EU/USA Agreement: protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offenses

PURPOSE: to conclude, on behalf of the European Union, the Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offenses.

PROPOSED ACT: Council Decision.

ROLE OF THE EUROPEAN PARLIAMENT: Council may adopt the act only if Parliament has given its consent to the act. 

BACKGROUND: the Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offenses was signed on 2 June 2016, subject to its conclusion at a later date.

The Agreement should now be approved on behalf of the Union.

The Union has competence covering all the provisions of the Agreement.

In particular, the Union adopted Directive (EU) 2016/680 of the European Parliament and of the Council1 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data. This Directive provides transfers by Member States subject to appropriate safeguards.

CONTENT: the draft Council Decision seeks to approve, on behalf of the European Union, the Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offenses.

The Agreement aims at establishing a comprehensive framework of data protection principles and safeguards when personal information is transferred for criminal law enforcement purposes between the United States, on the one hand, and the European Union or its Member States on the other. Its objective is to ensure a high level of data protection and, thereby, enhance cooperation between the parties.

Whilst not being itself the legal basis for any transfer of personal information to the United States, the Agreement supplements, where necessary, data protection safeguards in existing and future data transfer agreements or national provisions authorising such transfers.

The United Kingdom and Ireland are not bound by the rules laid down in the Agreement which relate to the processing of personal data by the Member States when carrying out activities which fall within the scope of Chapter 4 or 5 of Title V of Part Three of the TFEU where the United Kingdom and Ireland are not bound by the rules governing the forms of judicial cooperation in criminal matters or police cooperation which require compliance with the provisions laid down in the Agreement.

Denmark is not bound by the rules laid down in the Agreement or subject to their application which relate to the processing of personal data by the Member States when carrying out activities which fall within the scope of Chapter 4 or 5 of Title V of Part Three of the TFEU.