Out-Law News 1 min. read

EU endorses new 'umbrella' agreement on data protection for law enforcement


A new agreement to govern how personal data should be handled when exchanged between EU and US law enforcement agencies has been approved by EU law makers.

The Council of Ministers gave its formal support for the EU-US data protection 'Umbrella Agreement' to be finalised on Friday last week. MEPs in the European Parliament had voted to approve the agreement earlier in the week.

The umbrella agreement does not of itself provide a lawful authority for the transfer of the data to the US from the EU. Instead it applies privacy protections to data that is exchanged between law enforcement agencies in the EU and US for the purpose of prevention, investigation, detection and prosecution of criminal offences, including terrorism. Those safeguards include limitations on data use, prior consent from EU authorities before any onward transfer of data, a requirement to define data retention periods, and citizens' rights to access and correct data held about them.

EU justice commissioner Věra Jourová said: "More than ever, the EU and the US need to cooperate to fight crime and terrorism and protect citizens from common security challenges. At the same time this cooperation needs to safeguard the European fundamental right to privacy. The 'Umbrella Agreement' will ensure that the exchanges of personal data, such as criminal records, names or addresses, are governed by strong data protection rules."

Negotiations on the new agreement have taken a number of years. The conclusion of the deal was delayed in recent months after EU officials insisted that the US pass new legislation to give European citizens the right to pursue legal action against some US agencies in US courts if their personal data has been mishandled when used by the US in criminal and terror investigations. The US Judicial Redress Act was signed into law earlier this year.

The new agreement will be formally concluded during a ministerial meeting in Washington between EU and US officials on Monday, and will come into force "once the US authorities have completed their internal procedures", the Council said in a statement. The European Commission said the US "now has to make the necessary designations under the Judicial Redress Act".

The data protection umbrella agreement is separate from the EU-US Privacy Shield that facilitates the transfer of personal data from the EU to the US by businesses.

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.