Richard Downing, a member of the US Department of Justice’s Criminal Division, gave an update on the ongoing negotiations between the EU and the United States for an agreement on cross-border access to electronic evidence (see EUROPE 12348/17) during a meeting with journalists on Wednesday 20 November.
He stressed the difficulty of implementing this future agreement, recalling that the American justice system is obliged to ensure beforehand that each foreign partner complies with the standards and rules required by the ‘CLOUD Act’, the American law on access to electronic evidence.
The ‘CLOUD Act’ allows the US administration to enter into executive agreements, which would allow US service providers to provide data to a foreign partner government.
“These are difficult standards to meet”, said Richard Downing. “There are some countries in the world that we do not expect any time soon to be able to sign one of those agreements, because they do not have the same respect for the rule of law, and privacy and civil liberties”.
The European Commission, which wants to avoid the risk of fragmentation if the 28 EU Member States were to sign bilateral agreements with the United States, hopes that Washington will agree to derogate from these provisions in order to conclude a comprehensive agreement for the EU.
But, Mr Downing says he is not certain that a single agreement, valid for all European countries, can be reached. “I think if there is a possibility that we might have a sort of framework agreement where we resolve many issues at the EU level, and then have individual agreements with Member States to resolve the remaining issues, then it could work the same way it works for our Mutual Legal Assistance Treaty”, he explained.
An agreement on access to electronic evidence with the United Kingdom. Richard Downing also addressed the recent agreement between the United Kingdom and the United States.
This agreement has raised serious concerns on the European side (see EUROPE 12344/7). Mr Downing pointed out that the text had been negotiated by taking into account the General Data Protection Regulation (GDPR) which governs data processing in the EU Member States, a regulation to which the United Kingdom is therefore still subject.
This UK-US agreement should be able to enter into force within six months, after it is approved by the US Congress and the British Parliament, Richard Downing confirmed. (Original version in French by Agathe Cherki, intern)