18 U.S.C. § 2523 Executive Agreements On Access to Data By Foreign Governments

• Library: United States Statutes
• Edition: 2023
• Currency: Current through P.L. 118-34 (published on www.congress.gov on 12/26/2023), except for [P. L. 118-31]
• Year: 2023
• Citation: 18 U.S.C. § 2523

(a) DEFINITIONS.-In this section-

(1) the term "lawfully admitted for permanent residence" has the meaning given the term in section 101(a) of the Immigration and Nationality Act ( 8 U.S.C. 1101(a) ); and

(2) the term "United States person" means a citizen or national of the United States, an alien lawfully admitted for permanent residence, an unincorporated association a substantial number of members of which are citizens of the United States or aliens lawfully admitted for permanent residence, or a corporation that is incorporated in the United States.

(b) EXECUTIVE AGREEMENT REQUIREMENTS.-For purposes of this chapter, chapter 121, and chapter 206, an executive agreement governing access by a foreign government to data subject to this chapter, chapter 121, or chapter 206 shall be considered to satisfy the requirements of this section if the Attorney General, with the concurrence of the Secretary of State, determines, and submits a written certification of such determination to Congress, including a written certification and explanation of each consideration in paragraphs (1), (2), (3), and (4), that-

(1) the domestic law of the foreign government, including the implementation of that law, affords robust substantive and procedural protections for privacy and civil liberties in light of the data collection and activities of the foreign government that will be subject to the agreement, if-

(A) such a determination under this section takes into account, as appropriate, credible information and expert input; and

(B) the factors to be met in making such a determination include whether the foreign government-

(i) has adequate substantive and procedural laws on cybercrime and electronic evidence, as demonstrated by being a party to the Convention on Cybercrime, done at Budapest November 23, 2001, and entered into force January 7, 2004, or through domestic laws that are consistent with definitions and the requirements set forth in chapters I and II of that Convention;

(ii) demonstrates respect for the rule of law and principles of nondiscrimination;

(iii) adheres to applicable international human rights obligations and commitments or demonstrates respect for international universal human rights, including-

(I) protection from arbitrary and unlawful interference with privacy;

(II) fair trial rights;

(III) freedom of expression, association, and peaceful assembly;

(IV) prohibitions on arbitrary arrest and detention; and

(V) prohibitions against torture and cruel, inhuman, or degrading treatment or punishment;

(iv) has clear legal mandates and procedures governing those entities of the foreign government that are authorized to seek data under the executive agreement, including procedures through which those authorities collect, retain, use, and share data, and effective oversight of these activities;

(v) has sufficient mechanisms to provide accountability and appropriate transparency regarding the collection and use of electronic data by the foreign government; and

(vi) demonstrates a commitment to promote and protect the global free flow of information and the open, distributed, and interconnected nature of the Internet;

(2) the foreign government has adopted appropriate procedures to minimize the acquisition, retention, and dissemination of information concerning United States persons subject to the agreement;

(3) the terms of the agreement shall not create any obligation that providers be capable of decrypting data or limitation that prevents providers from decrypting data; and

(4) the agreement requires that, with respect to any order that is subject to the agreement-

(A) the foreign government may not intentionally target a United States person or a person located in the United States, and shall adopt targeting procedures designed to meet this requirement;

(B) the foreign government may not target a non-United States person located outside the United States if the purpose is to obtain information concerning a United States person or a person located in the United States;

(C) the foreign government may not issue an order at the request of or to obtain information to provide to the United States Government or a third-party government, nor shall the foreign government be required to share any information produced with the United States Government or a third-party government;