Europe's Top Court Invalidates ‘Safe Habour' Data Transfer Framework

On October 6, 2015, the Court of Justice of the European Union ("CJEU") declared that the US-EU Safe Harbour framework is invalid, striking it down in the highly anticipated case of Schrems v. Data Protection Commissioner. The decision is effective immediately, with far-reaching and widespread implications for entities with multinational data flows.

Since EU data protection laws purport to apply to the processing of personal data regardless of whether the individuals affected are EU citizens or not, or are physically present in the EU or not, the potential impacts of this decision go beyond those organizations with an EU clientele. Any organization that makes use of equipment located in a Member State to process personal data is potentially at risk.