Privacy & Information Security Law Blog

On September 8, 2015, representatives from the U.S. Government and the European Commission initialed a draft agreement known as the Protection of Personal Information Relating to the Prevention, Investigation, Detection and Prosecution of Criminal Offenses (the “Umbrella Agreement”). The European Commission’s stated aim for the Umbrella Agreement is to put in place “a comprehensive high-level data protection framework for EU-U.S. law enforcement cooperation.” The Umbrella Agreement has been agreed upon amid the ongoing uncertainty over the future of the U.S.-EU Safe Harbor, and was drafted shortly before the release of the September 23 Advocate General’s Opinion in the Schrems v. Facebook litigation. The content of the Umbrella Agreement is in its final form, but its implementation is dependent upon revisions to U.S. law that are currently before Congress.

The Umbrella Agreement sets out a number of protections for personal information transferred between the EU and the U.S. for law enforcement purposes. The Umbrella Agreement applies strict limits on the purposes for which personal information can be used when transferred between one Party (the “Transferor”) and another Party (the “Recipient”) for law enforcement purposes. It imposes obligations on the Recipient to maintain the security and accuracy of the transferred personal information, and requires the Recipient to notify the Transferor in the event of a data breach affecting that personal information. The Umbrella Agreement also restricts the period for which the transferred personal information can be retained by the Recipient, and requires the consent of the Transferor for any onward transfers of that information to a third country or international organization.

Arguably, the most significant feature of the Umbrella Agreement is that it creates a right to “judicial redress.” This will allow, for example, EU citizens to seek redress in U.S. courts if U.S. authorities fail to comply with their obligations under the Umbrella Agreement. This provision is dependent upon the passage of Bill (H.R. 1428), currently before Congress, that would create a legal basis for such judicial redress under U.S. law.

Notably, the Umbrella Agreement applies to all EU Member States except Denmark, Ireland and the UK. It will only apply to those jurisdictions if the European Commission notifies the U.S. Government in writing that they have opted in to the Agreement.