take into account any amendments that may have occurred in the interval between the institution of the
proceedings and the hearing which it held. That court stated that, in the main proceedings, its own
assessment is not confined to the grounds of invalidity put forward by the Commissioner, as a result of
which it may of its own motion decide that there are other well-founded grounds of invalidity and, on
those grounds, refer questions for a preliminary ruling.
60
According to the findings in that judgment, the US authorities’ intelligence activities concerning the
personal data transferred to the United States are based, inter alia, on Section 702 of the FISA and on
E.O. 12333.
61
In its judgment, the referring court specifies that Section 702 of the FISA permits the Attorney
General and the Director of National Intelligence to authorise jointly, following FISC approval, the
surveillance of individuals who are not United States citizens located outside the United States in order
to obtain ‘foreign intelligence information’, and provides, inter alia, the basis for the PRISM and
UPSTREAM surveillance programmes. In the context of the PRISM programme, Internet service
providers are required, according to the findings of that court, to supply the NSA with all
communications to and from a ‘selector’, some of which are also transmitted to the FBI and the Central
Intelligence Agency (CIA).
62
As regards the UPSTREAM programme, that court found that, in the context of that programme,
telecommunications undertakings operating the ‘backbone’ of the Internet — that is to say, the network
of cables, switches and routers — are required to allow the NSA to copy and filter Internet traffic flows
in order to acquire communications from, to or about a non-US national associated with a ‘selector’.
Under that programme, the NSA has, according to the findings of that court, access both to the
metadata and to the content of the communications concerned.
63
The referring court found that E.O. 12333 allows the NSA to access data ‘in transit’ to the United
States, by accessing underwater cables on the floor of the Atlantic, and to collect and retain such data
before arriving in the United States and being subject there to the FISA. It adds that activities
conducted pursuant to E.O. 12333 are not governed by statute.
64
As regards the limits on intelligence activities, the referring court emphasises the fact that non-US
persons are covered only by PPD‑28, which merely states that intelligence activities should be ‘as
tailored as feasible’. On the basis of those findings, the referring court considers that the United States
carries out mass processing of personal data without ensuring a level of protection essentially
equivalent to that guaranteed by Articles 7 and 8 of the Charter.
65
As regards judicial protection, the referring court states that EU citizens do not have the same
remedies as US citizens in respect of the processing of personal data by the US authorities, since the
Fourth Amendment to the Constitution of the United States, which constitutes, in United States law, the
most important cause of action available to challenge unlawful surveillance, does not apply to EU
citizens. In that regard, the referring court states that there are substantial obstacles in respect of the
causes of action open to EU citizens, in particular that of locus standi, which it considers to be
excessively difficult to satisfy. Furthermore, according to the findings of the referring court, the NSA’s
activities based on E.O. 12333 are not subject to judicial oversight and are not justiciable. Lastly, the
referring court considers that, in so far as, in its view, the Privacy Shield Ombudsperson is not a
tribunal within the meaning of Article 47 of the Charter, US law does not afford EU citizens a level of
protection essentially equivalent to that guaranteed by the fundamental right enshrined in that article.
66
In its request for reference preliminary ruling, the referring court also states that the parties to the main
proceedings disagree, inter alia, on the applicability of EU law to transfers to a third country of
personal data which are likely to be processed by the authorities of that country, inter alia, for purposes
of national security and on the factors to be taken into consideration for the purposes of assessing
whether that country ensures an adequate level of protection. In particular, that court notes that,
according to Facebook Ireland, the Commission’s findings on the adequacy of the level of protection
ensured by a third country, such as those set out in the Privacy Shield Decision, are also binding on the
supervisory authorities in the context of a transfer of personal data pursuant to the standard data
protection clauses in the annex to the SCC Decision.