EU Data Protection Authorities Issue Guidance On U.S. - EU Safe Harbor

In the wake of the decision from the Court of Justice of the European Union deeming the Safe Harbor program invalid, businesses have been clamoring for guidance from regulators regarding how they will interpret and react to the case.

Last week, the Article 29 Working Party (a collection of data protection authorities from EU member states) weighed in with a brief statement, which carries great weight given the collection of such authorities, even if their pronouncements are technically non-binding. Their statement is the following:

• Current data transfers that rely upon Safe Harbor are unlawful.
• Standard contractual clauses and binding corporate rules can still be used. However, this does not prevent any data protection authorities from investigating cases to protect individuals.