U.S., Europe Forge Data-Protection 'Um­brella Agree­ment' for Terrorism Cases

BER­LIN—U.S. and European of­fi­cials fi­nal­ized a long-awaited data-pro­tec­tion deal that would provide a road map for how per­son­al in­form­a­tion is pro­tec­ted when shared across the At­lantic by law-en­force­ment au­thor­it­ies, of­fi­cials an­nounced Tues­day.

The so-called “um­brella agree­ment” is the cul­min­a­tion of four years of ne­go­ti­ations over how po­lice and judges should be able to share data dur­ing the course of crim­in­al or ter­ror­ism in­vest­ig­a­tions that cross bor­ders, and it marks a sig­ni­fic­ant step for­ward to re­build trust between the United States and its European al­lies after the Ed­ward Snowden spy­ing rev­el­a­tions that began more than two years ago.

For the deal to take ef­fect, however, Con­gress will first have to pass a meas­ure grant­ing European cit­izens the right to sue in U.S. courts if they be­lieve Amer­ic­an au­thor­it­ies have mis­used their per­son­al data. A bill to that ef­fect in­tro­duced in re­cent months has earned some bi­par­tis­an sup­port, but law­makers re­main grid­locked and dis­trac­ted head­ing in­to an elec­tion year.

“I am very pleased that today we have fi­nal­ised ne­go­ti­ations with the U.S. on high data-pro­tec­tion stand­ards for transat­lantic law-en­force­ment co­oper­a­tion,” Věra Jour­ová, the European Com­mis­sion’s justice com­mis­sion­er, said in astate­ment. “Ro­bust co­oper­a­tion between the EU and the U.S. to fight crime and ter­ror­ism is cru­cial to keep Europeans safe.”

But, Jour­ová ad­ded, “all ex­changes of per­son­al data, such as crim­in­al re­cords, names, or ad­dresses, need to be gov­erned by strong data-pro­tec­tion rules. This is what the um­brella agree­ment will en­sure.”

A sig­ni­fic­ant hang-up for the agree­ment has been the in­ab­il­ity for Europeans liv­ing in the United States to sue U.S. fed­er­al agen­cies if they be­lieve their data has been im­prop­erly used, shared, or dis­closed. Amer­ic­an cit­izens pos­sess that right already in the European Uni­on.

Earli­er this year, Rep. Jim Sensen­bren­ner, a Wis­con­sin Re­pub­lic­an, in­tro­duced the Ju­di­cial Re­dress Act to ad­dress the data-pro­tec­tion im­bal­ance. His meas­ure would grant cit­izens of European al­lies the right to sue in the United States in re­gard to data pri­vacy vi­ol­a­tions. A pro­posed amend­ment to the long-stalled Cy­ber­se­cur­ity In­form­a­tion Shar­ing Act, put for­ward by Sen. Chris Murphy, a Con­necti­c­ut Demo­crat, mir­rors the Sensen­bren­ner ef­fort.

“The re­cent agree­ment on data shar­ing between na­tions is a great step for­ward for in­ter­na­tion­al safety and prosper­ity,” Sensen­bren­ner said in a Tues­day state­ment. “The Ju­di­cial Re­dress Act, however, re­mains a crit­ic­al piece in our part­ner­ship with the European Uni­on and is crit­ic­al to en­sure con­tin­ued shar­ing of law en­force­ment in­tel­li­gence.  I am op­tim­ist­ic that it will not only be brought be­fore Con­gress, but will be passed with bi­par­tis­an sup­port.”

Jour­ová also called on Con­gress to ad­opt the bill, “which would en­able us to fi­nally sign and con­clude the um­brella agree­ment,” she said.

Jour­ová also said that European of­fi­cials were work­ing in tan­dem with the United States to com­plete a more ro­bust safe-har­bor agree­ment, which deals with cor­por­ate data. Such agree­ments re­quire U.S. com­pan­ies to cer­ti­fy that they meet cer­tain levels of pri­vacy pro­tec­tions. If they clear European stand­ards, the com­pan­ies are al­lowed to store and pro­cess Europeans’ per­son­al data.