A slew of agreements requiring Europeans’ personal data to be transferred to United States authorities will come under intense spotlight in 2010. One big legal change will have a major impact on the dynamics of the discussion: the European Parliament must henceforth give its consent for such transfers to take place. US and EU officials are worried that the European Parliament, generally more sensitive about data privacy matters, could be a stumbling block to passing transatlantic agreements.

BANKING RECORDS

The first showdown will be the nine-month interim SWIFT agreement that the EU Council of Ministers signed on 30 November 2009, which gives the US Treasury continued access to intra-European bank transaction records. Parliament must give its consent to this deal - and to a longer-term one for which the European Commission is due to propose a negotiating mandate in early 2010. The US Treasury has, since late 2001, had access to intra-European data via the Belgian-based SWIFT company’s database in Virginia. However, on 31 December 2009, such data will only be stored in SWIFT’s sites in the Netherlands and Switzerland.

Dutch Liberal MEP Sophie in’t Veld, a long-time opponent of this arrangement, told Europolitics “if the Council and Commission are smart, they will involve us at an early stage in the negotiations”. She added: “I want proof that the existing EU-US agreement has saved lives [the Treasury says it uses it to catch terrorists]. The public believes it’s all or nothing with data transfers, but that is not true. The US could access the data without an agreement by producing a warrant and demonstrating ‘due cause’”. Another aspect she objected to was how “we are just outsourcing the job to the US. The Americans provide this data to EU governments which do not want to get it themselves for fear of breaching data protection laws”.

Article 4 of the 2003 EU-US Mutual Legal Assistance treaty (MLA), which enters into force on 1 February 2010, provides for sharing information on bank records. But it is harder for the US to get the data using this route because each request must be linked to a specific criminal investigation. Moreover, the MLA route does not permit direct access to the SWIFT database, relying instead on an EU government to obtain the data for the US. Governments can refuse to help if the crime being investigated is not punishable by at least two years in prison in the requested state. Such restrictions explain why the Treasury prefers a SWIFT-specific deal. However, MEPs may try to base US access on the 2003 MLA treaty.

A spokesman for SWIFT told Europolitics: “We are glad that sovereign nations are now talking about the issue. This is much more comfortable for us than receiving subpoenas from the US, handing over data and then getting caught up in the data privacy debate.” The spokesman said the current arrangement “has had a negative impact on our business” because the Treasury does not have such access to records of other companies that provide similar messaging services. SWIFT wants any EU-US accord to only give access for counter-terrorism purposes, to limit the volume of data that can be given to the Treasury and to apply the regime to SWIFT’s industry competitors too.

AIRPASSENGER DATA

Parliament must also give its consent to the 2007 EU-US Passenger Name Record (PNR) agreement that requires airlines to transmit passengers’ personal data to US authorities. This is because not all EU countries had ratified the 2007 accord by the time the Lisbon treaty entered into force on 1 December so that it could not be concluded under the pre-Lisbon framework. It is quite possible – even likely – that MEPs will reject the agreement. They challenged an earlier version of it at the European Court of Justice, which found partly in their favour, forcing the Council and Commission to negotiate a new deal with the US Department of Homeland Security. However, it is worth noting that the balance of power in the EP has shifted to right-leaning parties since the 2009 elections, possibly making it less strident on the data privacy front.

HORIZONTAL AGREEMENT

Meanwhile, initial preparations are underway for upcoming negotiations on the first ever horizontal EU-US agreement on data transfers to law enforcement authorities. These talks got the green light at an EU-US justice and home affairs ministerial in Washington in October 2009, where a set of common data protection principles were adopted. A major issue in these talks will be the fact that US data privacy laws do not protect European citizens’ personal data. In a separate but interlinked sphere, the EU will push for the remaining five EU countries to be included in the US Visa Waiver Programme. The countries will only be added if they agree to provide the US with a lot of law enforcement-related data – for example national criminal records. But this is not the main stumbling block for Bulgaria, Romania and Poland, rather it is their citizens’ stubbornly high US visa refusal rates.

TWO NEW COMMISSIONERS

The Spanish EU Presidency may play a supporting role on these dossiers, but the Commission will be in the driving seat given its deeper understanding of the issues and background and enhanced powers as the EU’s negotiator under Lisbon. It will be interesting to see the relationship that develops between the two women who will be in charge, Viviane Reding and Cecila Malmström, the Commissioners-designate for justice and home affairs respectively. Reding should take the lead on data protection issues, being responsible for fundamental rights policy, and Malmström on the data transfer side, as her remit covers law enforcement co-operation. Asked her view of the new line-up, MEP in’t Veld said “I am extremely pleased with Cecilia Malmström. But I am yet to be convinced that Viviane Reding will be a champion of fundamental rights. The Parliament’s hearings will be very interesting.”

The Spanish Presidency may play a supporting role on these dossiers, but the Commission will be in the driving seat