Privacy & Information Security Law Blog

On June 2, 2016, the European Union and the U.S. signed an Umbrella Agreement, which will implement a comprehensive data protection framework for criminal law enforcement cooperation. The agreement is not yet in effect and additional procedural steps are needed to finalize the agreement. The European Council will adopt a decision on the Umbrella Agreement after obtaining consent from the European Parliament.

The Umbrella Agreement covers all personal data (e.g., names, addresses, criminal records, etc.) exchanged between police and criminal justice authorities of the EU Member States and the U.S. federal authorities for preventing, investigating, detecting and prosecuting criminal offenses, including terrorism.

The Umbrella Agreement will provide safeguards and guarantees of lawfulness for data transfers, including provisions on clear limitations on data use, the obligation to seek prior consent before any onward transfer of data, the obligation to define appropriate retention periods, and the right to access and rectification.

In addition, the Umbrella Agreement will grant to EU citizens equal treatment with U.S. citizens with respect to judicial redress rights before U.S. courts in case U.S. authorities deny access or rectification, or unlawfully disclose personal data. In this regard, the signature of the U.S. Judicial Redress Act, granting judicial redress rights to EU citizens, by President Obama in February 2016 paved the way for the signature of the Umbrella Agreement.

The Umbrella Agreement will complement existing EU-U.S. and Member State–U.S. agreements between law enforcement authorities.

Read the European Council’s press release.