US law will restore trust in transatlantic data flows, says EU commissioner

The Act, which was signed into law this week by US president Barack Obama, gives European citizens the right to pursue legal action against some US agencies in US courts if their personal data has been mishandled when used by the US in criminal and terror investigations.

The Act will also give EU citizens rights to require US federal agencies to give them access to their data and correct inaccurate records they hold about them.

The passage of the Act has been seen as a pivotal component of reforms aimed at strengthening privacy protections given to people in the EU when their personal data is transferred to the US.

"This new law is a historic achievement in our efforts to restore trust in transatlantic data flows," Jourová said. "The Judicial Redress Act will ensure that all EU citizens have the right to enforce data protection rights in US courts, as called for in (EU) president Juncker's political guidelines. US citizens already enjoy this right in Europe."

"[This] will pave the way for the signature of the EU-US data protection umbrella agreement. This agreement will guarantee a high level of protection of all personal data, regardless of nationality, when transferred across the Atlantic for law enforcement purposes. It will strengthen privacy, while ensuring legal certainty for transatlantic data exchanges between police and criminal justice authorities. This is crucial to keep Europeans safe through efficient and robust cooperation between the EU and the US in the fight against crime and terrorism," Jourová said.

The data protection 'umbrella' agreement, a new privacy framework that will apply to personal data transferred to US law enforcement agencies, was announced by the European Commission last September, although it will not apply until EU law makers ratify it.

"In parallel, the Commission is working to put in place the EU-US privacy shield, ensuring a high level of data protection for commercial data transfers," Jourová said.

The EU-US privacy shield is a new deal to facilitate EU-US data transfers that has been announced to replace the previous safe harbour framework.

Earlier this month Isabelle Falque-Pierrotin, chair of the Article 29 Working Party, a body of European data protection authorities, said that she does not think the Judicial Redress Bill will address concerns raised in a ruling by the Court of Justice of the EU (CJEU) in October last year. In that ruling the CJEU invalidated a previous decision of the Commission. The Commission's decision was that adequate data protection applied to personal data when it was transferred to the US from the EU in line with 'safe harbour' principles.

The CJEU in invalidating the EU-US safe harbour framework referenced concerns in relation to the lack of redress EU citizens could obtain in the US if their data was misused. Falque-Pierrotin said, though, that she does not think the Judicial Redress Act will address those concerns because the Act would not apply to cases concerning access to data for national security purposes.