Privacy Shield, Revealed: A Look At The Proposed Replacement Of Safe Harbor

Since 6 October 2015 when the Court of Justice of the European Union ("CJEU") found that Safe Harbor was invalid, organisations which operate across the United States and the European Economic Area ("EEA") have been in an uncertain position when it comes to data transfers. Many hoped for a replacement to Safe Harbor. The Article 29 Working Party (the collective group of European data protection authorities, or "DPAs") indicated that no general enforcement action would be taken until the end of January 2016. This gave organisations some welcome breathing space to put in place alternative measures to legitimise data transfers to the United States. However, it also put pressure on the Commission to finalise a replacement data transfer scheme with the United States, which had been under negotiation for two years. On 2 February 2016, the Commission delivered – announcing the Privacy Shield, the replacement of Safe Harbor.