Yesterday evening, President Obama signed the Judicial Redress Act (“the Act”) into law. The Act extends the 1974 “Privacy Act” and provides qualifying non-U.S. individuals with limited rights to review, copy, and request amendments to records about themselves maintained by federal government agencies.
We previously examined a draft of the bill on this blog here. As previously explained, the Act only extends Privacy Act protections to citizens of “covered countries” which have “effectively shared” information with the U.S. for law enforcement purposes. The Act signed by President Obama reflects a further amendment to the draft bill. That amendment limits the extension of Privacy Act rights only to citizens of countries which permit commercial transfers of personal data to the United States.
The Act is viewed as a critical step towards bolstering relationships with the European Union in support of commercial transfers of data. That relationship has faced significant pressure since the invalidation of the Safe Harbor framework for EU-U.S. transfers of personal data last October. In effect, the Judicial Redress Act makes an offer to EU data protection officials: EU citizens may have enforceable rights under the Privacy Act, but only if the EU is willing to cooperate with the U.S. on law enforcement and commercial transfers of data.