The European Commission has announced that the negotiations of the EU-US data protection "umbrella agreement" have been finalised and that the agreement has been initialled. A mandate for the negotiation was adopted by the European Commission in May 2010 (see Legal update, European Commission adopts negotiation mandate for EU-US data protection agreement) and approved by the European Council the following December.

The aim of the agreement would be to ensure that US authorities comply with EU data protection principles when processing personal data transferred to them under agreements for transatlantic co-operation in criminal matters. Under the umbrella agreement, EU citizens' personal data can only be shared and subsequently processed for the purpose of preventing, investigating, detecting or prosecuting criminal offences, including terrorism. It must not be used for further incompatible purposes.

The agreement will require the US to adopt legislation that grants EU citizens the same judicial redress rights as US citizens in case of privacy breaches by US authorities to whom their data has been disclosed. This includes cases where US authorities deny access or rectification to EU data subjects, or unlawfully disclose their personal data to third parties. US plans to adopt such legislation were first announced in June 2014 (see Legal update, US government to seek rights for EU citizens under US Privacy Act) with the Judicial Redress Bill having been introduced to Congress in June 2015. The European Commission has made it clear that the formal conclusion of the umbrella agreement will be subject to the adoption of that Bill.

Source: European Commission press release, 8 September 2015.