Gemäss Pressemitteilung vom 2. Juni 2016 haben die EU und die USA das sog. Umbrella Agreement („Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection and prosecution of criminal offences“) unterzeichnet.
Dabei handelt es sich um ein Datenschutz-Rahmenabkommen für den „Austausch von personenbezogenen Daten zum Zweck der Vorbeugung, Aufdeckung, Untersuchung und Verfolgung von Straftaten, einschliesslich terroristischer Tätigkeiten“.
Das Umbrella-Agreement beinhaltet u.a. folgende Eckpunkte (vgl. Q&A-Seite der EU-Kommission):
(i) „Clear limitations on data use – Personal data may only be used for the purpose of preventing, investigating, detecting or prosecuting criminal offences, and may not be processed beyond compatible purposes“.
(ii) „Onward transfer – Any onward transfer to a non-US, non-EU country or international organisation must be subject to the prior consent of the competent authority of the country which had originally transferred personal data“.
(iii) „Retention periods - Individuals' personal data may not be retained for longer than necessary or appropriate. These retention periods will have to be published or otherwise made publicly available. The decision on what is an acceptable duration must take into account the impact on people's rights and interests“.
(iv) „Right to access and rectification - Any individual will be entitled to access their personal data – subject to certain conditions, given the law enforcement context – and request it to be corrected if it is inaccurate“.
(v) „Information in case of data security breaches – A mechanism will be put in place so as to ensure notification of data security breaches to the competent authority and, where appropriate, the data subject“.
(vi) „Judicial redress and enforceability of rights - EU citizens will have the right to seek judicial redress before US courts in case of the US authorities deny access or rectification, or unlawfully disclose their personal data".
Das Umbrella-Agreement muss im nächsten Schritt vom EU-Parlament gebilligt werden.
NB Die „Preliminary Opinion“ des Europäischen Datenschutzbeauftragten zum Umbrella-Agreement ist online verfügbar.
Dabei handelt es sich um ein Datenschutz-Rahmenabkommen für den „Austausch von personenbezogenen Daten zum Zweck der Vorbeugung, Aufdeckung, Untersuchung und Verfolgung von Straftaten, einschliesslich terroristischer Tätigkeiten“.
Das Umbrella-Agreement beinhaltet u.a. folgende Eckpunkte (vgl. Q&A-Seite der EU-Kommission):
(i) „Clear limitations on data use – Personal data may only be used for the purpose of preventing, investigating, detecting or prosecuting criminal offences, and may not be processed beyond compatible purposes“.
(ii) „Onward transfer – Any onward transfer to a non-US, non-EU country or international organisation must be subject to the prior consent of the competent authority of the country which had originally transferred personal data“.
(iii) „Retention periods - Individuals' personal data may not be retained for longer than necessary or appropriate. These retention periods will have to be published or otherwise made publicly available. The decision on what is an acceptable duration must take into account the impact on people's rights and interests“.
(iv) „Right to access and rectification - Any individual will be entitled to access their personal data – subject to certain conditions, given the law enforcement context – and request it to be corrected if it is inaccurate“.
(v) „Information in case of data security breaches – A mechanism will be put in place so as to ensure notification of data security breaches to the competent authority and, where appropriate, the data subject“.
(vi) „Judicial redress and enforceability of rights - EU citizens will have the right to seek judicial redress before US courts in case of the US authorities deny access or rectification, or unlawfully disclose their personal data".
Das Umbrella-Agreement muss im nächsten Schritt vom EU-Parlament gebilligt werden.
NB Die „Preliminary Opinion“ des Europäischen Datenschutzbeauftragten zum Umbrella-Agreement ist online verfügbar.