After four years of negotiations between the EU and the US, the text of the bilateral data protection ‘Umbrella Agreement’ has just been sealed. The Umbrella Agreement ensures the equal data protection rights of every US and EU citizens when it comes to criminal data transfers of personal information, such as names, addresses, criminal records, between EU and US criminal authorities. However, before it can be adopted the EU wants the US Congress to adopt the Judicial Redress Act.
The Agreement limits such data transfers for the sole purpose of prevention, detention, investigation and prosecution of criminal offenses that encompasses terrorist acts.
Other rules that fall under the Umbrella agreement require US government agencies to publish how long they will retain confidential the personal data and prohibit these agencies from holding onto the data indefinitely. These rules were already applicable in the EU.
Throughout the negotiations, tech and Internet platforms, such as Facebook, Google, IBM, Foursquare, Yahoo, and many others, supported the agreement. All are eager to see clearer and harmonised data protection rules between the two continents, in the hope to gain more trust from citizens.
Věra Jourová, EU Commissioner for Justice explained in a statement yesterday that the Umbrella Agreement is “an important step to strengthen the fundamental rights to privacy in Europe in practice and to rebuild trust in EU-US data flows”. In June, Commissioner Jourová and her counterpart Attorney General Loretta Lynch had committed to adopt the Agreement by the end of this year.
The Umbrella Agreement was first proposed in 2009, when the European Parliament published a resolution calling for an EU-US agreement that ensures adequate protection of civil liberties and personal data. The call was taken up by the European Commission a year later.
Today, the Agreement is back in the hands of the European Parliament who is letting everyone know that it will not pass the Agreement until the US Congress has adopted the last piece of the puzzle: the bipartisan Judicial Redress Act.
The Redress Act would allow Europeans to sue US government agencies misusing European private data, bringing EU and US citizens’ rights on an equal footing. US House Representative Jim Sensenbrenner (R-Wis.), architect of the original Patriot Act who put forward the Redress Act in the spring, is optimistic that the vote will go through Congress. As a matter of fact, an event is taking place already tomorrow September 10 in the Congress to discuss the Act, with US Senator Hatch (R-Utah) and Senator Murphy (D-Conn.), who in June introduced the Redress Act in the Senate.
We also need to be aware of the key role of the European Parliament in the often sensitive debate over data protection. Since the Lisbon Treaty, the Parliament has to give its consent for the majority of international agreements, giving a different angle to international negotiations. The lively debates in the European Parliament and consequent rejection of the Anti-Counterfeiting Trade Agreement (ACTA) in 2012, show that MEPs take this role very seriously and are ready to reject multilateral agreements even when these have been negotiated for years. The Umbrella agreement will be discussed in the LIBE committee in the European Parliament on 15 September.
In essence, what the Umbrella Agreement provides is a strengthening and restoration of trust between European and American partners, and by extension to its citizens, especially since the Snowden revelations in 2013 affected the relationship negatively. Restoring this trust around citizens’ personal data is the stepping stone for further privacy dialogues in the future, including the Safe Harbour 2.0 provision, which has been at a standstill for a while. There is will from legislators to move forward on increased international data cooperation, but it will definitely still take time, and it could even be moving too slow considering the fast pace of technology.
Charlotte Nørlund-Matthiessen is a Consultant at FTI Consulting in Brussels and Vladimir Beroun is a Senior Consultant at FTI Consulting in Brussels.