U.S.-EU Law Enforcement Data Transfer Deal Nearly Done

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Stephen Gardner

Sept. 9 — Negotiators from the U.S. and the European Union have initialed a data protection agreement that would provide minimum privacy protections for personal data transferred across the Atlantic for law enforcement purposes, the EU's top data protection official said Sept. 8.

Věra Jourová, the EU Commissioner for Justice, Consumers and Gender Equality, said in a statement that an “umbrella agreement” governing data transfer for law enforcement purposes had been finalized in principle and would take effect once the U.S. Congress has given EU citizens a right of redress in cases of privacy breaches.

Talks on an EU-U.S. umbrella agreement to combat crime and terrorism started in 2011, but they were held up by the redress issue. U.S. citizens have the right to seek judicial redress in the EU in case of the misuse of their data transferred for law enforcement purposes, but EU citizens have no reciprocal right in the U.S.

However, in March 2015, Rep. Jim Sensenbrenner (R-Wis.) introduced in the U.S. House of Representatives a judicial redress bill (H.R. 1428) that would authorize the U.S. Department of Justice to designate foreign countries whose citizens could bring civil actions in the U.S. courts under the 1974 Privacy Act. The bill was referred to the House Judiciary Committee Subcommittee on the Constitution and Civil Justice.

Jourová said the U.S. Congress should aim for “swift adoption” of the judicial redress bill, which would “enable us to finally sign and conclude the umbrella agreement.”

Sensenbrenner said in a statement Sept. 8 that he was “optimistic” that the judicial redress bill “will not only be brought before Congress, but will be passed with bipartisan support.”

As of Sept. 9 the bill has only one co-sponsor, Rep. John Conyers Jr. (D-Mich.).

Privacy Safeguards

The provisional agreement sets out a series of protections for data transferred for law enforcement purposes.

These include purpose limitation, a requirement that data should be retained only as long as necessary or appropriate; a right for individuals to access their data and seek rectification; and a right for individuals to seek redress in cases in which the privacy protections are breached, or if data are unlawfully disclosed.

The agreement would also prohibit the onward transfer of data without the consent of authorities in the country in which the data originated.

Jourová said the umbrella agreement is “an important step to strengthen the fundamental right to privacy effectively and to rebuild trust in EU-US data flows.”

Concerns about the protection of personal data transferred from the EU to the U.S. arose in the wake of the 2013 leaks from Edward Snowden, a former employee of a U.S. National Security Agency contractor, about NSA surveillance practices.

Snowden's leaks created pressure for EU and U.S. negotiators to complete the umbrella agreement. The leaks also led to questions being raised about the separate U.S.-EU Safe Harbor Program, which allows companies to transfer EU citizens' data to the U.S. if they self-certify their compliance with privacy principles similar to those contained in the EU Data Protection Directive (95/46/EC). The European Union Court of Justice's advocate general will Sept. 23 give his opinion on the legality of the program.

The advocate general's opinion is a nonbinding recommendation to the ECJ.

Common Standard

A European Commission spokesperson who asked not to be named told Bloomberg BNA Sept. 9 that the EU-U.S. umbrella agreement would provide a common level of data protection that “raises the standard” compared to current bilateral arrangements between the U.S. and individual EU countries on the transfer of data for law enforcement purposes.

On the EU side, once judicial redress for EU citizens in the U.S. is in place, the umbrella agreement would have to be ratified by the European Parliament before formal adoption by the EU Council, which represents the governments of the 28 EU member states.

To contact the reporter on this story: Stephen Gardner in Brussels at correspondents@bna.com

To contact the editor responsible for this story: Katie W. Johnson at kjohnson@bna.com

A European Commission fact sheet on the umbrella agreement is available at http://bit.ly/1Ov36DQ.