Executive Summary  i

1. Introduction 1

2. Background  3
2.1 Schrems I and Safe Harbor  3
2.2 Schrems II and the EU-US Privacy Shield  5

3. The Commission’s Adequacy Decision and Executive Order 14086  9
3.1 EO 14086: Scope and safeguards12
3.1.1 Signals intelligence and large-scale surveillance 12
3.1.2 Onward transfers 19
3.1.3 Redress mechanism 20

4. EU law and the Court of Justice’s benchmarks24
4.1 The Court of Justice’s adequacy and essential equivalence standards24
4.2 National security26
4.3 Data retention and international data transfers 28
4.4 Effective remedies and judicial protection 33

5. Fitness check 37
5.1 Privacy, national security and law enforcement in light of the rule of law37
5.2 Effective remedies and justice 40

6. Policy recommendations 42

Annex I - Interviews46
Annex II – Task Force Meetings agendas 47
Annex III – Task Force participants55
Principles and guidelines for the Task Force57