How will the Commission engage with its international partners to promote data protection standards?
The EU data protection legal framework has often served as a point of reference for third countries developing legislation in this field. The EU will continue discussions with its international partners to foster convergence by developing high and interoperable personal data protection standards globally. It will also enhance cooperation with relevant third country privacy enforcement and supervisory authorities to facilitate the effective enforcement of data protection legislation, including through mutual assistance arrangements. This is especially relevant to address common problems of non-compliance with data protection rules or data breaches that affect people in more than one jurisdiction.
- The Commission encourages accession by third countries to the Council of Europe Convention 108 and its additional Protocol. The Convention, which is open to non-members of the Council of Europe and has already been ratified by 50 countries. It is the only binding multilateral instrument in the area of data protection.
- The Commission will engage with important new actors, such as the United Nations Special Rapporteur on the Right to Privacy, and further develop its working relationships with regional organisations such as the Asia-Pacific Economic Cooperation, to foster a worldwide culture of respect for the rights to privacy and personal data protection.
- The Commission will develop international cooperation mechanisms with key international partners to facilitate effective enforcement.
What is the link between the international exchange of personal data and trade agreements?
For the EU privacy is not a commodity to be traded. Dialogues on data protection and trade negotiations with third countries have to follow separate tracks.
At the same time, these can be complementary discussions. In particular, an adequacy decision with a third country guarantees the free flow of personal data thus facilitating commercial exchanges with the third country in question. Adequacy decisions can ease trade negotiations or may complement existing trade agreements thereby amplifying their benefits.
What will the Commission do with respect to personal data exchanges in the law enforcement sector?
The swift exchange of personal data is essential for successful law enforcement cooperation and an effective response to transnational crime. To strengthen legal certainty and build mutual trust amongst law enforcement authorities, these exchanges rely on strong data protection safeguards.
To that end, the Commission will:
- Promote the possibility for adequacy decisions under the Police Directive with qualifying third countries.
- Promote negotiations of agreements in the area of law enforcement with international partners along the model provided by the Umbrella Agreement with the U.S.
- Work to facilitate the cross-border exchange of e-evidence in conformity with data protection rules.
What is the Umbrella Agreement? What are its benefits for international law enforcement cooperation?
The EU-U.S. data protection “Umbrella Agreement” concluded in December 2016 puts in place a comprehensive high-level data protection framework for EU-US law enforcement cooperation. The agreement covers all personal data (for example names, addresses, criminal records) exchanged between the EU and the U.S. for the purpose of prevention, detection, investigation and prosecution of criminal offences, including terrorism. The Umbrella Agreement will provide safeguards and guarantees of lawfulness for data transfers, thereby strengthening fundamental rights, facilitating EU-U.S. law enforcement cooperation and restoring trust. It is now important that the U.S. side makes the necessary designations under the Judicial Redress Act, so that the agreement can enter into force as soon as possible.
The Umbrella Agreement is a successful example of how law enforcement cooperation with an important international partner can be enhanced by negotiating a strong set of data protection safeguards. It constitutes the first bilateral international agreement with a comprehensive catalogue of data protection rights and obligations in line with the EU rules. It can therefore serve as a model for the negotiation of similar agreements with third countries not only in the field of judicial and police cooperation, but also in other areas of public enforcement (e.g. competition policy, consumer protection). This would cover both government-to-government exchanges and data transfers between private companies and law enforcement authorities. The Commission will explore the possibility to conclude similar framework agreements with its important law enforcement partners.