Access to fingerprint files will be on a “hit, no hit” basis, explained Peter Schaar, German data protection commissioner. If one country asks the other to check a fingerprint and there is a match, or hit, the inquiring country would need to follow up with a request for more information on the subject’s identity.

The agreement, which was described by two European officials, also allows for the transmission of “personal data revealing racial or ethnic origin, political opinion or religious or other beliefs, trade union membership or information concerning health and sexual life” in cases where they are “particularly relevant to the purposes of this agreement.” It defines personal data as “any information relating to an identified or identifiable natural person.”

The agreement also specifies that the parties, “recognizing the special sensitivity of the above categories of personal data, shall take suitable safeguards, in particular, appropriate security measures, in order to protect such data.”

Baker said that means the United States would not hand over data on a suspect’s religious beliefs unless it were relevant to an investigation, as in a terrorism plot involving Islamic extremists.

He said the United States has agreed to limit the purpose for which the data are sought, not to share it with other governments and not to retain data if they are no longer useful — if there is no match on a fingerprint, for instance. He said errors in records will be corrected.

But Schaar, who is independent from the government, said he found no “clear rules on purpose limitation” or on the storage period. “First,” he said, “which data are of concern is not really completely clear. Second, who are the competent authorities on the U.S. side? Third, and most important, there is a lack of independent supervision in the United States over data protection.” In European states, independent privacy commissions safeguard the privacy rights of citizens, he said.