European Court of Justice Issues Opinion Striking Down The Safe Harbor

In a landmark judgment in Schrems v Data Protection Commissioner (C-362/14) (October 6, 2015) ("Safe Harbor judgment"), the European Court of Justice ("ECJ") found the Safe Harbor Decision of the European Commission (Commission Decision 2000/520/EC of 26 July 2000) to be invalid. The invalidity of the Safe Harbor Decision calls into question the legality of large portions of data flows from Europe to the United States and causes considerable legal uncertainty for US companies offering their services in the EU.

Legal Background 

Under Art. 25 (1) of the EU Data Protection Directive 95/46/EC ("Directive 95/46"), the central legislation to govern the processing of personal data of European users, personal data of European citizens may be transferred to a non-EU country only if the country in question ensures an adequate level of protection of the data transferred. In its Safe Harbor Decision, the European Commission had decided that the "Safe Harbor