What happened to Safe Harbor?

A recent judgment of the Court of Justice of the European Union (‘CJEU’) regarding the US Safe Harbor scheme has understandably received a lot of interest.

In brief, a previous decision of the European Commission recognising the Safe Harbor scheme meant that businesses could be assured that by transferring personal data to members of the scheme in the US, they would have satisfied their legal requirements relating to the transfer of personal data outside of the EU on the basis that it would be adequately protected. However, following the judgment, that assurance has now gone.

Whilst the judgement did not specifically strike down the Safe Harbor scheme, it focussed on the decision of the European Commission which had previously given assurances to businesses. So, whilst signing up to the scheme is still very positive, the assurance previously enjoyed about adequacy of protection as required under the 8th data protection principle is no longer there.

The reason for the decision of the CJEU results from the ability of the US intelligence services to gain access to personal data transferred between organisations. The CJEU considered that the access which the intelligence service had went beyond what it considered to be strictly necessary and proportionate for the protection of US national security. As well as this point is the issue that non-US persons don’t have any right to seek legal remedies in the US for the misuse of their personal data.

The decision of the CJEU also contained a ruling that data protection authorities aren’t prevented from considering any complaints made by individuals that their data hasn’t been properly protected, even when a decision has been made previously by the European Commission on the issue. This issue goes beyond Safe Harbor and means inevitably that some of the previous certainty enjoyed by businesses under Commission decisions may no longer exist.

The effect the judgment will have on standard contractual clauses and the adequacy of particular countries is still being analysed but existing Commission decisions in these areas can still be relied on for the time being.

This is a complex area and one which needs a watchful eye over the next few months. 

By Daniel Gardener

Subject to our terms and conditions and copyright policy