FISA, the Foreign Intelligence Surveillance Act, is the centerpiece of US intelligence gathering. Section 702 (“Procedures for Targeting Certain Persons Outside the United States Other Than United States Persons”; FISA 702) is part of Title VII of FISA and specifically allows the collection of intelligence information on non-US persons believed to be outside the US with the compelled assistance of electronic communications service providers in the US. For this reason, the ECJ stated in the Schrems II ruling on FISA,
[…] Section 702 of FISA does not in any way indicate that there is no need for the Authorization to carry out monitoring programs for the purpose of foreign intelligence gathering; nor is it apparent that guarantees exist for non-US persons potentially covered by these programs. In these circumstances, this provision […] is not capable of ensuring a level of protection equivalent in substance to that guaranteed by the Charter […].
Sec. 702 is therefore part of the legal system that the ECJ has deemed to be not equivalent to the EU Charter. Accordingly, the probability that US authorities will access personal data transferred to a US recipient on the basis of FISA must be assessed as part of the transfer impact assessment.
FISA Title VII would have expired on December 31, 2023. US President Joe Biden has now extended this duration on December 22, 2023. extended until April 19, 2024. The extension is available in the “National Defense Authorization Act for Fiscal Year 2024″, the 3000-page defense bill, as “Sec. 7902. Extension of Title VII of FISA”. However, the content of Title VII remains unchanged. The extension had previously been the subject of controversy.
For the time being, this does not change anything with regard to transfers to the USA. However, as soon as Switzerland has a recognized CH-US Data Privacy Framework FISA no longer plays a role for transfers in normal cases.