The EU-U.S. data protection Umbrella Agreement consists of a framework of principles and safeguards for trans-Atlantic transfers of personal data (such as criminal records, names and addresses) in relation to the prevention, detection, investigation and prosecution of criminal offences, including terrorism. The agreement seeks to satisfy two core objectives: first, to ensure a high level of data protection, and second, to promote greater cooperation between EU and U.S. law enforcement. On 29 April, the European Commission published a proposal on signing the Agreement on behalf of the EU.

The Agreement will make transfers of data between the EU and the United States safer by:

  • Outlining clear limitations on the use of personal data
  • Placing restrictions on the onward transfer of personal data without consent
  • Placing limitations and requirements on the retention periods for records containing personal data
  • Providing all individuals with a right to access their personal data and request the correction of any inaccuracies (subject to certain conditions)
  • Requiring that all data security breaches be notified to the competent authority and data subject (where appropriate)
  • Giving EU citizens the right to seek judicial redress before U.S. courts in circumstances where US authorities deny access to or unlawfully disclose their personal data (enabled by the U.S. Judicial Redress Act being signed into law)

The Agreement does not provide a legal basis for the transfer of personal data between the EU and the United States; rather, it supplements the protection afforded to personal data in other existing and future data transfer agreements and national data transfer provisions. In order to formally conclude the Agreement, the Council must adopt the proposal to sign, and consent to the signing must be obtained from the European Parliament. The concluded Agreement should help to remedy some of the scepticism surrounding data flows between the EU and the United States following Edward Snowden's revelations of the mass intelligence collection programs of U.S. government agencies in 2013.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.