PRIVILEGED AND CONFIDENTIAL — LEGAL ADVICE / ATTORNEY WORK PRODUCT
TRANSFER IMPACT ASSESSMENT
TIA-001
Northgate Telecommunications PLC → Caldwell Analytics Inc. (United States)
Related Documents:
• DPIA-011 — Caldwell Analytics Network Performance Data Transfer (dated 28 July 2023)
• EU Standard Contractual Clauses (Module 2: Controller to Processor) — NTP to Caldwell Analytics Inc. (executed 17 July 2023)
• UK International Data Transfer Agreement (IDTA) — NTP to Caldwell Analytics Inc. (executed 17 July 2023)
• NTP–Caldwell Master Services Agreement (dated 1 June 2021)
Right-click to update Table of Contents
1. EXECUTIVE SUMMARY
This Transfer Impact Assessment ("TIA" or "Assessment") has been prepared by Calderwood & Harkness LLP on behalf of Northgate Telecommunications PLC ("NTP" or the "Data Exporter") to assess whether the laws and practices of the United States of America afford an essentially equivalent level of protection to personal data transferred from NTP to Caldwell Analytics Inc. ("Caldwell" or the "Data Importer"), and to determine whether supplementary measures are necessary and, if so, whether such measures are sufficient to bridge any identified protection gap.
This Assessment is required under the Recommendations 01/2020 of the European Data Protection Board (the "EDPB"), as adopted on 18 June 2021, on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, and the Information Commissioner's Office ("ICO") guidance on international transfer risk assessment. The Assessment follows the framework established by the Court of Justice of the European Union ("CJEU") in its landmark judgment in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, 16 July 2020) ("Schrems II"), in which the CJEU invalidated the EU-US Privacy Shield and clarified the obligation of data exporters to assess, on a case-by-case basis, whether the legal framework of the destination country ensures an essentially equivalent level of data protection.
The transfer of personal data from NTP to Caldwell is governed by the EU Standard Contractual Clauses adopted pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, specifically Module 2 (Controller to Processor) (the "EU SCCs"), and the UK International Data Transfer Agreement (the "UK IDTA") issued by the ICO under Section 119A of the Data Protection Act 2018. Both transfer tools were executed on 17 July 2023. The EU SCCs govern the transfer of personal data originating under the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR") from NTP's EU subsidiaries and operations, while the UK IDTA governs the transfer of personal data originating under the UK General Data Protection Regulation (as incorporated by the European Union (Withdrawal) Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019) ("UK GDPR") from NTP PLC's UK operations.
Overall Conclusion. Based on our analysis of the US legal framework, the nature and categories of personal data transferred, the technical and organisational measures implemented by both NTP and Caldwell, and the supplementary measures identified in this Assessment, we conclude that the transfer of personal data from NTP to Caldwell may proceed with the identified supplementary measures in place. The supplementary measures — comprising AES-256 encryption at rest, TLS 1.3 encryption in transit, pseudonymisation of direct identifiers prior to transfer, contractual audit rights, government access notification and challenge obligations, and data localisation for certain sensitive data categories — reduce the residual risk to data subjects to an acceptable level.
Residual Risk. The residual risk to data subjects, following implementation of the supplementary measures, is assessed as MEDIUM (reduced from HIGH prior to the application of supplementary measures). This residual risk level reflects the inherent uncertainties in the US legal framework regarding government access to data of non-US persons, tempered by the material improvements introduced through Executive Order 14086 ("EO 14086") and the technical protections that render the transferred data substantially less valuable to any party without access to the re-identification key, which is retained exclusively by NTP within UK/EEA infrastructure.
This TIA should be read in conjunction with DPIA-011 (Caldwell Analytics Network Performance Data Transfer), which assesses the broader data protection risks of the processing relationship, including risks related to profiling and automated decision-making. This TIA is also relevant to the Data Protection Commission (Ireland) ("DPC") preliminary inquiry IN-22-11-3 regarding cross-border transfers from Northgate Ireland Ltd, and forms part of NTP's comprehensive response to that inquiry.
2. METHODOLOGY
2.1 Legal Framework for the Assessment
This Assessment has been conducted in accordance with the following legal framework and regulatory guidance:
EU GDPR — Article 46(1) and (2)(c). Article 46(1) of the EU GDPR provides that, in the absence of an adequacy decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. Article 46(2)(c) identifies standard data protection clauses adopted by the European Commission as one such appropriate safeguard. The EU SCCs (Module 2 — Controller to Processor) relied upon for this transfer were adopted pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
UK GDPR — Article 46 and Data Protection Act 2018 Section 119A. The UK GDPR mirrors the EU GDPR requirement for appropriate safeguards for international transfers. Section 119A of the Data Protection Act 2018 provides the legal basis for the UK IDTA, which serves as the UK equivalent of the EU SCCs. The UK IDTA relied upon for this transfer is in the form approved by the ICO and laid before Parliament on 2 February 2022.
CJEU Judgment in Schrems II (Case C-311/18, 16 July 2020). The Schrems II judgment established that the use of EU SCCs as a transfer mechanism does not, in and of itself, ensure compliance with the level of protection required by EU law. The CJEU held that the data exporter and the data importer must assess, prior to the transfer, whether the law of the third country of destination ensures adequate protection of personal data transferred pursuant to standard contractual clauses, in the light of all the circumstances of the transfer. Where the assessment reveals that the third country's laws do not ensure an essentially equivalent level of protection, the parties must consider whether supplementary measures can be put in place to fill any gap, and must suspend or end the transfer if no effective supplementary measures are available. This TIA constitutes the assessment required by the Schrems II judgment.
EDPB Recommendations 01/2020 (Version 2.0, adopted 18 June 2021). These Recommendations provide a six-step framework for assessing whether the laws and practices of a third country impinge on the effectiveness of the transfer tool relied upon, and for identifying supplementary measures where necessary. This Assessment follows the six-step approach set out in those Recommendations.
EDPB Recommendations 02/2020 on the European Essential Guarantees for Surveillance Measures. These Recommendations set out four essential guarantees that the legal framework of a third country must provide for government surveillance measures to be considered as not impinging on the rights of data subjects whose data is transferred: (i) clear, precise, and accessible rules; (ii) necessity and proportionality; (iii) independent oversight; and (iv) effective remedies. This Assessment evaluates the US legal framework against these four guarantees in Section 4.4 below.
ICO Guidance on International Data Transfers. The ICO's post-Brexit guidance on international data transfers, including its transfer risk assessment tool, has been consulted in the preparation of this Assessment. The ICO's guidance is broadly aligned with the EDPB Recommendations but includes certain UK-specific considerations.
DPC (Ireland) Preliminary Inquiry IN-22-11-3. The DPC has opened a preliminary inquiry regarding cross-border transfers from Northgate Ireland Ltd (NTP's EU establishment). This TIA forms part of NTP's comprehensive response to that inquiry, and its conclusions are relevant to demonstrating NTP's compliance with its obligations under Article 46 of the EU GDPR. The inquiry was initiated in November 2022, and the DPC has requested a detailed description of NTP's transfer mechanisms, the results of any transfer impact assessments, and details of supplementary measures implemented. This TIA is being provided to the DPC in that context.
2.2 Assessment Steps
This Assessment follows the six-step methodology prescribed by the EDPB in Recommendations 01/2020:
Step 1 — Know Your Transfer. The first step requires the data exporter to map the transfer in detail, including the identity of the parties, the categories of personal data transferred, the categories of data subjects, the purposes of the processing, the frequency and duration of the transfer, and any onward transfers. This information is set out in Section 3 below.
Step 2 — Identify the Transfer Tool Relied Upon. The second step requires identification of the specific transfer mechanism under Chapter V of the GDPR. The transfer tools relied upon are the EU SCCs (Module 2 — Controller to Processor) and the UK IDTA, both executed on 17 July 2023. A detailed description of the contractual basis for the transfer is provided in Section 3.3 below.
Step 3 — Assess the Laws and Practices of the Destination Country. The third step, which represents the core of this Assessment, requires a detailed analysis of the legal framework of the United States, with particular focus on government surveillance powers and the extent to which those powers may be exercised in a manner that affects the personal data transferred. This analysis is set out in Section 4 below and includes an assessment against the EDPB's four European Essential Guarantees.
Step 4 — Identify and Adopt Supplementary Measures. Where the analysis under Step 3 reveals that the third country's laws and practices do not ensure an essentially equivalent level of protection, Step 4 requires the identification of supplementary measures — technical, contractual, and organisational — that can effectively bridge the gap. The supplementary measures identified are described in Section 6 below, and their effectiveness is assessed in Section 7.
Step 5 — Procedural Steps. Step 5 requires the data exporter to take any formal procedural steps that may be required to implement the supplementary measures, including amending or supplementing the transfer tool as necessary. The supplementary measures have been incorporated into the EU SCCs (Annex II) and the UK IDTA (Part 3), as well as through supplementary contractual provisions agreed between NTP and Caldwell.
Step 6 — Monitor and Re-evaluate. Step 6 requires ongoing monitoring for developments in the destination country that may affect the level of protection afforded to transferred personal data. The ongoing monitoring framework is described in Section 6.3.3 below.
2.3 Sources Consulted
In preparing this Assessment, we have consulted the following primary and secondary sources:
US Statutory Texts and Legal Instruments:
• Foreign intelligence Surveillance Act of 1978, as amended (50 U.S.C. §§ 1801–1885c), including in particular Section 702 (50 U.S.C. § 1881a), authorising the targeting of non-US persons reasonably believed to be located outside the United States for foreign intelligence purposes
• Executive Order 12333 — United States intelligence Activities (4 December 1981, as amended), authorising signals intelligence collection by US intelligence agencies
• Clarifying Lawful Overseas Use of Data Act ("CLOUD Act"), enacted 23 March 2018, amending the Stored Communications Act at 18 U.S.C. § 2713
• Executive Order 14086 — Enhancing Safeguards for United States signals intelligence Activities (7 October 2022), establishing new necessity, proportionality, and redress requirements for US signals intelligence collection
• Attorney General Regulation — Data Protection Review Court (effective 1 July 2023)
• USA FREEDOM Act of 2015, reforming certain bulk collection programmes under FISA Section 501
Regulatory and Judicial Guidance:
• EDPB Recommendations 01/2020 (Version 2.0, adopted 18 June 2021)
• EDPB Recommendations 02/2020 on the European Essential Guarantees for surveillance measures
• CJEU Judgment in Case C-311/18 (Schrems II), 16 July 2020
• European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 on the adequate level of protection of personal data under the EU-US Data Privacy Framework (the "DPF Adequacy Decision")
• ICO International Transfer Risk Assessment guidance (updated post-Brexit)
• US Privacy and Civil Liberties Oversight Board (PCLOB) reports on Section 702 implementation and EO 14086 safeguards
Representations and Technical Documentation from Caldwell Analytics Inc.:
• Written representations from Jennifer Huang, Vice President, Legal & Privacy, Caldwell Analytics Inc., transmitted via Hargrove Lister & Webb LLP (Natalie Prescott, Partner, Data Privacy & Cybersecurity), dated 14 July 2023 and 28 July 2023 (the "Caldwell Representations")
• Technical security documentation provided by Derek Rawlings, Chief Technology Officer, Caldwell Analytics Inc., dated 10 July 2023, describing Caldwell's data centre infrastructure, encryption capabilities, access controls, and SOC 2 Type II certification status (the "Caldwell Technical Documentation")
Internal NTP Documentation:
• DPIA-011 — Caldwell Analytics Network Performance Data Transfer (dated 28 July 2023)
• NTP Data Classification Policy (Version 3.1, effective 1 January 2023)
• NTP International Data Transfer Policy (Version 2.0, effective 15 March 2023)
• NTP Records of Processing Activities (Article 30 register) — Entry for Caldwell Analytics processing
3. DESCRIPTION OF THE TRANSFER
3.1 Data Exporter
The data exporter is Northgate Telecommunications PLC, a public limited company incorporated under the laws of England and Wales, with company number 04837291.
NTP is a leading telecommunications operator in the United Kingdom and the European Union, providing fixed-line, mobile, and broadband services to consumer and business customers. NTP's UK operations are conducted directly by NTP PLC, while its EU operations are primarily conducted through subsidiaries, with Northgate Ireland Ltd serving as NTP's main establishment in the EU for data protection purposes. NTP is listed on the London Stock Exchange (LSE: NTP) and has a market capitalisation of approximately £4.2 billion as at the date of this Assessment.
In the context of this transfer, NTP acts as a controller of the personal data of its subscribers. NTP determines the purposes and means of the processing carried out by Caldwell, as documented in the EU SCCs (Annex I) and the UK IDTA (Part 1 — Tables). Caldwell processes personal data solely on NTP's documented instructions.
3.2 Data Importer
The data importer is Caldwell Analytics Inc., a Delaware C-Corporation incorporated in the State of Delaware, United States of America.
Caldwell is a mid-market technology company specialising in the application of artificial intelligence and machine learning techniques to telecommunications network data. Caldwell's principal product offering involves the ingestion of network performance data from telecommunications operators and the application of predictive analytics algorithms to identify network anomalies, predict equipment failures, optimise capacity allocation, and generate performance improvement recommendations. Caldwell's platform is used by approximately 30 telecommunications operators globally, and the company has been in operation since 2015.
Caldwell's outside counsel for data privacy matters is Hargrove Lister & Webb LLP, a US-headquartered law firm with offices in San Francisco and London. The principal contact at Hargrove Lister & Webb for matters relating to this transfer is Natalie Prescott, Partner, Data Privacy & Cybersecurity, whose principal office is at 555 Mission Street, Suite 3100, San Francisco, CA 94105, USA, and who is also based part-time at the firm's London office at 30 Fenchurch Street, London EC3M 3BD, UK.
3.3 Contractual Basis for the Transfer
The transfer of personal data from NTP to Caldwell is governed by the following contractual instruments:
NTP–Caldwell Master Services Agreement (dated 1 June 2021). The MSA establishes the overarching commercial relationship between NTP and Caldwell, including the scope of services, service levels, fees, intellectual property rights, liability, and indemnification. The MSA was negotiated and executed prior to the implementation of the current SCC/IDTA framework. Schedule 4 of the MSA contains the original data processing provisions, which have been superseded and supplemented by the EU SCCs and UK IDTA executed on 17 July 2023.
EU Standard Contractual Clauses — Module 2 (Controller to Processor) (executed 17 July 2023). The EU SCCs, in the form adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, have been executed between NTP (as data exporter/controller) and Caldwell (as data importer/processor). Module 2 has been selected as the applicable module, reflecting the controller-to-processor relationship. The following optional provisions have been selected:
• Clause 7 (Docking Clause): Included, to permit NTP's EU subsidiaries to accede to the SCCs as additional data exporters.
• Clause 9(a) (Sub-processor Authorisation): Option 1 selected — prior specific written authorisation from NTP is required before Caldwell may engage any sub-processor.
• Clause 11 (Redress): The optional paragraph permitting data subjects to lodge a complaint with an independent dispute resolution body has not been included.
• Clause 17 (Governing Law): The laws of Ireland have been selected as the governing law, consistent with the lead supervisory authority being the DPC (Ireland).
• Clause 18(b) (Forum): The courts of Ireland have been selected as the forum for dispute resolution.
The SCCs include completed Annexes I (Description of the Transfer), II (Technical and Organisational Measures), and III (List of Sub-processors — currently blank, as Caldwell does not engage sub-processors for NTP data processing activities).
UK International Data Transfer Agreement (IDTA) (executed 17 July 2023). The UK IDTA has been executed between NTP (as data exporter/controller) and Caldwell (as data importer/processor) in the form approved by the ICO and laid before Parliament on 2 February 2022. The IDTA governs transfers of personal data originating under the UK GDPR from NTP PLC's UK operations. The IDTA's mandatory tables have been completed to reflect the specific circumstances of the transfer.
Complementary Relationship. The EU SCCs and UK IDTA operate in parallel. The EU SCCs govern the transfer of personal data that originates under the EU GDPR — principally data from NTP's EU subscribers processed through Northgate Ireland Ltd and other EU subsidiaries. The UK IDTA governs the transfer of personal data that originates under the UK GDPR — principally data from NTP's UK subscribers. Both instruments impose substantially equivalent obligations on Caldwell as data importer/processor, and both are supplemented by the measures described in this TIA.
3.4 Categories of Personal Data Transferred
The personal data transferred from NTP to Caldwell consists of network performance data that incorporates personal data elements. The following categories of personal data are included in the transfer:
Subscriber Metadata. This category includes call detail records metadata (excluding content), session data (timestamps, duration, cell identifiers for session initiation and termination), and traffic routing information. This metadata does not include the content of communications but does describe the circumstances of communications sessions (when, where, how long, and between which network endpoints).
Location Data. Cell tower connection data and approximate geolocation data are transferred to Caldwell. However, as described in Section 6.1.4 below, precise cell-level location data is retained within the EEA and is not transferred to Caldwell. Only aggregated, coarsened location data at the regional or city level is included in the transfer. This data reflects the approximate geographic area from which a subscriber accesses the network, but does not permit precise tracking of movements.
Device Identifiers. Device identifiers transferred to Caldwell include International Mobile Equipment Identity (IMEI) numbers, International Mobile Subscriber Identity (IMSI) numbers, and Media Access Control (MAC) addresses. These identifiers are associated with specific devices and SIM cards used by subscribers, and can potentially be linked to identified individuals when combined with other information held by NTP.
IP Addresses. Both IPv4 and IPv6 addresses assigned to subscriber devices during network sessions are transferred to Caldwell for the purpose of network performance analytics.
Usage Patterns and Service Interaction Data. This category includes data relating to subscribers' patterns of network usage, including data consumption volumes, application-level protocol identification (without content inspection), peak usage times, and service interaction data describing subscribers' engagement with NTP's network services.
Pseudonymisation. Critically, all personal data is pseudonymised by NTP prior to transfer to Caldwell. Direct identifiers — specifically, subscriber names, account numbers, postal addresses, email addresses, and telephone numbers — are stripped from the data and replaced with pseudonymous tokens (randomised alphanumeric keys) generated by NTP's pseudonymisation engine. The re-identification key (i.e., the mapping table linking pseudonymous tokens to direct identifiers) is retained exclusively by NTP within its UK/EEA infrastructure — specifically, within NTP's data centres in London and Dublin, which are operated by Pinnacle Cloud Services Ltd — and is not transferred to Caldwell under any circumstances.
It is important to note that, despite the pseudonymisation applied prior to transfer, the transferred data remains "personal data" within the meaning of Article 4(1) of the GDPR. This is because NTP, as the data exporter and controller, retains the means of re-identification. The CJEU and the Article 29 Working Party (now the EDPB) have consistently held that data which has been pseudonymised — as distinct from anonymised — retains its character as personal data where the data controller holds the means of re-identification. Accordingly, the transfer is subject to Chapter V of the GDPR and the requirements of Articles 44–49.
3.5 Categories of Data Subjects
The data subjects whose personal data is transferred to Caldwell are consumer subscribers of NTP's telecommunications services across its UK and EU operations. NTP has approximately 6.3 million consumer subscribers across these jurisdictions. The data transferred to Caldwell represents a subset of the overall subscriber base: specifically, analytics data derived from network performance monitoring covering active subscribers — i.e., subscribers who have generated network activity during the relevant monitoring period. Not all 6.3 million subscribers' data is transferred at any given time; the transfer volume fluctuates based on network activity levels and the scope of the analytics projects being conducted by Caldwell. However, over the course of a 12-month period, data relating to substantially all active subscribers is expected to be transferred.
It is emphasised that data subjects are not individually identifiable by Caldwell without the re-identification key, which is held exclusively by NTP within the UK/EEA. Caldwell processes the data in its pseudonymised form and does not have the ability, using means reasonably likely to be used, to identify specific data subjects.
3.6 Purpose of the Transfer
The transfer of personal data from NTP to Caldwell is made exclusively for the following purposes, as documented in the EU SCCs (Annex I) and the UK IDTA (Part 1):
AI-Driven Network Analytics. Caldwell applies artificial intelligence and machine learning algorithms to the transferred network performance data to generate insights and recommendations for NTP's network operations. This encompasses the following specific processing activities:
• Performance Optimisation: Analysis of network performance data to identify areas of suboptimal performance (e.g., high latency, packet loss, congestion) and to generate recommendations for configuration adjustments and infrastructure investments.
• Predictive Maintenance: Application of machine learning models to identify patterns in network equipment behaviour that are indicative of impending hardware or software failures, enabling NTP to schedule proactive maintenance and reduce network downtime.
• Anomaly Detection: Real-time monitoring of network data streams to detect anomalous patterns that may indicate security threats, equipment malfunctions, or unusual subscriber behaviour requiring investigation.
• Capacity Planning: Analysis of historical usage patterns and trends to forecast future network demand and inform NTP's capital expenditure planning for network expansion and upgrades.
The processing carried out by Caldwell is necessary for NTP's legitimate interest in maintaining and optimising its telecommunications network infrastructure, which in turn serves the interests of NTP's subscribers in receiving reliable and high-quality telecommunications services. Caldwell processes data solely on NTP's documented instructions as a processor. Caldwell does not determine the purposes or means of the processing, and does not use the transferred data for any purpose other than the provision of the analytics services described above.
3.7 Frequency and Duration of the Transfer
Frequency. The transfer of personal data from NTP to Caldwell is ongoing and operates on a continuous, near-real-time basis. Data is transmitted via secure API connections between NTP's data centres (London and Dublin) and Caldwell's data centre (San Jose, California). The API connections are active 24 hours per day, 7 days per week, with data transmitted in micro-batches at intervals of approximately 5 to 15 minutes, depending on network activity volumes and the specific analytics pipeline in operation.
Data Retention by Caldwell. Caldwell's retention of NTP personal data is governed by the following retention schedule, as agreed in the EU SCCs (Annex I) and the MSA (Schedule 4):
• Raw Data: Raw network performance data received from NTP is deleted by Caldwell within 90 days of receipt. Deletion is performed through automated processes, with quarterly verification by Caldwell's information security team.
• Processed Analytics Data: Intermediate and output data generated by Caldwell's analytics processing (which may still contain personal data in pseudonymised form) is retained for a maximum of 12 months from the date of processing.
• Aggregate and Anonymised Outputs: Statistical summaries, trend analyses, and other aggregate or anonymised outputs that do not constitute personal data (i.e., outputs from which individual data subjects cannot be identified, even with the re-identification key) may be retained indefinitely by Caldwell for benchmarking and model improvement purposes. The anonymisation standard applied is assessed and documented in DPIA-011.
Duration of the Transfer Arrangement. The transfer arrangement commenced under the MSA from 1 June 2021 and has been ongoing since that date. The SCC/IDTA framework became effective on 17 July 2023, replacing the prior contractual data protection provisions contained in Schedule 4 of the MSA. The MSA has an initial term of 5 years (expiring 31 May 2026) with automatic renewal for successive 2-year periods unless terminated by either party with 12 months' written notice. The transfer will continue for the duration of the MSA unless terminated or suspended in accordance with its terms or as required by this TIA or applicable law.
3.8 Onward Transfers
As at the date of this Assessment, Caldwell does not engage any sub-processors for the processing of NTP personal data. All processing is performed by Caldwell personnel using Caldwell's own infrastructure at its San Jose, California data centre.
Any future engagement of sub-processors by Caldwell for the processing of NTP personal data is subject to NTP's prior specific written authorisation, in accordance with EU SCCs Clause 9 (Option 1 — prior specific authorisation). This means that Caldwell may not engage any sub-processor without first providing NTP with details of the proposed sub-processor and the processing activities to be performed, and receiving NTP's express written consent. NTP retains the right to object to any proposed sub-processor engagement and, if the objection is not resolved, to terminate the processing relationship.
This restriction on onward transfers is a significant safeguard, as it ensures that NTP retains control over the entities that have access to its subscribers' personal data and can assess the data protection implications of any sub-processing arrangements on a case-by-case basis.
4. ASSESSMENT OF US LAWS AND PRACTICES
4.1 Overview of the US Legal Framework for Government Access to Data
The assessment of the US legal framework focuses on the laws and practices that govern government access to personal data held by private entities such as Caldwell. The central question, as established by the Schrems II judgment, is whether the US legal framework provides data subjects whose personal data is transferred to the US with a level of protection that is "essentially equivalent" to that provided by the GDPR. This assessment focuses on the following key areas: constitutional protections, surveillance authorities under the Foreign intelligence Surveillance Act (FISA), signals intelligence collection under Executive Order 12333, compelled disclosure under the CLOUD Act, and recent reforms under Executive Order 14086.
4.1.1 Constitutional Protections
The Fourth Amendment to the United States Constitution protects against "unreasonable searches and seizures" and generally requires the government to obtain a warrant based on probable cause before conducting a search of an individual's papers, effects, and — as the Supreme Court has recognised in recent jurisprudence such as Carpenter v. United States, 585 U.S. _ (2018) — certain categories of digital data, including historical cell-site location information.
However, Fourth Amendment protections are subject to significant limitations in the context of the data transferred from NTP to Caldwell. Most critically, Fourth Amendment protections apply primarily to "US persons" — a category defined to include US citizens and lawful permanent residents. Non-US persons located outside the United States generally do not benefit from Fourth Amendment protections against surveillance by US government agencies. Since the vast majority of NTP's subscribers whose data is transferred to Caldwell are UK and EU residents who are not US persons, the Fourth Amendment provides them with limited, if any, constitutional protection against US government access to their data.
Additionally, US law draws a distinction between "content" data (the substance of communications) and "metadata" (data about communications, such as call records, session information, and network routing data). Under the "third-party doctrine" established in Smith v. Maryland, 442 U.S. 735 (1979), metadata voluntarily disclosed to third parties (such as telephone companies) has historically received reduced Fourth Amendment protection, although the Supreme Court's decision in Carpenter has introduced some uncertainty regarding the continued scope of this doctrine for certain categories of metadata, particularly location data. The data transferred from NTP to Caldwell consists primarily of metadata and network performance data rather than content, which places it in a category that has historically received less robust constitutional protection.
4.1.2 Foreign intelligence Surveillance Act (FISA)
The Foreign intelligence Surveillance Act of 1978, as amended, is the principal statutory framework governing government surveillance for foreign intelligence purposes within the United States. FISA establishes the Foreign intelligence Surveillance Court ("FISC" or "FISA Court"), a specialised court that reviews and approves applications for surveillance orders. Several provisions of FISA are potentially relevant to the transferred data.
4.1.2.1 FISA Section 702. FISA Section 702 (50 U.S.C. § 1881a), added by the FISA Amendments Act of 2008 and most recently reauthorised in 2018, is the surveillance authority of greatest relevance to this Assessment. Section 702 authorises the US government to target non-US persons who are reasonably believed to be located outside the United States in order to acquire "foreign intelligence information," as defined in 50 U.S.C. § 1801(e). The authority does not require individualised court orders for specific targets; instead, the FISA Court issues annual certifications approving the government's targeting and minimisation procedures, and the government conducts surveillance under those certifications.
Section 702 operates by compelling "electronic communication service providers" — as defined in 50 U.S.C. § 1881(b)(4) — to assist the government in acquiring foreign intelligence information. The definition of "electronic communication service provider" is broad and encompasses any provider of an electronic communication service, a remote computing service, or any other communication service provider who has access to wire or electronic communications. The definition includes providers of telecommunications services, internet service providers, cloud computing providers, and potentially other entities that handle or process electronic communications data.
Assessment of Caldwell's Potential Exposure Under Section 702. A critical question for this Assessment is whether Caldwell Analytics Inc. could be considered an "electronic communication service provider" within the meaning of Section 702. Our analysis considers the following factors:
Caldwell is not itself a provider of electronic communication services to end users. Caldwell does not operate a telecommunications network, email service, or messaging platform. Rather, Caldwell provides analytics services to telecommunications operators such as NTP, processing network performance data on behalf of its clients. Caldwell's primary function is data analytics, not the provision of communication services.
However, the definition in 50 U.S.C. § 1881(b)(4) is drafted broadly and includes any entity that has "access to wire or electronic communications either as such communications are transmitted or as such communications are stored." Caldwell processes data that is derived from electronic communications (subscriber metadata, session data, traffic routing information) and stores that data on its servers. While the data processed by Caldwell consists of metadata rather than content, and is pseudonymised, it is derived from electronic communications activity and may fall within the scope of the statutory definition.
Our conclusion is that Caldwell's classification as an "electronic communication service provider" under Section 702 is uncertain. There are reasonable arguments both for and against Caldwell falling within the definition. The broad statutory language could potentially encompass Caldwell's activities, particularly its processing of data derived from electronic communications. However, the fact that Caldwell does not itself transmit or facilitate communications, and processes only pseudonymised metadata rather than content, may weigh against classification. We are not aware of any reported instance in which an analytics processor in a comparable position has been compelled to assist under Section 702, though the classified nature of Section 702 directives makes definitive conclusions impossible.
Even if Caldwell were to be classified as an electronic communication service provider and were to receive a Section 702 directive relating to NTP data, the effectiveness of any resulting disclosure would be substantially limited by the pseudonymisation measures applied to the data. Section 702 data acquired from Caldwell would consist of pseudonymised metadata that cannot be linked to identified individuals without the re-identification key held by NTP in the UK/EEA. The intelligence value of such data, standing alone, would be significantly reduced compared to data that includes direct identifiers.
Section 702 is subject to certain procedural safeguards. The FISA Court issues annual certifications approving the government's targeting procedures (which govern how the government determines that a particular target is a non-US person reasonably believed to be located outside the US) and minimisation procedures (which govern the handling, retention, and dissemination of non-publicly available information about US persons that is incidentally collected). The Privacy and Civil Liberties Oversight Board (PCLOB) has conducted reviews of the Section 702 programme and has issued reports on its implementation, including recommendations for reform. However, these safeguards are primarily designed to protect the rights of US persons whose communications are incidentally collected, and provide limited protection for the targeted non-US persons.
4.1.2.2 FISA Traditional Surveillance (Title I) and Pen Register/Trap and Trace (Title IV). FISA Title I (50 U.S.C. §§ 1801–1812) authorises electronic surveillance targeting specific individuals within the United States where there is probable cause to believe that the target is a foreign power or agent of a foreign power. Title I surveillance requires an individualised order from the FISA Court, based on a showing of probable cause, and is more targeted than Section 702.
FISA Title IV (50 U.S.C. §§ 1841–1846) authorises the installation and use of pen registers and trap-and-trace devices (which record outgoing and incoming communication addressing information, respectively) in foreign intelligence investigations. Title IV also requires a FISA Court order, though the standard is lower than probable cause.
These authorities are less likely to be relevant to the transferred data than Section 702, as they are targeted at specific individuals rather than operating through broad programmatic collection. The pseudonymised and aggregated nature of the data transferred to Caldwell further reduces the likelihood that these authorities would be used in respect of the transferred data. The risk from these authorities is assessed as LOW.
4.1.2.3 FISA Section 501 (Business Records / "Section 215"). FISA Section 501 (50 U.S.C. § 1861), commonly known as "Section 215," previously authorised the government to apply to the FISA Court for orders requiring the production of business records and other tangible things relevant to foreign intelligence investigations. This authority was used as the legal basis for the National Security Agency's bulk telephony metadata collection programme, which was revealed by Edward Snowden in 2013.
The USA FREEDOM Act of 2015 substantially reformed Section 215 by ending the bulk collection of telephony metadata and imposing new limitations on the scope of production orders. In addition, several provisions of Section 215 expired on 15 March 2020 and have not been reauthorised by Congress. The current applicability of Section 215 is therefore limited.
The risk from FISA Section 501 / Section 215 is assessed as LOW due to the legislative reforms enacted by the USA FREEDOM Act and the expiration of key provisions.
4.1.3 Executive Order 12333
Executive Order 12333, issued by President Reagan on 4 December 1981 and subsequently amended, establishes the framework for US intelligence activities. EO 12333 authorises US intelligence agencies — in particular, the National Security Agency (NSA) — to collect foreign intelligence information, including signals intelligence (SIGINT), without FISA Court oversight when the collection occurs outside the United States or involves foreign-to-foreign communications. EO 12333 collection activities are conducted under internal executive branch oversight mechanisms rather than judicial oversight.
EO 12333 is of particular concern in the context of this transfer because data transmitted between NTP's UK/EU data centres and Caldwell's US data centre traverses international telecommunications links (principally transatlantic fibre optic cables). Data in transit across these links may potentially be subject to interception by US intelligence agencies conducting upstream collection activities under EO 12333 authority. Such collection would occur without the knowledge or involvement of either NTP or Caldwell, and without judicial oversight.
The key mitigant for EO 12333 upstream collection risk is the encryption of data in transit. As described in Section 6.1.2 below, all data transmissions between NTP and Caldwell are encrypted using TLS 1.3 (Transport Layer Security version 1.3), with an additional VPN tunnel overlay. TLS 1.3 provides strong cryptographic protection for data in transit, rendering intercepted data unintelligible to any party that does not hold the encryption keys. While it is theoretically possible that a state-level intelligence agency could possess the capability to decrypt TLS 1.3-encrypted data, this is not currently believed to be feasible using publicly known methods, and TLS 1.3 is generally regarded as providing a high level of protection against interception.
Additionally, Executive Order 14086 (discussed in Section 4.1.5 below) introduced new safeguards for signals intelligence activities, including requirements that signals intelligence collection be necessary and proportionate to the validated intelligence priority pursued. While EO 14086 operates through executive authority rather than statute and does not provide the same level of legal certainty as legislation, it represents a material improvement in the safeguards applicable to EO 12333 collection activities.
The risk from EO 12333, after taking into account the encryption of data in transit, is assessed as LOW.
4.1.4 Clarifying Lawful Overseas Use of Data Act (CLOUD Act)
The Clarifying Lawful Overseas Use of Data Act ("CLOUD Act"), enacted on 23 March 2018, amends the Stored Communications Act (18 U.S.C. § 2713) to provide that a provider of an electronic communication service or remote computing service, as defined in the Stored Communications Act, shall comply with the obligations of the Act to preserve, back up, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider's possession, custody, or control, "regardless of whether such communication, record, or other information is located within or outside of the United States."
The CLOUD Act is relevant to Caldwell as a US corporation. As a US-based entity that processes and stores electronic data, Caldwell is subject to US law enforcement and national security process, including warrants, subpoenas, and court orders issued under the Stored Communications Act. The CLOUD Act clarifies that Caldwell's obligation to comply with such process extends to data in its possession, custody, or control regardless of where that data is physically stored. This means that even if NTP were to require Caldwell to store NTP data on servers physically located outside the United States (for example, in the EEA), Caldwell could still be compelled to produce that data in response to a valid US legal process.
Assessment of Caldwell's Exposure. Caldwell could, in principle, be compelled by a valid US warrant, subpoena, or court order to produce NTP subscriber analytics data in its possession. Such a compulsion could arise in the context of a criminal law enforcement investigation, a national security investigation, or other lawful US legal process.
However, several mitigating factors reduce the practical impact of this risk:
Pseudonymisation. The data held by Caldwell is pseudonymised. Even if Caldwell were compelled to produce data in response to a CLOUD Act request, the produced data would consist of pseudonymised network analytics data that cannot be linked to identified individuals without the re-identification key held by NTP in the UK/EEA. The intelligence or investigative value of such data, without the re-identification key, is substantially limited.
CLOUD Act Executive Agreements. The CLOUD Act provides a framework for the US to enter into executive agreements with qualifying foreign governments, under which orders issued by the partner government's authorities can be served directly on US providers, and vice versa. The UK-US CLOUD Act Agreement (also known as the Data Access Agreement) entered into force in October 2022. Under this agreement, UK law enforcement authorities may, subject to certain conditions, obtain orders requiring US providers to disclose data directly, without going through the traditional Mutual Legal Assistance Treaty (MLAT) process. The agreement includes safeguards such as requirements that orders be targeted, relate to a specific account, and be reviewed and authorised by an appropriate authority. The existence of this bilateral agreement provides a structured framework for UK-US law enforcement cooperation and may reduce the likelihood of unilateral US government access to NTP data outside of the agreed framework. However, the agreement does not prevent the US government from seeking access to data under domestic US legal process in parallel.
Comity Analysis. The CLOUD Act permits a provider to file a motion to modify or quash a legal process where the provider reasonably believes that the customer or subscriber is not a US person and does not reside in the US, and that the required disclosure would create a material risk that the provider would violate the laws of a qualifying foreign government. This comity provision could, in theory, be invoked by Caldwell in respect of NTP data, given that NTP's subscribers are UK and EU residents and disclosure could conflict with GDPR requirements. However, the effectiveness of this provision is uncertain, and its invocation is at the discretion of the provider and ultimately subject to the court's determination.
The risk from the CLOUD Act, after taking into account the pseudonymisation of transferred data, is assessed as MEDIUM.
4.1.5 Executive Order 14086 — Enhancing Safeguards for US signals intelligence Activities
Executive Order 14086, signed by President Biden on 7 October 2022, establishes new requirements for US signals intelligence activities that are directly relevant to this Assessment. EO 14086 was issued in response to the Schrems II judgment and the subsequent negotiations between the US and the EU that led to the EU-US Data Privacy Framework.
The key elements of EO 14086 include:
Necessity and Proportionality Standards. EO 14086 requires that signals intelligence collection activities be conducted only as necessary to advance a validated intelligence priority and only to the extent and in a manner that is proportionate to that priority. This represents a significant departure from prior US practice, which did not impose an express proportionality requirement on signals intelligence collection. The introduction of a proportionality standard is one of the central improvements in the US framework since Schrems II.
Prohibited and Restricted Objectives. EO 14086 prohibits signals intelligence collection for certain purposes, including suppressing or burdening criticism, dissent, or the free expression of ideas, disadvantaging persons based on their ethnicity, race, gender, or religion, or providing a competitive advantage to US companies. It also restricts bulk collection to specified objectives and requires that targeted collection be prioritised over bulk collection wherever feasible.
Data Protection Review Court (DPRC). EO 14086 establishes a two-tier redress mechanism for individuals who believe their personal data may have been collected through US signals intelligence activities in violation of US law. The first tier is a review by the Civil Liberties Protection Officer of the Office of the Director of National intelligence (ODNI CLPO). The second tier is a review by the Data Protection Review Court (DPRC), a body composed of individuals appointed by the Attorney General from outside the US government, with appropriate security clearances. The DPRC has the authority to issue binding determinations.
Assessment of EO 14086's Effectiveness. EO 14086 represents a material improvement in the US legal framework for the protection of non-US persons' data. The introduction of necessity and proportionality requirements, and the establishment of the DPRC redress mechanism, address two of the central concerns identified by the CJEU in the Schrems II judgment.
However, we note the following limitations:
Legal Status. EO 14086 is an executive order, not legislation enacted by Congress. As such, it is subject to amendment or revocation by the current or any future President without Congressional approval. This creates a degree of legal uncertainty regarding the permanence of the safeguards it establishes. While the current administration has indicated its commitment to maintaining these safeguards, there can be no guarantee that a future administration will not modify or revoke EO 14086.
DPRC Independence. The DPRC has been criticised by some commentators for lacking full judicial independence, as its members are appointed by the Attorney General (a member of the executive branch) rather than by an independent authority. The DPRC also operates within a classified environment, which limits transparency. However, the European Commission, in its DPF adequacy decision, concluded that the DPRC provides sufficient independence and impartiality for the purposes of Article 45 GDPR.
Effectiveness of Remedies. Individuals who file complaints through the DPRC mechanism will not receive confirmation of whether they were in fact surveilled. The DPRC's determination will confirm only that the review did not identify any violations, or that any identified violations have been remedied. This "neither confirm nor deny" approach is a feature of US national security law and limits the transparency of the redress mechanism. The practical effectiveness of the DPRC remains untested as at the date of this Assessment, as the mechanism has only recently been established.
Relevance to the Current Transfer. EO 14086 provides additional safeguards for the transferred data but does not eliminate all of the risks identified in the Schrems II judgment. It is a relevant and positive contextual factor in our overall assessment but is not, on its own, sufficient to ensure an essentially equivalent level of protection. Supplementary measures remain necessary, as described in Section 6 below.
4.2 EU-US Data Privacy Framework (DPF)
On 10 July 2023, the European Commission adopted an adequacy decision pursuant to Article 45 of the GDPR for the EU-US Data Privacy Framework ("DPF"). The DPF adequacy decision permits the transfer of personal data from the EU to US organisations that have self-certified under the DPF and committed to complying with its principles. The DPF replaces the EU-US Privacy Shield, which was invalidated by the Schrems II judgment.
The DPF adequacy decision is based, in part, on the safeguards introduced by EO 14086, including the necessity and proportionality requirements for signals intelligence collection and the DPRC redress mechanism. The European Commission concluded that the DPF, together with the reforms under EO 14086, provides an adequate level of protection for personal data transferred to self-certified US organisations.
Caldwell's DPF Certification Status. As of the date of this Assessment (4 August 2023), Caldwell Analytics Inc. has not self-certified under the EU-US Data Privacy Framework. We understand from Jennifer Huang (VP, Legal & Privacy) that Caldwell is currently evaluating self-certification and may pursue it in the future, but has not yet completed the process. As a result, the DPF adequacy decision cannot be relied upon as the transfer mechanism for the transfer of NTP personal data to Caldwell. The operative transfer tools remain the EU SCCs (Module 2) and the UK IDTA.
Notwithstanding the fact that the DPF adequacy decision is not directly applicable to this transfer, the decision — and the underlying assessment of the US legal framework that it reflects — is a relevant contextual factor in this Assessment. The European Commission's conclusion that the US framework, as reformed by EO 14086, provides an adequate level of protection for transfers to DPF-certified organisations indicates a positive overall assessment of the current US legal landscape. While the adequacy decision applies only to DPF-certified organisations, the safeguards introduced by EO 14086 (which underpin the adequacy decision) apply to all signals intelligence collection, regardless of whether the data is held by a DPF-certified organisation. This means that the improvements in the US framework reflected in the DPF adequacy decision are relevant to the overall risk assessment for this transfer.
4.3 Assessment of Caldwell's Exposure to Government Access Requests
4.3.1 Representations from Caldwell Analytics Inc.
As part of this Assessment, we have obtained written representations from Caldwell Analytics Inc. regarding its experience with and exposure to government access requests. These representations were provided by Jennifer Huang, Vice President, Legal & Privacy, Caldwell Analytics Inc., and transmitted via Hargrove Lister & Webb LLP (Natalie Prescott, Partner, Data Privacy & Cybersecurity) in letters dated 14 July 2023 and 28 July 2023.
The Caldwell Representations confirm the following:
(a) Caldwell has not received any FISA Section 702 directives, national security letters ("NSLs"), or FISA Court orders relating to NTP data or any telecommunications subscriber data processed on behalf of any of Caldwell's approximately 30 telecommunications operator clients.
(b) Caldwell has not received any CLOUD Act warrants, subpoenas, or court orders relating to NTP data or any data processed on behalf of NTP.
(c) Caldwell has not received any other form of government access request (including requests from state or local law enforcement authorities) relating to NTP data.
(d) Caldwell commits to promptly notifying NTP (and in any event within 48 hours of receipt) of any legally binding request for access to NTP personal data from a US government authority, to the extent such notification is not prohibited by applicable US law. Where notification is prohibited (for example, by a non-disclosure order accompanying a FISA order or NSL), Caldwell commits to using its best efforts to obtain a waiver of the prohibition and, where possible, to challenge the non-disclosure order.
(e) Caldwell commits to challenging any government access request that it reasonably considers to be unlawful, disproportionate, or overly broad under applicable US law. In any event, Caldwell will seek to limit any required disclosure to the minimum data necessary to comply with the request.
(f) Caldwell commits to providing NTP with an annual transparency report on the number and nature of government access requests received by Caldwell across all data processed (not limited to NTP data), including the legal authority under which each request was made and the outcome.
Assessment of the Reliability and Weight of These Representations. The Caldwell Representations are based on Caldwell's own knowledge and records and are provided in good faith. They have been transmitted via Caldwell's external counsel (Hargrove Lister & Webb LLP), adding a degree of professional accountability. We consider these representations to be credible and to provide useful evidence of Caldwell's actual experience with government access requests.
However, certain limitations on the weight of these representations must be acknowledged:
Forward-looking limitations. The absence of prior government access requests does not guarantee that Caldwell will not receive such requests in the future. Changes in the geopolitical environment, the nature of Caldwell's business, or the data it processes could increase the likelihood of government interest.
Non-disclosure prohibitions. US law may, in certain circumstances, prohibit Caldwell from disclosing the existence of government access requests. FISA orders may include non-disclosure provisions that prevent Caldwell from notifying NTP or even from acknowledging the existence of the order. Similarly, NSLs typically include non-disclosure requirements (though recipients may challenge these requirements in court). While Caldwell has committed to seeking waivers and challenging non-disclosure orders, there is no guarantee that such challenges would be successful. This means that the notification commitment, while valuable, cannot be relied upon as an absolute safeguard.
Scope of representations. The representations relate to Caldwell's experience to date and its current assessment of its legal obligations. They do not constitute a legal opinion on the scope of US surveillance authorities or Caldwell's potential exposure, and should not be relied upon as such.
4.3.2 Caldwell's Technical and Organisational Measures
In addition to the Caldwell Representations regarding government access, we have received and reviewed technical documentation from Derek Rawlings, Chief Technology Officer of Caldwell Analytics Inc., describing Caldwell's data centre infrastructure and security measures.
The Caldwell Technical Documentation confirms the following:
Data Centre Environment. NTP personal data is processed and stored within Caldwell's primary data centre located at 2700 Technology Drive, San Jose, California. The data centre is a purpose-built facility operated by Caldwell (not a co-located or shared facility). The data centre is equipped with redundant power supplies, environmental controls, physical access controls (including biometric access, 24/7 security personnel, and CCTV monitoring), and fire suppression systems.
SOC 2 Type II Certification. Caldwell's data centre and information security practices are SOC 2 Type II certified by an independent third-party auditor (Tindall Tanaka CPAs LLP). The most recent SOC 2 Type II report covers the period from 1 October 2021 to 30 September 2022 and confirmed that Caldwell's controls were suitably designed and operating effectively throughout the audit period. Caldwell has committed to maintaining SOC 2 Type II certification and providing NTP with copies of audit reports on an annual basis.
Access Controls. Caldwell implements role-based access control (RBAC) for all s