Data Transfers In Limbo – U.S. Companies Face Fines By German Data Protection Authorities

Article by Sophie Ratzke, Christian Schröder and Sam Castic.

While EU regulators determine whether to adopt a new agreement for transfers of personal data from Europe to the United States to replace the invalid EU-U.S. Safe Harbor Framework, German data protection authorities have not been idly twiddling their thumbs.

Hamburg's data protection commissioner, the head of one of 16 Federal German data protection authorities ("DPA"), announced in February that his agency is investigating Hamburg-based subsidiaries of large U.S. companies engaging in transfers of personal data of EU citizens to the U.S.

While the "EU-U.S. Privacy Shield" has been proposed by the EU Commission as a replacement to the Safe Harbor Agreement it is still under discussion and has not been formally adopted. In the meantime, some U.S. companies may still be relying on the defunct Safe Harbor Agreement to transfer personal data across the Atlantic. After the Safe Harbor Agreement was