EN Official Journal of the European Union C 186/4

Executive Summary of the Preliminary Opinion of the of the European Data Protection Supervisor on the agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection and prosecution of criminal offences

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2016/C 186/04)

This Opinion builds on the general obligation that international agreements concluded by the EU must comply with the provisions of the Treaty of the Functioning of the European Union (TFEU) and the respect for fundamental rights that stands at the core of EU law. In particular, the assessment is made so as to analyse the compliance of the content of the Umbrella Agreement with Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union and Article 16 TFEU ensuring personal data protection.

EXECUTIVE SUMMARY

Investigating and prosecuting crime is a legitimate policy objective, and international cooperation including information exchange has become more important than ever. Until now, the EU has lacked a robust common framework in this area and so there are no consistent safeguards for individuals’ fundamental rights and freedoms. As the EDPS has long argued, the EU needs sustainable arrangements for sharing personal data with third countries for law enforcement purposes, fully compatible with the EU Treaties and the Charter of Fundamental Rights.

Therefore, we welcome and actively support the efforts of the European Commission to reach a first ‘Umbrella Agreement’, with the US. This international law enforcement agreement aims at establishing for the first time data protection as the basis for information sharing. While we recognise that it is not possible to replicate entirely the terminology and definitions of EU law in an agreement with a third country, the safeguards for individuals must be clear and effective in order to fully comply with EU primary law.

The European Court of Justice in recent years has affirmed data protection principles including fairness, accuracy and relevance of information, independent oversight and individual rights of individuals. These principles are as relevant for public bodies as they are for private companies, regardless of any formal EU adequacy finding with respect to third countries data protection safeguards; indeed they become all the more important considering the sensitivity of the data required for criminal investigation.

This Opinion aims to provide constructive and objective advice to the EU institutions as the Commission finalises this delicate task, with broad ramifications, not only for EU-US law enforcement cooperation but also for future international accords. The ‘Umbrella Agreement’ is separate from but has to be considered in conjunction with the recently announced EU-US ‘Privacy Shield’ on the transfer of personal information in the commercial environment. Further considerations may be necessary to analyse the interaction between these two instruments and the reform of the EU’s data protection framework.

Before the Agreement is submitted for the consent of the Parliament, we encourage the Parties to consider carefully significant developments since last September, when they signalled their intention to conclude the Agreement once the Judicial Redress Act is passed. Many safeguards already envisaged are welcome, but they should be reinforced, also in the light of the Schrems judgment in October invalidating the Safe Harbour Decision and the EU political agreement on data protection reform in December, which covers transfers and judicial and police cooperation.

The EDPS has identified three essential improvements which he recommends for the text to ensure compliance with the Charter and Article 16 of the Treaty:

— clarification that all the safeguards apply to all individuals, not only to EU nationals;

— ensuring judicial redress provisions are effective within the meaning of the Charter;

— clarification that transfers of sensitive data in bulk are not authorised.

The Opinion offers additional recommendations for clarification of the envisaged safeguards by way of an accompanying explanatory document. We remain at the disposal of the institutions for further advice and dialogue on this issue.

I. Context of the initialled Agreement

1. On 3 December 2010, the Council adopted a decision authorising the Commission to open negotiations on an Agreement between the European Union (EU) and the United States of America (US) on the protection of personal data when transferred and processed for the purpose of preventing, investigating, detecting or prosecuting criminal offences, including terrorism, in the framework of police cooperation and judicial cooperation in criminal matters (hereinafter: the ‘Agreement’) (1).

2. The negotiations between the Commission and the US began officially on 29 March 2011 (2). On 25 June 2014, the United States Attorney General announced that legislative action will be taken in order to provide for judicial redress concerning privacy rights in the US for citizens of the EU (3). After several rounds of negotiations, which extended over 4 years, the Agreement was initialled on 8 September 2015. According to the Commission, the objective is to sign and formally conclude the Agreement only after the US Judicial Redress Act is adopted (4).

3. The European Parliament must consent to the initialled text of the Agreement, while the Council must sign it. As long as this has not taken place and the Agreement is not formally signed, we note that the negotiations can be reopened on specific points. It is in this context that the EDPS issues this Opinion, based on the text of the initialled Agreement published on the website of the Commission (5). This is a preliminary Opinion based on a first analysis of a complex legal text and it is without prejudice to any additional recommendations to be made on the basis of further available information, including legislative developments in the US, such as the adoption of the Judicial Redress Act. The EDPS has identified three essential points which require improvement and also highlights other aspects where important clarifications are recommended. With these improvements, the Agreement can be considered compliant with EU primary law.

V. Conclusions

53. The EDPS welcomes the intention to provide for a legally binding instrument that aims to ensure a high level of data protection for the personal data transferred between the EU and the US for the purpose of preventing, investigating, detecting or prosecuting criminal offences, including terrorism.

54. Most of the substantive provisions of the Agreement aim to fully or partially correspond with the essential guarantees of the right to personal data protection in the EU (such as the rights of the data subject, independent oversight and the right to judicial review).

55. Although the Agreement does not technically constitute an adequacy finding decision, it creates a general presumption of compliance for transfers grounded on a specific legal basis, in the framework of the Agreement. Therefore, it is crucial to ensure that this ‘presumption’ is reinforced by all necessary safeguards within the text of the Agreement, to avoid any breach of the Charter, in particular of Articles 7, 8 and 47.

56. There are three essential improvements the EDPS recommends for the text to ensure compliance with the Charter and Article 16 TFEU: 1) clarification that all the safeguards apply to all individuals, not only to EU nationals; 2) ensuring judicial redress provisions are effective within the meaning of the Charter; 3) clarification that transfers of sensitive data in bulk are not authorised.

57. Moreover, for the purpose of legal certainty, the EDPS recommends that the following improvements or clarifications be introduced in the text of the Agreement or within explanatory declarations to be attached to the Agreement, or in the implementing phase of the Agreement, as detailed within this Opinion: 1) that Article 5(3) must be interpreted as respecting the role of supervisory authorities so as to be compliant with Article 8(3) of the Charter; 2) that the specific legal bases for transfers (Article 5(1)) must fully comply with the safeguards provided in the Agreement and that, in the case of conflicting provisions between a specific legal basis and the Agreement, the latter will prevail; 3) that in case of ineffective protection for data transferred to authorities at State level, the relevant measures under Article 14(2) will include, where necessary, measures concerning data already shared; 4) that the definitions of processing operations and personal information (Article 2) are aligned to be in compliance with their well-established understanding under EU law; in case the Parties will not fully align these definitions, a clarification should be done in the explanatory documents accompanying the Agreement that the application of the two notions will not differ on substance from their understanding in EU law; 5) that an indicative list of the ‘specific conditions’ where data are transferred in bulk (Article 7(3)) could be included in the explanatory declaration; 6) that the Parties intend to apply the provisions regarding information breach notifications (Article 10) with a view to limit as much as possible omission of the notifications, on one hand, and to avoid excessive delays of notifications; 7) that the data retention provision in Article 12(1) is complemented by the specification ‘for the specific purposes for which they were transferred’, in the light of the purpose limitation principle invoked by the Parties in the Agreement; 8) that the Parties of the Agreement consider increasing their efforts to ensure that restrictions to the exercise of the right of access are limited to what is indispensable to preserve the public interests enumerated and to strengthen the obligation for transparency; 9) that a detailed explanatory declaration to the Agreement specifically list (Article 21): — the supervisory authorities that have competence in this matter and the mechanism for the Parties to inform each other about future changes; — the effective powers they may exercise; — the identity and coordinates of the contact point which will assist with the identification of the competent oversight body (see Article 22(2)).

58. Finally, the EDPS would recall the need that any interpretation, application and implementing measure of the Agreement should be done, in the case of lack of clarity and apparent conflict of provisions, in a way compatible with the EU constitutional principles in particular with regard to Article 16 TFEU and Articles 7 and 8 of the Charter, regardless of the welcome improvements to be adduced following the recommendations in this Opinion.

Done at Brussels, 12 February 2016. Giovanni BUTTARELLI European Data Protection Supervisor

(1) See MEMO 10/1661 of the European Commission, published on 3 December 2010, available here: http://europa.eu/rapid/press-release_IP-10-1661_en.htm

(2) See MEMO 11/203 of the European Commission, published on 29 March 2011, available here: http://europa.eu/rapid/press-release_MEMO-11-203_en.htm

(3) See Press release 14-668 of the Office of the Attorney General, published on 25 June 2014, available here: http://www.justice.gov/opa/pr/attorney-general-holder-pledges-support-legislation-provide-eu-citizens-judicial-redress

(4) See MEMO 15/5612 of the European Commission, published on 8 September 2015, available here: http://europa.eu/rapid/press-release_MEMO-15-5612_en.htm

(5) Text available here: http://ec.europa.eu/justice/data-protection/files/dp-umbrella-agreement_en.pdf