FISA Section 702: US surveillance and European data

Key points

Section 702 of FISA (Foreign Intelligence Surveillance Act) allows targeted surveillance of non-US persons located outside the United States, through US providers.
Adopted in 2008, it has been renewed several times, most recently in April 2024 for two years.
Unlike the CLOUD Act, which falls under criminal law, FISA 702 falls under intelligence and national security.
The Schrems II ruling (CJEU, 2020) invalidated the Privacy Shield, notably identifying FISA 702 as incompatible with EU data protection standards.

Definition

What is FISA 702?

Section 702 was introduced in 2008 into the Foreign Intelligence Surveillance Act, itself passed in 1978 after the abuses revealed by the Church Committee. It authorises the Attorney General and the Director of National Intelligence to conduct, without an individual warrant, surveillance of non-US persons reasonably believed to be outside the United States, for foreign intelligence purposes.

In practice, the NSA and the FBI can issue directives to US electronic communication service providers, requiring them to hand over communications matching selectors (email addresses, numbers, identifiers). The PRISM (collection from providers) and Upstream (interception on the Internet backbone) programmes rely on this legal basis.

Oversight is provided by the FISA Court, a special court whose decisions long remained entirely secret. The law has been renewed several times, most recently in April 2024 by RISAA, with amendments but without calling the core mechanism into question.

Timeline

From 2008 to the Data Privacy Framework

July 2008Adoption of the FISA Amendments Act, which introduces Section 702. Codified at 50 U.S.C. § 1881a.
June 2013Snowden revelations: the press documents the PRISM and Upstream programmes, which rely on FISA 702 and involve nine major US technology companies.
October 2015CJEU Schrems I ruling, which invalidates Safe Harbor on the grounds that transfers to the United States do not guarantee an adequate level of protection.
July 2020Schrems II ruling, which invalidates the Privacy Shield, the successor to Safe Harbor. The Court explicitly cites FISA 702 and Executive Order 12333 among the problematic programmes.
July 2023The European Commission adopts a new transfer framework (EU-US Data Privacy Framework) following President Biden's Executive Order 14086, which creates the Data Protection Review Court.
April 2024Congress renews Section 702 for two years through the Reforming Intelligence and Securing America Act (RISAA).

Distinction

CLOUD Act and FISA 702, two different regimes

The two mechanisms address different situations but may concern the same providers. Confusing them leads to underestimating the overall risk.

Axis	CLOUD Act (2018)	FISA Section 702 (2008)
Legal basis	Criminal and civil law, amends the Stored Communications Act	Intelligence law, targets foreign nationals
Requesting authority	Federal prosecutor through a court order	Attorney General + DNI, overseen by the FISA Court
Typical target	Suspect in a criminal case	Non-US person abroad deemed of national security interest
Notification	Possible gag order, but within a judicial framework	Confidential by design
EU means of redress	Cooperation via Mutual Legal Assistance Treaty	Data Protection Review Court since 2022, contested

Practical impact

Consequences for European organisations

Five effects observed since Schrems II in the compliance work of large European organisations.

Surveillance without notification

FISA 702 targets, by design, non-US persons abroad. The European citizen or organisation will not be informed that collection concerns them, and has no direct judicial remedy before a US judge.

Broad scope

The law covers any electronic communication service provider subject to US jurisdiction. This includes hyperscalers, US SaaS vendors and European subsidiaries technically integrated with their parent company.

Documented GDPR risk

Since Schrems II, the FISA 702 risk must be covered by a Transfer Impact Assessment. This analysis has become an obligation for DPOs and data controllers.

Limits of the DPF

The 2023 Data Privacy Framework introduces additional safeguards but does not change FISA 702 itself. Legal challenges are pending before the CJEU. A possible invalidation would produce a Schrems III with immediate effects on transfers.

Architecture choices

For the most sensitive data, the only robust answer is to keep it out of any system built on a US orchestration stack, and therefore subject to FISA 702. Genuinely sovereign operators (open or controlled software stack) and application-level encryption with customer-held keys reduce the risk; the Bleu and S3NS joint ventures mitigate it contractually but do not eliminate it as long as they embed non-auditable vendor code (see below).

Key point

The real trigger: the orchestration stack

FISA 702 does not depend solely on where the data is stored. As soon as a service relies on a US orchestration stack - hypervisor, control plane, managed services, telemetry or update chain supplied by Google, AWS or Microsoft - the provider depends on a vendor subject to US law. Locating the servers in France does not neutralise this software dependency.

Yet the core of these platforms is proprietary and closed. ANSSI cannot audit the source code of Google, AWS or Microsoft: it is not disclosed. A qualification covers an architecture, processes and observable configurations - not the binary actually executed at the lowest level, nor what a remote update might introduce into it.

The direct consequence for Bleu (Microsoft + Orange + Capgemini) and S3NS (Google + Thales): the French joint venture does not shield these offers. As long as they embed non-auditable code from the US vendor, nothing guarantees the absence of a dormant component or an update channel through which the US authorities could, relying on their law, compel the vendor to impose a backdoor - at any operator, whatever the legal structure.

Diagram: the path that triggers FISA 702 (beyond location)

Data hosted in France. Geolocation alone seems reassuring.
But a US orchestration stack. Hypervisor, control plane, managed services, updates: Google, AWS or Microsoft.
Vendor subject to US law. The software stack supplier has a connection to the United States.
FISA 702 & CLOUD Act apply. US law prevails over the contract and the location of the servers.
Closed code, not auditable by ANSSI. ANSSI audits an architecture and processes, not the vendor's binary.
A backdoor can be imposed. Nothing guarantees the absence of a dormant component or an update channel that can be activated remotely.

Frequently asked questions

Five questions to understand

What is Section 702 of FISA?

Section 702 was introduced in 2008 into the Foreign Intelligence Surveillance Act. It authorises targeted surveillance, without an individual warrant, of non-US persons believed to be located outside the United States, for foreign intelligence purposes.

How does it differ from the CLOUD Act?

The CLOUD Act falls under criminal and civil law. FISA 702 falls under intelligence and national security. Both may concern the same providers but through different authorities (federal prosecutor for the CLOUD Act, FISA Court for Section 702).

Am I concerned as a European citizen?

FISA 702 targets, by design, non-US persons abroad. A European citizen using a service subject to US law is potentially within scope. Collection is confidential and does not give rise to notification.

Did Schrems II invalidate FISA 702?

No. The July 2020 ruling invalidated the Privacy Shield, citing FISA 702 as incompatible with European standards, but the US law itself remains in force and was renewed in April 2024 by RISAA.

Does the 2023 Data Privacy Framework solve the problem?

Partly. Executive Order 14086 introduces the Data Protection Review Court and certain safeguards. But FISA 702 remains unchanged. Legal challenges are pending before the CJEU; a possible invalidation would produce a Schrems III.

Sources and references

Going further

CLOUD ActThe criminal and civil counterpart of the US framework. To be mapped alongside FISA 702 for a complete view of jurisdictional risk.SecNumCloud qualificationA technical and organisational qualification from ANSSI - not a legal shield. It cannot neutralise FISA 702, which falls under US law, as long as a US software dependency remains.Exposure auditOur audit approach includes a Transfer Impact Assessment and the identification of data exposed to FISA risk.

Understand

Also read : extraterritorial laws

CLOUD ActThe 2018 law that allows US authorities to demand data stored outside the United States.Schrems IIThe CJEU ruling that invalidated the Privacy Shield and requires a case-by-case assessment of any data transfer to the United States.Digital sovereigntyThe ability to control one's infrastructure, data and technological dependencies, read across six dimensions.NIS 2The directive that imposes cybersecurity measures and incident reporting on thousands of essential and important entities, cloud providers included.

All guides

FISA Section 702, US surveillance of foreign data.