EU, US near deal on police access to online data

BRUSSELS — The long arm of the law is about to stretch from Europe all the way into United States-based data centers — and back.

A transatlantic agreement is expected to give European police forces new powers to access data from U.S.-headquartered Big Tech platforms, despite longstanding concerns over privacy and civil rights.

European Justice Commissioner Didier Reynders told POLITICO he was "confident" a two-way deal between Brussels and Washington to speed up law enforcement's access to data held by tech companies on both sides of the Atlantic could be reached by the end of the year. Reynders said Monday he would most likely meet with U.S. Attorney General Merrick Garland in Washington in March "to fix the final concerns" and the goal was to finish the deal before the United States' November elections.

Unlike most privacy issues between the two blocs — which have centered around U.S. mass surveillance practices like those revealed by Edward Snowden in 2013 — the concerns over this new deal are bifold: Europe fears the U.S. could overreach in their requests for data but civil rights defenders and others have equally warned that European countries with a poor track record on the rule of law could misuse the new powers in ways that limits freedom of speech or political opinion.

Some EU countries have seen a backslide in the rule of law, including Hungary, which in 2021 passed an anti-LGBTQ+ law prohibiting the portrayal of homosexuality or transgender people in content shown to minors.

American tech companies are currently banned under U.S. law from handing content data, such as emails, directly to foreign law enforcement. They can, however, choose to share other data — like information about an account and the email address.

European national police most often have to go through American authorities to request digital information from U.S.-headquartered companies under a 2010 EU-U.S. mutual legal assistance treaty. But law enforcement agencies in Europe have complained that the complex process, which takes about 10 months on average according to the Commission, has hindered or even destroyed some investigations.

Meanwhile, U.S. law enforcement agencies can obtain data stored by U.S. companies including Google, Meta, Microsoft and Amazon anywhere in the world through Washington’s CLOUD Act, adopted in 2018 — an extraterritorial data grab that has irked many European capitals.

Reynders said Brussels and Washington shared similar goals for improving their police forces' access to data in criminal investigations related to terrorism, drug trafficking and online child sexual abuse. “Now the problem is to see if it's possible to align all safeguards on both sides,” he said. “But again, it's not easy due to some major differences like the death penalty.”

U.S. judges can still impose the death penalty for some serious crimes, a punishment banned in the European Union. In previous e-evidence deals, the U.S. agreed to give the United Kingdom and Australia veto power to block information obtained from companies headquartered in their countries as part of American death penalty prosecutions, and obtained in return veto power to oppose the potential use of U.S.-based data for proceedings raising freedom-of-speech concerns.

European Justice Commissioner Didier Reynders | Ronald Wittek/EFE via EPA

It's unclear whether the EU-U.S. deal might include similar conditions. A senior Commission official told the European Parliament in 2023 that it would be "difficult" for the EU to accept an agreement where data was used to secure the death penalty or lifetime imprisonment without parole, while the U.S. would push to get access to real-time communications and limits to use data for investigations with a possible impact on free speech.

Brussels kicked off talks on police access to data with Washington in 2019, but put them on hold to find a common European position on the issue. After finalizing the bloc's e-evidence law, negotiations restarted in March 2023. The U.S., meanwhile, reached deals with the U.K. in 2019 and Australia in 2021.

Any new deal to empower European and U.S. law enforcement to more easily obtain data could likely also face legal action from digital rights nonprofits on both sides of the Atlantic.