EU/USA Agreement: protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offenses

PURPOSE: to conclude, on behalf of the European Union, an Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offences.

LEGISLATIVE ACT: Council Decision (EU) 2016/2220 on the conclusion, on behalf of the European Union, of the Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offences.

CONTENT: under this Decision, the Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offences is approved on behalf of the European Union. It was signed on 2 June 2016, subject to its conclusion at a later date.

Purpose: the Agreement aims to ensure a high level of protection of personal information and enhance cooperation between the United States and the European Union and its Member States, in relation to the prevention, investigation, - detection or prosecution of criminal offences, including terrorism.

For this purpose, this Agreement establishes the framework for the protection of personal information when transferred between the United States, on the one hand, and the European Union or its Member States, on the other.

This Agreement in and of itself shall not be the legal basis for any transfers of personal information. A legal basis for such transfers shall always be required. The Agreement supplements data protection safeguards in existing and future data transfer agreements or national provisions authorising such transfers.

Data protection principles and safeguards: the Agreement covers important principles governing personal data processing as well as key safeguards and limitations:

• purpose and use limitations: the transfer of personal information shall be for specific purposes authorised by the legal basis for the transfer and the further processing of personal information by a Party shall not be incompatible with the purposes for which it was transferred;
• onward transfer: where a Competent Authority of one Party has transferred personal information relating to a specific case to a Competent Authority of the other Party, that information may be transferred to a State not bound by the present Agreement or international body only where the prior consent of the Competent Authority originally sending that information has been obtained;
• maintaining quality and integrity of information: the Parties shall take reasonable steps to ensure that personal information is maintained with such accuracy, relevance, timeliness and completeness as is necessary and appropriate for lawful processing of the information;

- information security and notification of an information security incident: the Parties shall ensure that they have in place appropriate technical, security and organisational arrangements for the protection of personal information against all of the following: (a) accidental or unlawful destruction; (b) accidental loss; and (c) unauthorised disclosure, alteration, access, or other processing;

- the setting of precise retention periods to ensure that data will not be retained longer than is necessary and appropriate. Processing of personal information revealing racial or ethnic origin, political opinions or religious or other beliefs, trade union membership or personal information concerning health or sexual life shall only take place under appropriate safeguards in accordance with law.

The Parties shall ensure that any individual is entitled to seek access to his or her personal information and request a rectification if they consider it to be either inaccurate or has been improperly processed. They shall also ensure that any individual is entitled to seek administrative redress where he or she believes that his or her request for access has been improperly denied.

ENTRY INTO FORCE: 10.12.2016.