After clearing the House and Senate, the Judicial Redress Act was sent to President Obama on February 10, 2016, to be signed into law. The Act, which will provide foreign citizens the same judicial redress afforded to U.S. citizens and aliens lawfully admitted for permanent residence if the U.S. government misuses their personal information, is a key piece of the United States’ commitment to the Privacy Shield agreement reached between the United States and the European Union on February 2, 2016.
Although the idea to extend judicial redress to non-U.S. citizens for privacy violations was first raised in March 2015, Congress did not take meaningful action until after the European Court of Justice invalidated the now defunct Safe Harbor pact in October 2015. The Court reasoned that the agreement failed to protect the privacy of EU citizens by permitting the U.S. government nearly unfettered access to their data. Just two weeks after the Court’s ruling, the House passed its version of the Judicial Redress Act. The Senate Judiciary Committee failed to vote on the bill before the year-end recess, but advanced the bill out of committee last month.
Although the measure moved relatively quickly through Congress, it was not without obstacles. In advancing the Act, the Senate Judiciary Committee added a somewhat controversial reciprocity amendment that will extend the Act’s benefits only to countries that allow commercial data transfers with the United States and agree not to impede U.S. national security interests. On February 9, 2016, days after the United States and the EU reached the new Privacy Shield pact, the Act passed in the Senate, despite the reciprocity amendment. A reconciled version of the bill passed both chambers of Congress the following day, and the bill was presented to President Obama for his signature.
Under the Act, U.S. law enforcement and intelligence agencies cannot willfully or intentionally violate conditions for disclosing records of foreign citizens without the consent of the individual to whom the record pertains. Moreover, U.S. agencies cannot refuse a foreign citizen’s request to review his or her records, and must also permit requests by foreign citizens to amend records. The Act applies to citizens of “covered countries” designated as such by the Attorney General based on congressionally-prescribed criteria related to data privacy. If the U.S. government violates the Act and misuses personal data, foreign citizens covered by the Judicial Redress Act will be permitted to bring civil actions under the Privacy Act of 1974 against certain U.S. government agencies—the same judicial recourse granted to U.S. citizens for like violations.
The Act has several important implications for U.S.-EU relations. Although not an express requirement under the Privacy Shield agreement, many hope that the passage of the Judicial Redress Act will prompt the European Court of Justice to find that the U.S. privacy framework is essentially equivalent to privacy protections in the EU, a finding that is crucial to the legality and ultimate success of the Privacy Shield. Moreover, the Act is a stated requirement of the U.S.-EU data privacy protection “umbrella agreement,” which will govern the transfer of personal data related to transatlantic criminal investigations. The United States and the EU concluded the umbrella agreement back in September 2015, but it required amending the Privacy Act of 1974 before the umbrella agreement took legal effect—an amendment accomplished by the Judicial Redress Act.
Reporter, Bailey J. Langner, San Francisco, +1 415 318 1214, blangner@kslaw.com.
