What You Need To Know About The New EU-U.S. Data Transfer Pact

In October 2015, the Court of Justice of the European Union ("CJEU"), in its Schems decision, struck down protections afforded by the 2000 CJEU "Safe Harbor Decision." The Safe Harbor framework had established a system by which U.S. companies could self-certify compliance with a single set of principles and procedures, thus verifying that they complied with all the various EU privacy and data transfer standards.

But in 2015, things changed. Concerned with the U.S. government's ability to gain access to information during law enforcement investigations, the CJEU determined that the protections afforded by the Safe Harbor framework failed to meet EU standards and adequately protect information of EU citizens. Overnight, companies that previously certified compliance via the Safe Harbor framework were in violation of the EU data protection laws.