ARTICLE 29 DATA PROTECTION WORKING PARTY

(including conditions for the retention and dissemination of the data), data security and access
by relevant staff [i.e. rules containing safeguards limiting the risks of abuse and improper
use], data quality and oversight. These guarantees apply regardless of the nationality of the
data subjects, i.e. to U.S. and non-U.S. persons.
During the transmission of the data to the U.S., the safeguards established by PPD-28 are
also applicable. Annex VI contains a commitment of the ODNI that if the U.S. Intelligence
Community were to collect data from transatlantic cables while it is being transmitted to the
United States, “it would do so subject to the limitations and safeguards set out herein,
including the requirements of PPD-28” 41 . WP29 notes that there continues to be a lack of
established jurisprudence determining the legality of cables interception if it were to be
carried out by any country. In any case, the U.S. neither confirms nor deny that they do use
cables interception as a means for intelligence data collection.
The concept of ‘signals intelligence’ is not defined in PPD-28 nor in any other applicable text.
3.2.2 Foreign Intelligence Surveillance Act
Overall, the text of FISA appears to be clearer and more precise. However, the interpretation
of many provisions in the light of PPD-28 and thus their practical application largely depends
on the implementation made by the various agencies. While a full report on the
implementation of the new safeguards is not yet available, U.S. delegates have informed
representatives of the WP29 that the implementation of the PPD-28 safeguards has indeed
been completed and is carried out in a similar way across the U.S. intelligence community.
More precisely, Section 501 is relatively clear on the kind of intelligence operations that can
be mandated: “the production of any tangible things (including books, records, papers,
documents, and other items)”. However, it should be noted that the fact that the definition of
‘tangible things’ includes ‘other items’ makes the scope of this authority quite broad.
Section 702, which allows for data to be collected from non-U.S. persons reasonably believed
to be outside the United States in order to obtain foreign intelligence information, 42 does not
provide the same level of detail as Section 501. Concerning its scope, Section 702 targets
electronic communications service providers established in the U.S. for the collection of
foreign intelligence information of individuals located outside the U.S. The definition of
‘foreign intelligence information’ is broad. It includes amongst others, “information with
respect to a foreign power or foreign territory that relates to the conduct of foreign affairs of
the United States” 43 which raises some uncertainty as to the type of information that can be
collected in practice.
40 “Signals intelligence activities shall be as tailored as feasible. In determining whether to collect signals intelligence, the
United States shall consider the availability of other information, including from diplomatic and public sources. Such
appropriate and feasible alternatives to signals intelligence should be prioritised.” (Section 1(d))
41 Privacy Shield Annex VI, Office of the Director of National Intelligence (ODNI) letter regarding safeguards and
limitations applicable to U.S. national security authorities, p. 2
42 50 U.S. Code §1881a (D)(1)
43 50 U.S. Code § 1801 (e) (2).
36