FTC Settles With Businesses Who Allegedly Misrepresented US-EU Safe Harbor Certification

Beware: Even if your company substantially complies with the Privacy Principles of the US-EU Safe Harbor, failure to annually re-certify can land you in hot water.

Twelve US businesses—ranging from sports teams, to software and consumer product companies, to Internet giants—have recently agreed to settle Federal Trade Commission (FTC) charges that they falsely claimed compliance with the US-EU Safe Harbor, an international privacy framework.

Background

The US-EU Safe Harbor is a voluntary, simplified and cost-effective means for US entities to comply with European privacy regulations. The European Commission's Directive on Data Protection¹ prohibits the transfer of personal data to non-European Union countries that do not meet the European Union (EU) "adequacy" standard for privacy protection. The US-EU Safe Harbor framework, developed by the US Department of Commerce in consultation with the European Commission, is a voluntary, streamlined and cost-effective