EU/USA Agreement: protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offenses
The Committee on Civil Liberties, Justice and Home Affairs adopted the report by Jan Philipp ALBRECHT (Greens/EFA, DE) on the draft Council decision on the conclusion, on behalf of the European Union, of the Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offenses.
The committee recommended that the European Parliament give its consent to the conclusion of the Agreement.
In the short justification accompanying the draft resolution, it is recalled that, following calls by the European Parliament, on 3 December 2010, the Council adopted a decision authorising the Commission to open negotiations on an Agreement between the European Union and the United States of America on the protection of personal data when transferred and processed for the purpose of preventing investigating, detecting or prosecuting criminal offences, including terrorism, in the framework of police cooperation and judicial cooperation in criminal matters.
On 28 March 2011, the Commission opened negotiations with the U.S. Department of Justice. Over the course of the negotiations, the Parliament was regularly informed.
The text of the agreement was initialled on 8 September 2015.
Following the adoption by the U.S. Congress of the Judicial Redress Act on 24 February 2016, on 18 July 2016, the Council decided to request the European Parliament to give its consent to the conclusion of the Agreement.
The purpose of the Agreement is to ensure a high level of protection of the fundamental rights and freedoms of individuals, in particular the right to privacy with the respect to the processing of personal data when personal data are transferred to competent authorities of the European Union and its Member States and the US for these purposes.
The Agreement contains provisions setting out the basic data protection principles, namely:
- purpose and use limitations of personal data transferred;
- data quality and integrity and retention periods;
- rules on onward transfers, both to domestic authorities of the contracting party and to third country authorities or international organisation not bound by the Agreement. In the latter case, the prior consent of the law enforcement authority originally transferring the data is required.
One of the main novelties of the Umbrella Agreement is that it will allow the citizens of each Party to be able to seek judicial redress for the i) denial of access, ii) denial of rectification or iii) unlawful disclosure by the authorities of the other Party. These rights are exercised pursuant to the law of the State where they are invoked.
In order to overcome the lack of rights for non-US citizens, the US Congress adopted the Judicial Redress Act on 24 February 2016. This Act will extend to the citizens of “covered countries” (e.g. the Member States) some judicial redress grounds provided under the 1974 US Privacy Act.
Regarding the exemptions possible under Section 552a(j)(2) of the US Privacy Act, the data subject rights conferred by the Umbrella Agreement are formulated in an unconditional manner and accordingly, the US authorities may not invoke exemptions of the US Privacy Act for law enforcement databases to deny an effective judicial redress to EU citizens as it is currently the case for law enforcement databases such as for PNR data or the TFTP.
The Umbrella Agreement provides that the Parties shall have in place one or more public oversight authorities that exercise independent oversight functions and powers, including review, investigation and intervention, where appropriate on their own initiative. It shall be subject to periodic joint reviews.
The Rapporteur concluded that the agreement constitutes major progress for the protection of personal data when transferred between the EU and the US in the context of law enforcement activities.