FTC Serious About Safe Harbor Framework Enforcement

Perhaps signaling increased scrutiny of Safe Harbor Framework certification, the Federal Trade Commission (FTC) announced recently that it settled 12 enforcement actions where companies had allegedly falsely asserted compliance with the U.S.-EU and U.S.-Swiss Safe Harbor Frameworks. The defendant-companies had claimed compliance with the relevant frameworks even though they had let their certifications lapse.

Under the U.S.-EU Safe Harbor program, U.S. companies operating in the EU are permitted to transfer EU customers’ data out of the EU if they declare compliance with the Safe Harbor Framework, which includes seven privacy principles similar to the 1995 EU Data Protection Directive. Under the U.S.-Swiss program, companies similarly promise to comply with Swiss data protection principles. Both programs require that companies reaffirm the “existing self-certification.”