ARTICLE 29 DATA PROTECTION WORKING PARTY

In particular, Section 1 of PPD-28 provides that U.S. signals intelligence activities must
always be ‘as tailored as feasible’. While recognising this limitation, it is difficult to
determine whether ‘as tailored as feasible’ means that all data collection is necessary and
proportionate.
PPD-28 recognises that bulk collection continues to be permitted “in order to identify new or
emerging threats and other vital national security information that is often hidden within the
large and complex system of modern global communications”. 46 The WP29 notes that PPD-
28 states that “signals intelligence collected in ‘bulk’ means the authorised collection of large
quantities of signals intelligence data which, due to technical or operational considerations, is
acquired without the use of discriminants (e.g., specific identifiers, selection terms, etc.)”.
PPD-28 imposes limits on the use of signals intelligence collected in bulk as regards the
purpose of the use. These six purposes for which data can be collected in ‘bulk’, including
counter-terrorism and other forms of serious (transnational) crimes. The WP29’s analysis
suggests that the purpose limitation is rather wide (and possibly too wide) to be considered as
targeted.
PPD-28 has not removed the possibility for the indiscriminate collection of personal data in
bulk and that the scale of such collection possibilities remains unclear and potentially broad.
In this regard, the WP29 notes that in Annex VI, the ODNI affirms that “any bulk collection
activities regarding internet communication that the U.S. Intelligence Community performs
through signals intelligence operate on a small portion of the Internet 47 and therefore would
appreciate further evidence being provided through transparency measures.
3.3.2 Foreign Intelligence Surveillance Act
The Section 215 and Section 702 FISA minimisation procedures were introduced in order to
protect U.S. persons from far reaching government access to their data. These limitations do
not officially apply to foreigners, even though U.S. government officials have stated
repeatedly in both public and private meetings with WP29 representatives that the scope of
application of the minimisation procedures has since in practice been extended to cover all
persons, no matter their nationality or habitual place of residence.
Section 702 specifies that an acquisition authorised “shall be conducted in a manner
consistent with the Fourth Amendment to the Constitution of the United States limiting data
collection to what is considered as compliant with the reasonable search principle. In this
regard, no difference is made between U.S. and non U.S. companies”. In other words, under
the condition that the Fourth Amendment applied to all data collected in the U.S., ‘bulk’
collection taking place in the U.S. would be ‘unreasonable’ and thus unconstitutional.
46 PPD-28, Section 2 and Privacy Shield Annex VI, Office of the Director of National Intelligence (ODNI) letter regarding
safeguards and limitations applicable to U.S. national security authorities, p. 3
47 Privacy Shield Annex VI, Office of the Director of National Intelligence (ODNI) letter regarding safeguards and
limitations applicable to U.S. national security authorities, p. 4; the WP29 recalls in this regard the report of the findings by
the EU Co-Chairs of the ad hoc EU-US Working Group on Data Protection, which states that “Communications data make
up a very small part of global internet traffic”, given that the “vast majority of global internet traffic consists of high-volume
streaming and downloads such as television series, films and sports” (§3.1.2 of the report)44
38