Legal opinion given to European lawmakers states that the Umbrella Agreement, outlined last September between the EU and the US, does not allow for any redress by EU citizens for the failure to protect their personal data when on US servers. It is the second data-sharing agreement to be called into doubt.
Leaked legal opinion: EU-US data deal incompatible with EU law, basic rights https://t.co/jH69L6FFna Background https://t.co/SEeVCkseKM
— Statewatch (@StatewatchEU) February 15, 2016
The Umbrella Agreement is separate to the new agreement of sharing data — Privacy Shield — to replace Safe Harbor, which was last year ruled to have been invalid. The agreement was a quasi-judicial understanding that the US undertook to agree that it would ensure EU citizens' data on US servers would be held and protected under the same restrictions as it would be under EU law and directives. The data covers a huge array of information — from Internet and communications usage, to sales transactions, import and exports.
.@Buttarelli_G Don't underestimate historical significance #UmbrellaAgreement for int'l law enforcement info sharing pic.twitter.com/TsEFCgfjmF
— EDPS (@EU_EDPS) February 15, 2016
However, the European Court of Justice ruled in October 2015 that Safe Harbor was invalid. The issue arises from the strict EU laws — enshrined in the Charter of Fundamental Rights of the European Union — to the privacy of their personal data.
The case arose when Maximillian Schrems, a Facebook user, lodged a complaint with the Irish Data Protection Commissioner, arguing that — in the light of the revelations by ex-CIA contractor Edward Snowden of mass surveillance by the US National Security Agency (NSA) — the transfer of data from Facebook's Irish subsidiary onto the company's servers in the US do not provide sufficient protection of his personal data.
— EDPS (@EU_EDPS) February 15, 2016
.@Buttarelli_G There is still time to adjust and improve #UmbrellaAgreement 3 essential recommended improvements pic.twitter.com/mYSmhQv3t3
— EDPS (@EU_EDPS) February 15, 2016
However, the chair of the European Commission Data Protection Working Party, Isabelle Falque-Pierrotin, has slammed Privacy Shield as little more than a "handshake". She told reporters in Brussels that the proposals, as they stand, are legally totally unclear.
"We can't just accept words. It's difficult to come to a conclusion when you're facing political will but no real documents. The legal format of the arrangement is still unclear for us," Falque-Pierrotin said.
Counterterrorism Data Sharing Agreement
EU-US data sharing is also the subject of the Umbrella Agreement, which covers all personal data (for example names, addresses, criminal records) exchanged between the EU and the US for the purpose of prevention, detection, investigation and prosecution of criminal offences, including terrorism.
However, in a legal opinion given to the lawmakers in the Civil Liberties, Justice and Home Affairs (LIBE) Committee of the European Parliament by its own legal service it was stated that: "the EU-US Umbrella agreement fails to ensure that all natural persons covered by EU law will be afforded rights of judicial redress in the US where their personal data is transferred by competent authorities in the EU to competent authorities in the US."
