(June 1, 2010) On May 26, 2010, the European Commission commenced negotiations with the United States on a new general framework agreement to regulate aspects of protection of personal data for European Union citizens. The agreement will be part of the cooperation efforts of the two partners in fighting terrorism, organized crime, and other criminal activities. Since the al-Qaeda-coordinated attacks of September 11, 2001, in the United States and the ensuing terrorist attacks in London and Madrid, the EU has increased its efforts domestically and internationally to fight terrorism. The cooperation between the two partners led to the conclusion of several agreements on the transfer of information, especially through the Passenger Name Records (PNR) and the Terrorist Finance Tracking Program (TFTP), both of which deal with the transfer and processing of personal data. (Press Release, MEMO/10/16, EU-US Data Protection Agreement Negotiations: Frequently Asked Questions (May 26, 2010), EUROPA [portal site of the EU], available at http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/10/216&
format=HTML&aged=0&language=EN&guiLanguage=en.)
The new draft agreement does not deal with the issue of whether personal data must be transferred; it applies to data that will be transferred from the EU and then further processed in the United States, in the context of police and judicial cooperation in criminal matters. Therefore, agreements already concluded, such as the PNR and TFTP, and other future agreements requiring the transfer of personal data to be processed in the United States, would need to comply with the framework agreement. (Id.)
The impetus for the new agreement is the differing approaches to the issue of privacy and personal data protection in the EU and the United States, which had led to a number of disputes in the past and made negotiations for any agreement requiring transfer of personal data cumbersome. In the EU, the right to privacy and personal data protection is a fundamental right contained in article 8 of the legally binding EU Charter of Fundamental Rights. The United States lacks a constitutionally guaranteed right to privacy and has enacted privacy laws regulating specific sectors at the federal and state levels. (Id.)
In addition, the European Parliament, in a resolution adopted on March 26, 2009, had emphasized that the signing of a general framework agreement with the United States on transfer of personal data protection was critical and imperative. (The State of Transatlantic Relations in the Aftermath of the US Elections, 2010 Official Journal of the European Union (C117 E) 198-206 (May 6, 2010), available athttp://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2010:117E:019
8:0206:EN:PDF.)
Pursuant to the EU laws on personal data protection, the agreement contains the standards that must be applied to any transfer and processing of personal data, including:
- data must be processed fairly for a specific and legitimate reason;
- data must be retained for a limited period only;
- the transfer plan must contain a clause stating that an individual has the right to access his personal data, the right to rectify it, and the right to delete it;
- compliance must be overseen by an independent, public authority in the EU and the United States; and
- plans must contain clauses for legal redress to an individual harmed by the unlawful processing of his personal data, including compensation for any damages suffered. (Press Release, supra.)
Viviane Reding, the Justice and Rights Commissioner for the EU, has stated, “[f]undamental rights must be protected and respected at all times. I want an EU-US agreement that protects personal data rights while fighting crime and terrorism.” (Valentina Pop, EU Moves on Data Protection Deal with the US, EU Observer, May 27, 2010, available at http://euobserver.com/9/30144/?rk=1.) Moreover, the European Commission anticipates that the signing of this agreement will ensure the European Parliament's endorsement of future agreements with the United States requiring the transfer of data and will avoid possible vetoes by the European Parliament, as has happened in the past. (Id.)