EU-U.S. Umbrella Agreement Gets ‘Amber Light’ from Article 29 Working Party

As a sign of support for the deal, the Working Party welcomes the initiative to set up a general data protection framework in relation to law enforcement cooperation.  In a fairly positive tone, the Working Party states that the Umbrella Agreement “considerably strengthens the safeguards in existing law enforcement bilateral treaties with the US, some of which were concluded before the development of the EU data protection framework.” The Working Party also explicitly “recognises the legitimate case for efficient exchange of information in the context of co-operation between law enforcement authorities”.

However, the Working Party also states its intention to monitor whether the Umbrella Agreement fully satisfies key data protection requirements and whether it is in compliance with Article 7 and Article 8 of the Charter of Fundamental Rights of the European Union.  It also recommends requesting further assurances from the US government explaining and confirming the scope of redress rights granted to data subjects in the EU through the Judicial Redress Act, how records from US law enforcement agencies are exempted from the application of the Privacy Act, and the compatibility of these practices with the Umbrella Agreement.

The Working Party adds that clarification may be needed to ensure that the level of protection of personal data afforded by the Umbrella Agreement is fully consistent with EU law, particularly given that:

• The concepts of “personal data” and “data processing” are differently defined by US and EU law.

• The data retention period is insufficiently strictly defined in relation to the purpose pursued.

• The restrictions on individuals’ access rights are very broad.

• Access could be improved by the establishment of an indirect access right mechanism.

Once the Agreement is approved by the European Parliament, the Working Party intends to continue to monitor its implementation and oversight measures to ensure that the rights afforded are effective.  As part of this exercise, the Working Party undertakes to follow future developments in legislation and in the courts in the U.S. and the EU.

This statement by the Working Party follows its recent announcement that it had created a working group for enforcement actions on organisations targeting several member states, which is yet another sign of the growing international ambitions of the EU data protection authorities.

Elizabeth Campion, a paralegal in the London office, contributed to this entry.

Authored by Eduardo Ustaran