EU data bill is likely target of NSA snoops

German daily Der Spiegel revealed over the weekend that the US intelligence agency, the NSA, spied on EU missions in Washington and in New York. The daily says NSA agents may have also infiltrated EU security communication lines in Brussels.

The draft EU data protection regulation and its accompanying directive aim to overhaul data protection rules throughout the 28 member states.

But the bill, first introduced by the European Commission in January 2012, has been the target of intense lobbying by the US government and US-based companies like Amazon, Google, and Facebook.

“It has been debated at the council, it has been debated in the EU institutions, also in the representation in Washington,” noted Albrecht.

MEPs are currently grappling with over 4,000 amendments in the regulation, pushing back a scheduled orientation vote in the civil liberties committee to the end of the year.

The unfolding series of US-led spy scandals first revealed by the Washington Post and The Guardian in June has prompted the MEPs to strengthen the bill with an anti-snooping clause.

The so-called article 42 aims to create a legal framework on the transfer of data between third countries, including the United States.

US companies with branches in Europe under the current regime are caught in a legal paradox. Demands for their data must be kept secret under US law but the EU says they must inform people when the US seeks out their personal data.

The article first appeared in a leaked draft by the commission in November 2011 but was later dropped because of American lobbying efforts.

Article 42 is known in EU circles as the "anti-Fisa clause" because the US carried out Prism under its Foreign Intelligence Surveillance Act (Fisa).

The parliament’s group of lead negotiators on the file is set to debate re-inserting article 42 into the regulation before the end of summer.

But in reality, the regulation and the directive would have little impact on foreign intelligence gathering on US-based Cloud services because neither apply to national security issues.

“Perhaps its time to re-discuss once more if we really want to completely exclude national security from the scope of the regulation,” said Albrecht.