Caveat Vendor

House Seeks to Reassure Europe by Approving Bill to Extend Privacy Protections to Certain Foreign Citizens

October 26, 2015

Mary-Elizabeth M. Hadley

Yesterday, the U.S. House of Representatives passed the Judicial Redress Act, legislation that would enable citizens of certain countries, such as those in the European Union (“EU”), to file suit against U.S. government agencies for certain Privacy Act violations.

 Judicial Redress Act

The bill, H.R. 1428, extends certain protections of the Privacy Act, 5 U.S.C. § 552a, to citizens of “covered countries,” i.e., those designated by the Attorney General, with the concurrence of the Secretary of State, Secretary of the Treasury and Secretary of Homeland Security, on the basis that they: (i) have “entered into an agreement with the United States that provides for appropriate” information-sharing privacy protections, or (ii) have “effectively shared information with the United States for the purpose of preventing, investigating, detecting, or prosecuting criminal offenses and has appropriate privacy protections for such shared information.”

Those covered by the act will be able to bring a lawsuit in the U.S. District Court for the District of Columbia for intentional or willful violations of the Privacy Act’s disclosure provisions as well as challenge, among other things, designated federal agencies’ determinations not to provide access to or amend their records.  Notably, however, the bill contains a broad preservation of “any applicable privilege” and makes clear that it shall not “require the disclosure of classified information.”

An Effort to Assuage Concerns

Timely passage of the legislation is viewed as particularly key in light of the European Court of Justice’s (“ECJ”) landmark opinion earlier this month, overturning the European Commission's 15-year old decision that the privacy principles of the U.S.-EU Safe Harbor Accord provide an adequate level of protection of the personal data of EU citizens.  Technology companies and House lawmakers have expressed their hope that approval of the bill will be viewed as a first step towards restoring trust between the EU and the United States.  Similarly, Sen. Orrin Hatch (R-Utah), who, along with Sen. Chris Murphy (D-Conn.), introduced the Judicial Redress Act in the Senate, issued a statement emphasizing that “now is the time to act.  In light of the European Court of Justice’s recent 'safe harbor' decision, Congress must provide assurances to our European allies that America respects data privacy.  We cannot afford to wait any longer.”
Signing of the law is also essential to the finalization of an “umbrella agreement” on the data protections that will govern how data are shared among law enforcement officials in the United States and the EU, provisionally reached last month.  The umbrella agreement is contingent on EU citizens being provided additional judicial rights in the United States.

It remains unclear, however, if and when the Senate will act and whether the legislation will have any impact on separate negotiations over an enhanced safe harbor framework.  In the interim, see Paul Hastings’ recent presentation for ten options to consider in the wake of the ECJ’s decision and stay tuned for updates.

Caveat Vendor is Paul Hastings’ Consumer Issues blog. We welcome your feedback. Please contact our blog editor with any thoughts or suggestions.

Subscribe to Caveat Vendor__. You will receive an email when the blog has been updated.