U.S. No Longer Safe Harbor For European Data

On October 6, 2015, the European Court of Justice (the "Court") ruled that the EU Data Protection Commission's U.S. Safe Harbor Decision¹ (the "Safe Harbor Decision") is invalid. The European Union Data Protection Directive forbids the transfer of personal data to a country outside the European Economic Area ("EEA") unless that country has adequate data protection measures in place. American data protection laws have long been deemed inadequate in the eyes of EU decisions makers; and therefore, the Safe Harbor Decision was designed to facilitate data transfers between the EEA and the U.S. The Safe Harbor Decision allowed American companies to self-certify that they complied with European privacy standards to legally receive exports of personal data from the EEA to the U.S. For the past fifteen years, companies have relied on the Safe Harbor Decision for the transfer of personal data² between the U.S. and the EU.