The Commission recalls that the Umbrella Agreement does not constitute a legal basis for the transfer of personal data between the EU and the US for the prevention, investigation, detection or prosecution of criminal offences, including terrorism (see Article 1(3) of the Agreement). Rather, in combination with the applicable legal basis for the transfer and subject to the conditions set forth in Article 5 of the Agreement, the Agreement aims to provide appropriate safeguards within the meaning of Article 37(1) of Directive 2016/680. By contrast, the Agreement does not provide a general authorisation for transfers. Furthermore, the Agreement preserves the ability of national data protection authorities to fully exercise their supervisory powers granted by EU law as regards international transfers falling within its scope.

The Commission notes that in line with the request from the European Parliament in its Resolution of 12 March 2014 (2013/2188(INI)) to guarantee ‘effective and enforceable […] judicial remedies for all EU citizens in the US’ and to ‘put rights for EU citizens on an equal footing with rights for US citizens’, Article 19(1) of the Umbrella Agreement provides EU citizens with rights to judicial redress. In order to comply with this provision, the U.S. Congress has already adopted the Judicial Redress Act. This is an important step in the implementation process. Based on the assurances it has received during the negotiations, the Commission expects that all designations under that Act, both of the EU as a ‘covered country’ and of all U.S. agencies that process data falling within the scope of the Agreement as ‘designated federal agency or component’, will be made and that all data transfers falling within the scope of the Agreement will be covered. The Commission confirms that this includes transfers carried out on the basis of the EU-U.S. Agreement on Passenger Name Records (PNR) and the EU-U.S. Agreement on the processing and transfer of Financial Messaging Data from the EU to the U.S. for purposes of the Terrorist Finance Tracking Program (TFTP) (see Article 3(1) in conjunction with the fourth paragraph of the preamble to the Agreement) and that the respective data sets cannot be exempted from the benefit of the judicial redress rights granted by the Judicial Redress Act. The Commission considers that only this will ensure the full implementation of Article 19(1) of the Agreement as required by Article 5(2) and (3) of the Agreement.

The Commission considers that Article 19(1) of the Umbrella Agreement constitutes an essential provision of the agreement that needs to be fully implemented, in particular through the necessary designations. Moreover, as provided for in Article 23(1) of the Agreement, the Commission will pay particular attention during the joint review to the effective implementation of Article 19 of the Agreement on judicial redress.

While the additional judicial redress rights provided in Article 19(1) of the Agreement do not extend to non-EU citizens, this is without prejudice to other existing judicial redress rights under U.S. law that are available to any individual regardless of residence or nationality (see Article 19(3) of the Agreement), such as for instance under the Administrative Procedure Act, the Electronic Communications Privacy Act or the Freedom of Information Act.