S.C. 804(2). Further, because it relates to agency management or personnel, it is not a “rule” as that term is used in the Congressional Review Act, 5 U.S.C. 804(3)(b), and, accordingly, the reporting requirements of 5 U.S.C. 801 do not apply.

E. Paperwork Reduction Act of 1995

This rule does not impose any new reporting or recordkeeping requirements under the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq.

F. Executive Orders 12866 and 13563—Regulatory Review

Because the rule involves the foreign affairs function of the United States, it is not a “regulation or rule” under section 3(d) of Executive Order 12866, “Regulatory Planning and Review,” and the requirements of that order and Executive Order 13563, “Improving Regulation and Regulatory Review,” accordingly, do not apply. Nevertheless, this rule has been drafted and reviewed in accordance with section 1(b) of Executive Order 12866 and section 1(b) of Executive Order 13563.

G. Executive Order 13132—Federalism

This rule will not have substantial direct effects on the States, on the relationship between the National Government and the States, or on the distribution of power and responsibilities among the various levels of government. Therefore, in accordance with section 6 of Executive Order 13132, “Federalism,” the Department has determined that this rule does not have sufficient federalism implications to warrant the preparation of a federalism summary impact statement.

H. Executive Order 12988—Civil Justice Reform

This rule meets the applicable standards set forth in sections 3(a) and 3(b)(2) of Executive Order 12988, “Civil Justice Reform.”

List of Subjects in 28 CFR Part 201

• Claims
• Foreign relations
• Privacy
• Signals intelligence

Accordingly, for the reasons set forth in the preamble, the Department of Justice adds part 201 to chapter I of title 28 of the Code of Federal Regulations to read as follows:

PART 201—DATA PROTECTION REVIEW COURT

201.1

Purpose.

201.2

Definitions.

201.3

Appointment of judges and rules of procedure.

201.4

Appointment of Special Advocates.

201.5

Administrative support for the DPRC.

201.6

Applications for review.

201.7

Convening of panels, conduct of judges, and independence of the DPRC.

201.8

Special Advocates.

201.9

Consideration of applications and decisions.

201.10

Guiding principles of law.

201.11

Information security and classified national security information.

201.12

Disclaimer.

Authority: 5 U.S.C. 301; 28 U.S.C. 509, 510-512; Executive order of October 7, 2022.

§ 201.1

Purpose.

This part establishes an independent and impartial Data Protection Review Court (DPRC) to consider, in classified proceedings, applications for review of determinations made by the Civil Liberties Protection Officer of the Office of the Director of National Intelligence (ODNI CLPO) in response to qualifying complaints submitted through the redress mechanism established pursuant to section 3 of the Executive order of October 7, 2022, “Enhancing Safeguards for United States Signals Intelligence Activities.”

§ 201.2

Definitions.

The terms “appropriate remediation,” “covered violation,” “element of the Intelligence Community,” “Intelligence Community,” “national security,” and “qualifying complaint” shall have the same meanings as they have in the Executive order of October 7, 2022. The term “qualifying state” means a country or regional economic integration organization designated as a qualifying state by the Attorney General pursuant to section 3(f) of the Executive order of October 7, 2022.

§ 201.3

Appointment of judges and rules of procedure.

(a) The Attorney General shall, in consultation with the Secretary of Commerce, the Director of National Intelligence, and the Privacy and Civil Liberties Oversight Board (PCLOB), appoint not fewer than six individuals to serve as judges on the DPRC for four-year renewable terms, choosing individuals who at the time of their initial appointment have not been employees of the executive branch in the previous two years.

(b) The Attorney General's appointments shall be informed by the criteria used by the executive branch in assessing candidates for the Federal judiciary, giving weight to any prior judicial experience, and shall be of individuals with appropriate experience in the fields of data privacy and national security law. The Attorney General shall endeavor to ensure that at least half of the judges at any given time have prior judicial experience, and all persons appointed as judges shall be active members in good standing of the bar of a State, Commonwealth, Territory, or Possession, or of the District of Columbia and shall be duly licensed to practice law.

(c) During their term of appointment as judges on the DPRC, such judges shall not have any official duties or employment within the United States Government other than their official duties and employment as judges on the DPRC.

(d) The DPRC shall review and adopt by majority vote rules of procedure consistent with the Executive order of October 7, 2022 and this part, which thereafter shall be made publicly available and applied by each DPRC panel convened under § 201.7(a). The rules of procedure may thereafter be amended at such times and in such ways as a majority of the judges may deem necessary and appropriate to accomplish the work of the DPRC. A quorum of six judges shall be required for the initial adoption of and any amendments to the rules of procedure.

§ 201.4

Appointment of Special Advocates.

(a) The Attorney General shall, in consultation with the Secretary of Commerce, the Director of National Intelligence, and the PCLOB, appoint no fewer than two individuals to serve as Special Advocates for two-year renewable terms, choosing individuals who at the time of their initial appointment have not been employees of the executive branch in the previous two years.

(b) All persons appointed as Special Advocates shall have appropriate experience in the fields of data privacy and national security law, shall be experienced attorneys and active members in good standing of the bar of a State, Commonwealth, Territory, or Possession, or of the District of Columbia, and shall be duly licensed to practice law.

§ 201.5

Administrative support for the DPRC.

(a) The Office of Privacy and Civil Liberties of the Department of Justice (OPCL) shall be responsible for providing administrative support to the DPRC and the Special Advocates.

(b) The administrative support provided by OPCL shall include the following functions:

(1) Facilitating the Attorney General's consultations with other officials regarding the appointment of judges and Special Advocates;

(2) Drafting in consultation with relevant agencies rules of procedure and, when requested by the DPRC, any amendments thereto for consideration by the DPRC;

(3) Receiving applications for review of determinations made by the ODNI CLPO and receiving from the ODNI CLPO its record of review;

(4) Receiving and maintaining the confidentiality of any written information that a complainant filing an application for review wishes to provide to the DPRC and of any responses the complainant or their counsel provides to questions from the Special Advocate;

(5) Coordinating with the ODNI CLPO as needed on matters arising from an application for review;

(6) Securely maintaining records pursuant to applicable law;

(7) Making publicly available information about the DPRC, including the names of the judges and Special Advocates, the rules of procedure, and the process for filing an application for review, and such other information as the DPRC in its discretion deems appropriate for its function; and

(8) Providing other administrative support to the DPRC, its panels and judges, and the Special Advocates.

§ 201.6

Applications for review.

(a) A complainant may apply for review by the DPRC of a determination made by the ODNI CLPO in response to a qualifying complaint submitted by the complainant by filing an application for review with the appropriate public authority in a qualifying state, for forwarding to OPCL, no later than sixty (60) days after the date, as reported to OPCL by the appropriate public authority in a qualifying state, on which the complainant receives notification that the ODNI CLPO has completed its review.

(b) The complainant shall submit with the application for review, through the appropriate authority in a qualifying state, any information, including argument on questions of law or the application of law to the facts, that the complainant wishes to provide to the DPRC. The complainant may be represented by counsel in submitting this information. OPCL shall maintain the confidentiality of such information.

(c) An element of the Intelligence Community may apply for review by the DPRC of a determination made by the ODNI CLPO by filing an application for review with OPCL no later than sixty (60) days after the date on which the element of the Intelligence Community receives notification from the ODNI CPLO that the ODNI CLPO has completed its review of the qualifying complaint. An application for review filed by an element of the Intelligence Community may include any information that the element of the Intelligence Community wishes to provide to the DPRC, including argument on questions of law or the application of law to the facts. To prevent the disclosure of classified or otherwise privileged or protected information, the DPRC, Special Advocates, and OPCL shall not provide to the complainant any information relating to the existence, review, or outcome of any application for review filed by an element of the Intelligence Community.

§ 201.7

Convening of panels, conduct of judges, and independence of the DPRC.

(a) Upon receipt of an application for review, OPCL shall convene a panel of the DPRC by selecting three judges on a rotating basis, while ensuring if possible that at least one of the judges selected has prior judicial experience.

(b) The three judges on a DPRC panel shall select a presiding judge by unanimous agreement. If agreement is not reached within five (5) days of the convening of the DPRC panel, the presiding judge shall be the judge who was selected first by OPCL who has prior judicial experience; if no judge on the DPRC panel has such experience, the presiding judge shall be the judge selected first by OPCL.

(c) Judges on a DPRC panel shall conduct themselves in accordance with the Code of Conduct for United States Judges, except that a judge may participate in extrajudicial activities, including business activities, financial activities, non-profit fundraising activities, fiduciary activities, and the practice of law, where such extrajudicial activities do not interfere with the impartial performance of the judge's duties or the effectiveness or independence of the DPRC.

(d) A DPRC panel and its judges shall not be subject to the day-to-day supervision of the Attorney General. The Attorney General shall not remove a judge from a DPRC panel, remove a judge from the DPRC prior to the end of the judge's term of appointment under § 201.3(a), or take any other adverse action against a judge arising from service on the DPRC, except for instances of misconduct, malfeasance, breach of security, neglect of duty, or incapacity, after taking due account of the standards in the Rules for Judicial-Conduct and Judicial-Disability Proceedings promulgated by the Judicial Conference of the United States pursuant to the Judicial Conduct and Disability Act (28 U.S.C. 351 et seq.).

§ 201.8

Special Advocates.

(a) After a DPRC panel is convened under § 201.7(a), the presiding judge shall select a Special Advocate to assist the panel in the consideration of the application for review.

(b) The Special Advocate shall upon selection receive from OPCL the application for review and any information that the complainant provided under § 201.6(b). The Special Advocate shall not be the agent of the complainant, consistent with the rules of professional responsibility, and there shall be no attorney-client relationship between the Special Advocate and the complainant.

(c) The Special Advocate shall also have access to the record of the ODNI CLPO's review and any information or submissions provided to the DPRC panel by an element of the Intelligence Community.

(d) To prevent the disclosure of classified or otherwise privileged or protected information, the Special Advocate shall adhere to the following rules on communications with the complainant or the complainant's counsel:

(1) If the complainant did not file an application for review, the Special Advocate shall not communicate with the complainant or the complainant's counsel.

(2) If the complainant did file an application for review, the Special Advocate may at any stage submit to OPCL written questions for the complainant or the complainant's counsel. OPCL shall, in consultation with relevant elements of the Intelligence Community, review any such questions to ensure they do not disclose any classified or otherwise privileged or protected information and, subject to that limitation, shall convey the questions through the appropriate public authority in a qualifying state to the complainant or the complainant's counsel, with an invitation to provide written responses to the Special Advocate through the appropriate public authority in a qualifying state.

(e) The Special Advocate shall assist the DPRC panel in its consideration of the application for review, including by advocating regarding the complainant's interest in the matter and by ensuring that the DPRC panel is well informed of the issues and the law with respect to the matter. Where the complainant has filed an application for review, the submissions of the Special Advocate to the DPRC shall include the complainant's application for review and the information and responses to questions submitted to the Special Advocate by the complainant.

(f) Affected elements of the Intelligence Community shall be provided an opportunity to respond to submissions made by the Special Advocate.

§ 201.9

Consideration of applications and decisions.

(a) A DPRC panel shall consider an application for review in a manner that is timely, impartial, and consistent with the Executive order of October 7, 2022 and this part in order to determine whether a covered violation occurred and, if so, to determine any appropriate remediation.

(b) A DPRC panel shall conduct its review based on the record of the ODNI CLPO's review and any information or submissions provided by the complainant, the Special Advocate, or an element of the Intelligence Community. A DPRC panel may request that the ODNI CLPO supplement the record with specific explanatory or clarifying information and that the ODNI CLPO make additional factual findings where necessary to enable the DPRC panel to conduct its review.

(c) If the DPRC panel finds no evidence in the record indicating that signals intelligence activities occurred involving personal information of or about the complainant, the DPRC panel shall render a decision to that effect.

(d) In all other cases, the DPRC panel shall determine:

(1) Whether, under the applicable law as set forth in the definition of a covered violation in the Executive order of October 7, 2022, the ODNI CLPO's determination whether a covered violation occurred was legally correct and supported by substantial evidence; and

(2) Whether, in the event of a covered violation, the ODNI CLPO's determination as to the appropriate remediation was consistent with the Executive order of October 7, 2022.

(e) If a DPRC panel decides that a determination by the ODNI CLPO does not meet the standard set out in paragraph (d) of this section, the DPRC panel shall issue its own determination.

(f) Prior to determining an appropriate remediation under paragraph (e) of this section, a DPRC panel shall seek through the ODNI CLPO the views of affected elements of the Intelligence Community regarding the appropriate remediation, including an assessment of impacts on the operations of the Intelligence Community and the national security of the United States. The panel shall take due account of these views as well as customary ways of addressing a violation of the type identified.

(g) A DPRC panel shall make its decision by majority vote. Each DPRC panel shall issue a written decision setting out its determinations and the specification of any appropriate remediation. The decision of each DPRC panel shall be final and binding with respect to the application for review before it and shall be controlling only as to that application for review.

(h) After the issuance of a written decision under paragraph (g) of this section, OPCL shall forward the decision to the ODNI CLPO. If the complainant submitted an application for review in the case, OPCL shall notify the complainant through the appropriate public authority in a qualifying state, without confirming or denying whether the complainant was subject to signals intelligence activities, that:

(1) The DPRC completed its review;

(2) The review either did not identify any covered violations or the Data Protection Review Court issued a determination requiring appropriate remediation; and

(3) The notification to the complainant constitutes the final agency action in the matter.

(i) A DPRC panel shall provide a classified report on information indicating a violation of any authority subject to the oversight of the Foreign Intelligence Surveillance Court to the Assistant Attorney General for National Security, who shall report violations to the Foreign Intelligence Surveillance Court in accordance with its rules of procedure.

(j) For each application for review, OPCL shall maintain a record of the information reviewed by the DPRC panel and the decision of the DPRC panel, which records shall be made available for consideration as non-binding precedent to future DPRC panels considering applications for review.

§ 201.10

Guiding principles of law.

(a) The Executive order of October 7, 2022 and its terms shall be interpreted by the DPRC exclusively in light of United States law and the United States legal tradition, and not any other source of law.

(b) In a DPRC panel's review of an application under § 201.9, the DPRC panel shall be guided by relevant decisions of the United States Supreme Court in the same way as are courts established under Article III of the United States Constitution, including those decisions regarding appropriate deference to relevant determinations of national security officials.

§ 201.11

Information security and classified national security information.

(a) All proceedings before and other activities of the DPRC and all activities of the Special Advocates shall be governed by Executive Order 13526 of December 29, 2009, “Classified National Security Information,” or any successor order, and this part.

(b) Judges may serve on a DPRC panel convened under § 201.7(a), and Special Advocates may be selected to assist a DPRC panel under § 201.8(a), only if they hold the requisite security clearances to access classified national security information. The DPRC and Special Advocates shall have no authority to declassify or grant any person access to any classified or otherwise privileged or protected information, including the information reviewed in or information about the existence or outcome of any proceedings before the DPRC or any information that would tend to reveal whether a complainant was subject to signals intelligence activities.

(c) The Department of Justice Security Officer shall be responsible for establishing security procedures for proceedings before and other activities of the DPRC and the Special Advocate, and for amending those procedures as necessary.

§ 201.12

Disclaimer.

This part governs the ability to obtain review of the ODNI CLPO's determinations by the DPRC in accordance with the redress mechanism established in section 3 of the Executive order of October 7, 2022. This part is not intended to, and does not, create any other entitlement, right, or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person. This part is not intended to, and does not, modify the availability or scope of any judicial review of the decisions rendered through the redress mechanism, which is governed by existing law.

Dated: October 7, 2022.

Merrick B. Garland,

Attorney General.