German Data Protection Commissioner Fines US Companies For Unlawful Data Transfers

On June 6, 2016, the Data Protection Commissioner for Hamburg, Germany, announced fines against three US companies for unlawful transfers of employee and customer data from the EU to the US. This action by the Hamburg Commissioner is the most significant enforcement action to date for non-compliance with current law.

These fines occurred in the wake of the October 2015 decision by the Court of Justice of the European Union (CJEU), which invalidated the US-EU Safe Harbor Framework as a means for lawfully transferring personal data from the EU to the US. (Previously, certain US companies and other persons could lawfully transfer Europeans' personal data to the US by certifying their compliance with the Safe Harbor Framework.) The CJEU's decision created significant uncertainty for data transfers from the EU to the US, as many companies rushed to implement alternate means of lawfully transferring data. European data protection authorities provided a three months grace