EDPB-EDPS Joint Response on the US Cloud Act

Mr. Juan Fernando López Aguilar Chair of the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE)

Brussels, 10 July 2019

By email only

Ref: OUT2019-0007

Subject: LIBE Committee letters to the EDPS and to the EDPB regarding legal assessment of the impact of the US Cloud Act on the European legal framework for personal data protection

Dear Mr. López Aguilar,

We thank the LIBE Committee for its letters, by which the Committee asked both the EDPS and the EDPB for a legal assessment of the impact of the US Clarifying Lawful Overseas Use of Data Act (US CLOUD Act) on the European legal framework for the protection of personal data, as this is an important and complex issue.

The attached initial legal assessment focuses on this specific context of requests made by US law enforcement authorities under the US CLOUD Act for criminal investigations purposes. It builds on the current EU data protection legal framework and is therefore subject to its accurate interpretation. It does not preclude any conclusions that could possibly be drawn in other contexts or any future legal improvements where necessary.

The General Data Protection Regulation 2016/679 contains in particular one important provision, which aims to regulate “transfers or disclosures not authorised by Union law” and constitutes an important element of the current set of rules framing disclosures and transfers of personal data from the EU to third countries (Article 48).

We would like also to remind you that the GDPR also contains a series of derogations for transfers in specific situations that must be subject to strict interpretation (Article 49). We have conducted an initial analysis of this question that you will find attached. We are of the view that currently, unless a US CLOUD Act warrant is recognised or made enforceable on the basis of an international agreement, the lawfulness of such transfers of personal data cannot be ascertained, without prejudice to exceptional circumstances where processing is necessary in order to protect the vital interests of the data subject.

The Mutual Legal Assistance Treaty already in force between the EU and the US , as a legal instrument mainly aimed at facilitating judicial cooperation, contains only very limited provisions relevant from a data protection point of view. The EDPB and EDPS therefore wish to emphasize the urgent need for a new generation of MLATs to be implemented, allowing for a much faster and secure

processing of requests in practice. In order to provide a much better level of data protection, such updated MLATs should contain relevant and strong data protection safeguards such as, for example, guarantees based on the principles of proportionality and data minimisation. In addition, the "dual criminality principle" providing safeguard against discrepancy between how a crime is defined under the foreign law and how the same crime is legally defined under EU law should be preserved.

We also note that the European Commission has recently engaged in negotiations with the US of an international agreement dealing precisely with cross-border access requests to electronic evidence. The relevant negotiating mandate together with more specific negotiating directives were adopted by the Council on 27 May 2019 . We would like to recall that, of course, such international agreement must also contain sufficient adequate data protection safeguards and be compliant with EU law.

In light of the above, we would like to stress the importance of a comprehensive EU-US agreement on access to electronic evidence, containing strong procedural and substantive fundamental rights' safeguards, to ensure the necessary level of protection for EU data subjects and legal certainty for businesses operating in both jurisdictions.

We also stress the need for an EU-level approach. In this specific context, as massive amounts of electronic communication data are processed and stored by operators falling under US jurisdiction and since direct access requests sent by US authorities are likely to affect any Member State, an EUlevel approach is essential here in order to avoid the potential negative consequences of a fragmented patchwork of non-harmonised bilateral executive agreements between the US and EU Member States that would be concluded under the US CLOUD Act.

Finally, an EU-level approach should on the one hand be coherent: conditions under which US law enforcement authorities could obtain personal data stored in the EU should not be more lenient/flexible than conditions for EU law enforcement authorities to obtain data in the EU. On the other hand, such approach should be reciprocal: conditions for US authorities to access personal data stored in the EU should take into account conditions with which EU law enforcement authorities must comply to request data in the US, so that individuals on both sides of the Atlantic enjoy similar safeguards and protections.

Further analysis is required with regard to additional specific situations and other issues raised in this legal assessment.

Yours sincerely,

For the EDPB For the EDPS

Andrea Jelinek Giovanni Buttarelli

Attached: Annex Cc: Antoine CAHEN, Head of Unit, LIBE Secretariat. Jose-Manuel de FRUTOS GOMEZ, Administrator, LIBE Secretariat.