This article is more than 1 year old

EU-US data sharing deal for cops edges closer as usual suspects moan

Euro Commission says the text is set in stone and WILL take effect... in due course

After four years of talks, the EU and the US have finally reached a “gentleman’s agreement” on data sharing for law enforcement.

The so-called Umbrella Agreement should allow the exchange of personal data between the EU and the US “for the purpose of prevention, detection, investigation and prosecution of criminal offences” so long as it is not “processed beyond compatible purposes.”

“Once in force, this agreement will guarantee a high level of protection of all personal data when transferred between law enforcement authorities across the Atlantic. It will in particular guarantee that all EU citizens have the right to enforce their data protection rights in US courts. The finalisation of the Umbrella Agreement negotiations is therefore an important step to strengthen the fundamental right to privacy effectively and to rebuild trust in EU-US data flows,” said EU Justice Commissioner Věra Jourová.

Although the final text has not been published and the negotiations were conducted behind closed doors, the European Commission has confirmed some elements.

According to the Commish: “Individuals’ personal data may not be retained for longer than necessary or appropriate. These retention periods will have to be made publicly available. Any individual will be entitled to access their personal data and request it to be corrected if it is inaccurate.”

EU citizens will also have the same rights as Americans to seek judicial redress before US courts if US authorities deny access or rectification, or unlawfully disclose personal data, said Jourova. Americans have data protection rights in Europe, so this is seem as a quid pro quo. However, the Judicial Redress Bill has yet to be approved by Congress, and, although it would put Europeans on a level footing with Americans, those data privacy rights are not absolute because certain types of data are exempt.

The US Mission to the EU explained (PDF): “In the United States, the Privacy Act of 1974 allows individuals to access and correct information that federal government agencies have obtained about them and it provides for judicial redress to enforce those rights. However, law enforcement records collected for criminal investigations are regularly exempted from these provisions of the Privacy Act, in a manner similar to analogous exemptions in EU data protection laws.”

“People seem to believe all the loopholes will have been closed once the US has adopted an act that gives EU citizens equal rights to judicial redress. But that is a faulty argument, as US citizens do not have full rights either. For example: the use of PNR data is exempt from the Privacy Act. So neither US nor EU citizens have full judicial redress in this case,” said Dutch MEP Sophie In’t Veld.

Despite the EU Commission presenting the agreement as a done deal, it will not take effect until approved by the European Parliament.

“How does this umbrella agreement sit with the data protection laws currently being negotiated,” asked In't Veld. “I have asked the Commission countless times, but they refuse to give a clear answer. Basically the umbrella agreement has far weaker safeguards than the EU Data Protection Regulation and Directive will have (expectedly), but if there is a conflict between the two legal instruments, it appears the agreement takes precedence,” continued the Dutch MEP.

“Ergo: an agreement that has been hammered out in negotiations behind closed doors, will override legislation that has been adopted in a democratic procedure, and as the negotiations on a fairly complex legal document have taken place below the radar, there has not been much political pressure,” she continued. “I fear it will be pushed through and not meet with much resistance.”

Another issue is the level of oversight from EU data protection authorities (DPAs). If a US authority wants to further transfer EU data to a third country or international organisation, it must get consent from the law enforcement authority that originally transferred the data to the US, but not the data protection authority.

“This is common practice in all existing police cooperation / mutual legal assistance treaties,” said the European Parliament’s Mr Privacy, Jan Philipp Albrecht. “Of course we would wish a more active involvement of the DPAs, but the agreement doesn't undermine existing standards here. In fact it assures that at least the authority of origin has to consent to and can deny onward transfers. In some covered agreements this wasn't even the case so the umbrella gives legal certainty in this regard.”

The EU Commission is due to make a presentation about the agreement to the parliament’s justice and civil liberties committee next week, but to date, even MEPs have yet to see the full text. The fat lady has certainly not yet sung on this data deal. ®

More about


Send us news

Other stories you might like