§2523 Executive Agreements on Access to Data by Foreign Governments

Summary

Lets the Attorney General, with the Secretary of State’s agreement, say in writing that a U.S. executive agreement with a foreign government about access to electronic data meets certain rules. Two defined terms to know: “lawfully admitted for permanent residence” means a person with that immigration status, and “United States person” means U.S. citizens, nationals, permanent residents, certain U.S.-based groups, or U.S.-incorporated companies. The certification must explain why the agreement meets four big requirements. First, the foreign government’s laws and how it acts must give strong privacy and civil‑liberty protections, shown by factors like cybercrime and electronic‑evidence rules, rule of law, respect for human rights, clear rules and oversight for officials who seek data, transparency, and support for a free, open Internet. Second, the foreign government must have ways to minimize collecting, keeping, and sharing data about United States persons. Third, the agreement cannot force or stop providers from being able to decrypt data. Fourth, orders covered by the agreement must follow strict targeting and legal rules: they may not intentionally target U.S. persons or people in the U.S.; may not target someone abroad just to get U.S. person data; may not be used to get or pass data to the U.S. or another government; must be for serious crimes like terrorism, name a specific account or device, follow the foreign country’s law, be based on reasonable, factual justification, be subject to independent review or oversight, and — for wiretaps — be time‑limited, necessary, and used only if less intrusive means won’t work. The foreign government must protect speech, promptly review and securely store collected material, apply strict minimization for irrelevant U.S. person content, limit sharing with U.S. authorities unless the content shows significant harm, allow reciprocal data access where appropriate, agree to U.S. compliance reviews, and accept that the U.S. can refuse to treat some orders as covered. The Attorney General must give Congress a copy and notice within 7 days. The agreement cannot take effect sooner than 180 days after that notice unless Congress passes a special joint resolution to disapprove within that period. The certification cannot be reviewed by courts or agencies. The Attorney General and Secretary of State must review and may renew the certification every 5 years and must report why they renewed, any changes, and implementation issues. Any revision to an agreement is treated as a new agreement and follows the same rules, but with shorter congressional time limits (90 and 60 days for certain steps). The certification, renewals, and terminations must be published in the Federal Register. U.S. authorities who receive covered communications must use minimization procedures that, as much as possible, match the definition in section 101 of the Foreign Intelligence Surveillance Act.