Last-minute change to privacy bill adds tension to US-EU talks

The European Commission is dismayed by the final language of a key privacy bill that could influence already-tense negotiations over a new data flow agreement with the U.S., according to those familiar with the talks.

The so-called Judicial Redress Act, passed out of a Senate committee on Thursday, includes a compromise offered in response to concerns from some Republicans that the bill was a “concession” to the EU.

{mosads}The amendment, circulated amid a flurry of eleventh-hour negotiations on Wednesday, would require the European countries covered by the bill to allow commercial data transfers with the U.S. In addition, it includes a provision stating that the bill can not impede U.S. national security interests.

Supporters have long hoped that passing the bill, which gives EU citizens the right to challenge misuse of their personal data in U.S. court, would help U.S. negotiators reach a deal on a new Safe Harbor agreement.

The original pact, which permitted some 4,400 U.S. firms to legally handle European citizens’ data, was struck down last fall over privacy concerns.

Now, the clock is running down to the wire: Europe’s privacy regulators have said they will begin to take enforcement action against U.S. firms at the end of the month if a new agreement is not reached.

Passage of the bill is also a prerequisite of a pending data-sharing “umbrella” agreement reached last fall that would allow the U.S. and EU to exchange more data during criminal and terrorism investigations.

Those familiar with the Safe Harbor talks say the European Commission, which is leading negotiations on the EU side, is weighing sending a letter to Congress expressing concerns over the last-minute addition to the legislation.

But they say if the commission does take action, it will likely wait until after the Senate body votes on the bill.

More realistically, the commission is expected to be pragmatic and accept the Senate compromise rather than derail the negotiations, several of those tracking the issue say.

True kickback to the edit is more likely to come from Europe’s more hard-line privacy regulators, set to meet in Brussels on Tuesday to set common guidelines on how U.S. companies can legally handle European citizens’ data in the absence of Safe Harbor.

The amendment was agreed to by unanimous consent. The bill passed out of the Senate Judiciary Committee on a 19-1 vote, with only Sen. Jeff Sessions (R-Ala.) objecting.

Majority Whip John Cornyn (R-Texas) on Thursday cast the new language as a show of U.S. strength in the negotiations over Safe Harbor, rankling some observers who saw the tactic as strong-arming.

“U.S. companies should not have to endure regulatory threats in an attempt to change our policy or laws. This amendment lays down these important markers,” Cornyn said.

Although Jan. 31 — Sunday — is the formal deadline given by the group of privacy regulators, many tracking the negotiations believe that the true drop-dead date for an agreement is Tuesday, when they meet in Brussels.

“It is evident that we will sanction any transfers of personal data which are solely based on the old safe harbour decision,” Johannes Caspar, head of Germany’s data protection authority, said earlier this month.