News and events

Council adopted EU-US Data Protection Umbrella Agreement


The past couple of years have been a data protection roller-coaster for companies, starting with the Schrems decision of the Court of Justice of the European Union revoking the EU-US Safe Harbour framework and leading to a frantic situation where companies that had relied upon Safe Harbour to transfer data to the US quickly had to find new solutions. Then came the by some long-awaited and by others dreaded General Data Protection Regulation, which will keep IT, HR, Legal and other departments rather busy until its entry into force in May 2018. In summer 2016, the new EU-US Privacy Shield was adopted, replacing the Safe Harbor system and enabling transatlantic data transfers. A couple of days ago, there was another development. The European Council adopted the decision to authorise the EU to conclude the EU-US Data Protection Umbrella Agreement, which puts in place a comprehensive high-level data protection framework for EU-US law enforcement co-operation.

The Umbrella Agreement is the result of years of negotiations and covers all personal data exchanged between the EU and the US for the purpose of preventing, detecting, investigating and prosecuting criminal offences. It will safeguard the lawfulness of data transfers while facilitating criminal law enforcement co-operation. For example, the Agreement will provide clear limitations on data use; data can only be processed for the purposes mentioned above (preventing, detecting, investigating and prosecuting criminal offences). Moreover, if the US wants to transfer data onwards to a non-EU country, it must retrieve consent from the relevant authority of the country that originally transferred the data to the US prior to the onward transfer. Following the Agreement, EU citizens will also have the right to seek judicial redress in US courts if US authorities, for example, unlawfully disclose their personal data. This is currently not possible.

The Umbrella Agreement will enter into force when US authorities have completed their internal procedures. However, post-US election there is some uncertainty as to how Donald Trump’s statement that he will review all global trade deals will affect the Umbrella Agreement, and the Privacy Shield for that matter.

For more information about the Umbrella Agreement, please contact the undersigned. If you missed our articles on the General Data Protection Regulation or the Privacy Shield, you can access them here: 20 million reasons to get serious with Data Protection and Privacy Shield -järjestely otettu käyttöön (in Finnish).

For further information, please contact:
Lotta Uusitalo

More news

Back to News and Events »