Answer given by Mrs Reding on behalf of the Commission
The United States (US) Patriot Act(1) of 2001 establishes a wide range of measures for US competent authorities in the fight against terrorist acts. Amongst other things, the US Patriot Act gives US law enforcement and intelligence agencies greater powers to access personal data and to engage in surveillance activities. In this regard, measures such as a court order from the Foreign Intelligence Surveillance Court for production of information (provided in Section 215) or a ‘national security letter’ issued by the Federal Bureau of Investigation (FBI) (provided in Section 505) can be issued upon a US established legal entity. A legal entity established under US law is subject to US law, including such court orders or ‘national security letters’ that might request production of information or evidence on specific persons or facts related to a particular counterterrorism investigation.
However, in accordance with international public law, and in the absence of a recognised jurisdictional link, a foreign law or statute cannot directly impose legal obligations on organisations or undertakings established in a third country regarding the activities performed within the territory of that third country. In order to give effect to the different legal obligations provided by the US Patriot Act on legal entities established in the EU, it would be necessary that they are imposed by an EU legal instrument or a Member State’s legal instrument which respects its obligations under EC law, including data protection principles.
The Commission attaches the utmost importance to the fundamental rights to freedom of expression, respect for private and family life and personal data protection, which are applied in the EU without discrimination on the basis of nationality, citizenship or place of residence.
The Commission’s upcoming proposals for reform of the EU data protection framework will therefore particularly focus on the challenges posed by globalisation and modern technologies.