The Judicial Redress Act (Act), signed into law on February 24, 2016, by President Obama, extends the privacy protections offered to U.S. citizens under the Privacy Act of 1974 to citizens of  ''covered countries'' overseas. The Act paves the way for the implementation of the Privacy Shield and the execution of the European Union (EU)-United States Umbrella Agreement, two key cross-border privacy and transfer agreements that would allow companies in the United States to receive personal information from companies in the EU.

In September 2015, the United States and EU finalized negotiations on the Protection of Personal Information Relating to the Prevention, Investigation, Detection, and Prosecution of Criminal Offenses (Umbrella Agreement). The Umbrella Agreement was predicated, however, on the United States extending the Privacy Act to enable EU citizens to seek judicial redress if U.S. authorities unlawfully disclosed their personal data—which the Judicial Redress Act accomplishes.

The Privacy Act, which previously applied only to U.S. citizens and lawfully admitted permanent residents, establishes rules governing the collection, maintenance, use, and disclosure of information about individuals by federal agencies. The Judicial Redress Act gives individuals from "covered countries," as determined by the U.S. Attorney General, the right to access and amend their personal information and the right to bring a civil action against a federal agency that violates the Privacy Act. Extension of the Privacy Act protections to EU citizens is intended to address concerns regarding a perceived lack of accountability of U.S. agencies for the privacy rights of EU citizens. Similarly, the addition of a judicial redress mechanism for EU citizens in U.S. courts now is meant to enhance protection of privacy rights under the EU legal framework.

Under the Act, the Attorney General will have the authority to designate a foreign country, regional economic integration organization, or member country of such organization as a ''covered country'' if:

• It has entered into an agreement with the United State that provides for appropriate privacy protections for information shared for the purpose of preventing, investigating, detecting, or prosecuting criminal offenses.
• The Attorney General has determined that it has effectively shared information with the United States for the purpose of preventing, investigating, detecting, or prosecuting criminal offenses and has appropriate privacy protections for such shared information.
• It permits the transfer of personal data for commercial purposes between  that country or regional economic organization and the United States, through an agreement with the United States or otherwise.
• The Attorney General has certified that the policies regarding the transfer of personal data for commercial purposes and related actions of the country or regional economic integration organization, or member country of such organization, do not materially impede the national security interests of the United States.

Since the invalidation of the Safe Harbor agreement, companies have had to rely on other mechanisms to justify EU-U.S. cross-border data transfers. The Judicial Redress Act is another step toward the finalization of the Privacy Shield as a means to facilitate such transfers in compliance with the EU Data Directive.