European Union negotiations with the US government for an international data protection framework agreement in the law enforcement area have been finalised. The “Umbrella Agreement” provides that personal data transferred between EU and US law enforcement authorities, such as names, addresses, and criminal records, can only be shared for the purpose of prevention, detection, investigation and prosecution of criminal offences, including terrorism. It must not be used for further incompatible purposes. In cases where a US authority intends to transfer the data further, to a third country or international organisation, it will first have to obtain the consent of the law enforcement authority in the EU which originally transferred the data to the US.
At present EU citizens are unable to obtain redress in US courts, where their data is unlawfully processed. The Agreement will require the US to adopt legislation (the Judicial Redress Bill) granting EU citizens the same judicial redress rights as US citizens in case of privacy breaches by US authorities to whom their data has been disclosed. The formal conclusion of the agreement will be subject to the adoption of that Bill.
Q&A on the EU-US data protection “Umbrella Agreement”