The comments from the EDPS show that he remains concerned about the draft agreement, which is generally viewed as an improvement on the first version. The agreement, which will replace the much criticised SWIFT data-sharing procedures, has attracted criticism suggesting that it remains lop-sided – giving more powers to the USA than to the EU.
The EDPS points out that there are still some open questions to address and key elements to improve in order to meet the conditions of the EU legal framework on the protection of personal data. The most obvious defect in the draft agreement is that Europol is given a quasi-judicial function in certain circumstances whilst retaining its major investigative function. The EDPS lists the following concerns and areas that require improvement:
‘Ensuring that bulk transfers are replaced with mechanisms allowing financial transaction data to be filtered in the EU, and ensuring that only relevant and necessary data are sent to US Authorities
Considerably reducing the storage period for non-extracted data
Entrusting the task to assess the requests of the US treasury to a public judicial authority, in line with the negotiating mandate and the current EU legal framework
Ensuring that the data subjects’ rights conferred by the proposal are clearly stated and effectively enforceable also in the US territory
Enhancing the independent oversight and supervision mechanisms’
The Opinion can be read in full here
