What is Tealium's practical experience dealing with government access requests?

Tealium has never received a US National Security Request (including requests for access under FISA 702 or direct access under EO 12333) in connection with customer personal data.

Therefore, while Tealium may theoretically be subject to the surveillance laws identified in Schrems II, we have not been subject to these types of requests in our day-to-day business operations.

US Surveillance Laws

FISA 702 and Executive Order 12333

The following US laws were identified by the Court of Justice of the European Union in Schrems II as being potential obstacles to ensuring essentially equivalent protection for personal data in the US:

• FISA Section 702 (“FISA 702”) – allows US government authorities to compel disclosure of information about non-US persons located outside the US for the purposes of foreign intelligence information gathering. The Foreign Intelligence Surveillance Court in Washington, DC, must approve this information gathering. In-scope providers subject to FISA 702 are electronic communication service providers (ECSP ) within the meaning of 50 USC § 1881(b)(4), which can include remote computing service providers ( RCSP ), as defined under 18 USC § 2510 and 18 USC § 2711.


• Executive Order 12333 ( EO 12333 ) - authorizes intelligence agencies (like the US National Security Agency) to conduct surveillance outside the US. In particular, it provides authority for US intelligence agencies to collect foreign signals intelligence information, being information collected from communications and other data passed or accessible by radio, wire and other electromagnetic means. This may include accessing underwater cables carrying Internet data in transit to the US. EO 12333 does not rely on the compelled assistance of service providers but instead appears to rely on exploiting vulnerabilities in telecommunications infrastructure.

Further information about these US surveillance laws can be found in the US Privacy Safeguards Relevant to SCCs and Other EU Legal Bases for EU-U.S.Data Transfers after Schrems II whitepaper from September 2020. This whitepaper detailed the limits and safeguards about US public authority access to data and was issued in response to the Schrems II ruling.

Regarding FISA 702, the whitepaper notes:

• For most companies, the concerns about national security access to company data highlighted by Schrems II are unlikely to arise because the data they handle is of no interest to the US intelligence community. Companies handling ordinary commercial information like employee, customer, or sales records would have no basis to believe US intelligence agencies would seek to collect that data.


• There is individual redress, including for EU citizens, for violations of FISA section 702 through measures not addressed by the court in the Schrems II ruling, including FISA provisions allowing private actions for compensatory and punitive damages.

Regarding Executive Order 12333, the whitepaper notes:

• EO 12333 does not on its own authorize the US government to require any company or person to disclose data. Instead, EO 12333 must rely on a statute like FISA 702 to collect data.


• Bulk data collection, the data collection at issue in Schrems II, is expressly prohibited under EO 12333.

CLOUD Act

For more information on the CLOUD Act, review What is the CLOUD Act? by BSA Software Alliance, outlining the scope of the CLOUD Act.

The whitepaper notes:

• The CLOUD Act only permits the US government access to data in criminal investigations after obtaining a warrant approved by an independent court based on probable cause of a specific criminal act.


• The CLOUD Act does not allow the US government access to national security investigations, and it does not permit bulk surveillance.

Is Tealium subject to FISA 702 or EO 12333?

Tealium, like most US-based SaaS companies, could technically be subject to FISA 702, where it is deemed an RCSP. However, Tealium does not process personal data likely to interest US intelligence agencies.

Furthermore, Tealium is not likely to be subject to upstream surveillance orders under FISA 702, the type of order principally addressed in, and deemed problematic by, the Schrems II decision. Tealium does not provide internet backbone services but only carries traffic involving its customers. To date, the US Government has interpreted and applied FISA 702 upstream orders to only target market providers with traffic flowing through their internet backbone and carrying traffic for third parties (i.e., telecommunications carriers).

EO 12333 contains no authorization to compel private companies (such as Tealium) to disclose personal data to US authorities. FISA 702 requires an independent court to authorize a specific type of foreign intelligence data acquisition generally unrelated to commercial information. If US intelligence agencies were interested in the type of data that Tealium processes, safeguards such as the requirement for authorization by an independent court and the necessity and proportionality requirements would protect data from excessive surveillance.