The Judicial Redress Act (Act), signed into law on February 24, 2016, by President Obama, extends the privacy protections offered to U.S. citizens under the Privacy Act of 1974 to citizens of  ''covered countries'' overseas. The Act paves the way for the implementation of the Privacy Shield and the execution of the European Union (EU)-United States Umbrella Agreement, two key cross-border privacy and transfer agreements that would allow companies in the United States to receive personal information from companies in the EU.

In September 2015, the United States and EU finalized negotiations on the Protection of Personal Information Relating to the Prevention, Investigation, Detection, and Prosecution of Criminal Offenses (Umbrella Agreement). The Umbrella Agreement was predicated, however, on the United States extending the Privacy Act to enable EU citizens to seek judicial redress if U.S. authorities unlawfully disclosed their personal data—which the Judicial Redress Act accomplishes.

The Privacy Act, which previously applied only to U.S. citizens and lawfully admitted permanent residents, establishes rules governing the collection, maintenance, use, and disclosure of information about individuals by federal agencies. The Judicial Redress Act gives individuals from "covered countries," as determined by the U.S. Attorney General, the right to access and amend their personal information and the right to bring a civil action against a federal agency that violates the Privacy Act. Extension of the Privacy Act protections to EU citizens is intended to address concerns regarding a perceived lack of accountability of U.S. agencies for the privacy rights of EU citizens. Similarly, the addition of a judicial redress mechanism for EU citizens in U.S. courts now is meant to enhance protection of privacy rights under the EU legal framework.

Under the Act, the Attorney General will have the authority to designate a foreign country, regional economic integration organization, or member country of such organization as a ''covered country'' if:

  • It has entered into an agreement with the United State that provides for appropriate privacy protections for information shared for the purpose of preventing, investigating, detecting, or prosecuting criminal offenses.

  • The Attorney General has determined that it has effectively shared information with the United States for the purpose of preventing, investigating, detecting, or prosecuting criminal offenses and has appropriate privacy protections for such shared information.

  • It permits the transfer of personal data for commercial purposes between  that country or regional economic organization and the United States, through an agreement with the United States or otherwise.

  • The Attorney General has certified that the policies regarding the transfer of personal data for commercial purposes and related actions of the country or regional economic integration organization, or member country of such organization, do not materially impede the national security interests of the United States.

Since the invalidation of the Safe Harbor agreement, companies have had to rely on other mechanisms to justify EU-U.S. cross-border data transfers. The Judicial Redress Act is another step toward the finalization of the Privacy Shield as a means to facilitate such transfers in compliance with the EU Data Directive.

Attorneys in Ballard Spahr's Privacy and Data Security Group can help U.S. companies comply with their obligations in connection with data processing and cross-border transfer so as to mitigate the exposure of violating the rights of EU nationals.

Copyright © 2016 by Ballard Spahr LLP.
www.ballardspahr.com
(No claim to original U.S. government material.)

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, including electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of the author and publisher.

This alert is a periodic publication of Ballard Spahr LLP and is intended to notify recipients of new developments in the law. It should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own attorney concerning your situation and specific legal questions you have.