Safe Harbour Not Safe Enough: Data Transfers From E.U. To U.S. Out To Sea

The transfer of personal information from the European Union (EU) to the United States (US), and potentially other non-EU nations, just became a lot more complicated.

The Decision

On October 6, 2015, the Court of Justice of the European Union (CJEU) released its decision in Schrems v Data Protection Commissioner.¹ The Schrems decision will have a significant impact on the ability of businesses to transfer personal data from the EU to the US, and potentially to other non-EU countries as well. The decision contains two important holdings: (1) that companies can no longer rely on compliance with safe harbour principles to transfer personal data from the EU to the US, and (2) that the supervisory authority in each EU Member State has the right to review whether non-EU countries provide adequate data-protection policies to permit cross-border data transfers.