The EU-US data protection ‘umbrella agreement‘ puts in place a comprehensive high-level data protection framework for EU-US law enforcement cooperation. The agreement covers all personal data (for example names, addresses, criminal records) exchanged between the EU and the USA for the purpose of prevention, detection, investigation and prosecution of criminal offences, including terrorism. It also covers personal data that are transferred by private entities in the territory of one party to competent authorities of the other party for these purposes, based on an international agreement.

The umbrella agreement will provide safeguards and guarantees of lawfulness for data transfers, thereby strengthening fundamental rights, facilitating EU-US law enforcement cooperation and restoring trust. However, it must be underlined that the agreement itself will not constitute the legal basis for any transfer of personal information to the USA, but will supplement, where necessary, data protection safeguards in existing and future data transfer agreements or national provisions authorising such transfers.

The EU-US negotiations on the umbrella agreement were finalised on 8 September 2015. The Commission made the signature of the agreement conditional on the US Congress’ passing the Judicial Redress Act. This will eliminate a visible discrimination by giving EU citizens not resident in the USA the right to challenge in US courts the way in which their data is used under the agreement. This right is already enjoyed by US nationals in the EU.

The US Judicial Redress Act was signed into law by President Obama on 24 February 2016, thus paving the way for the signature of the Umbrella Agreement.

The agreement was signed on 2 June 2016; the Council’s decision to conclude the agreement needed the  consent of the European Parliament (EP), in accordance with Article 218 of the Treaty on the Functioning of the European Union (TFEU).

The European Parliament has expressed its views on several occasions. In its resolution of 12 March 2014 on the US National Security Agency (NSA) surveillance programme, the Parliament underlined the importance of the agreement to restore mutual trust; it stressed that it should provide effective and enforceable administrative and judicial remedies for all EU citizens in the USA without any discrimination.

In the follow-up resolution of 29 October 2015, the Parliament welcomed the efforts made by the US administration, and in particular, the fact that the 2015 Judicial Redress Act was successfully passed. At the same time, it urged the Commission to assess the legal impact and implications of the Court of Justice ruling in the Schrems case vis-à-vis any agreements with third countries allowing for the transfer of personal data, and namely the EU-US umbrella agreement.

The EP gave its consent on 1 December 2016 to the conclusion of the agreement by the Council with 481 votes for, 75 against and 88 abstentions. On 2 December 2016 the Council adopted the decision authorising the conclusion of the agreement. 

The agreement entered into force on 1 February 2017, following the completion by US authorities of their internal procedures, including making the necessary designations under the Judicial Redress Act on 17 January 2017. Three EU Member States - the United Kingdom, Ireland and Denmark - have the possibility to opt-in to the agreement at a later date. The EU has notified the United States that Ireland has agreed that the agreement applies to it, and Ireland has been accordingly designated by the US as a covered country under the Judicial Redress Act. Denmark has informed the European Commission that the country will not opt-in to the Agreement for the time being. Finally, no later than three years following the entry into force of the Agreement, the parties will perform a joint review of its functioning, and the results will be made public.

References:

• EP Legislative Observatory, Procedure file on the EU/USA Agreement, 2016/0126(NLE)
• The United States Department of Justice, Judicial Redress Act of 2015, updated on 26 January 2017
• European Parliament, Resolution of 12 March 2014 on the US NSA surveillance programme, surveillance bodies in various Member States and their impact on EU citizens’ fundamental rights and on transatlantic cooperation in Justice and Home Affairs, (2013/2188(INI); Resolution of 29 October 2015 on the follow-up to the European Parliament resolution of 12 March 2014 on the electronic mass surveillance of EU citizens, (2015/2635(RSP)
• Council Decision (EU) 2016/2220 of 2 December 2016 on the conclusion, on behalf of the European Union, of the Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offences, OJ L 336, 10.12.2016, p. 1–2
• Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offences, OJ L 336, 10.12.2016, p. 3–13
• European Commission, Statement by Commissioner Věra Jourová on the European Parliament consent vote on the conclusion of the EU-U.S. data protection ‘Umbrella Agreement’, 1 December 2016
• European Commission, Questions and Answers on the EU-U.S. Data Protection ‘Umbrella Agreement’, Fact Sheet, 1 December 2016
• Council, Umbrella agreement : EU ready to conclude deal with the US, Press release, 2 December 2016

Further reading:

• European Parliament, EPRS, EU-US cooperation in Justice and Home Affairs – an overview, Briefing, April 2016
• European Parliament, EPRS, EU-US Umbrella Agreement on data protection, Plenary At a Glance, November 2016

 Author: Carmen-Cristina Cîrlig, Members' Research Service, legislative-train@europarl.europa.eu