Trouble Brewing For International Data Transfers Under U.S. - EU Safe Harbor

Today the EU threw a huge wrench into one of the ways that personal data goes back and forth between EU countries and the U.S., as reported in Mintz Levin's Privacy and Security Matters Blog. Companies that currently rely on the U.S.-EU Safe Harbor Program – as  many in the health care industry do – need to think carefully and quickly about a back-up plan for these data transfers.

The relevant EU privacy protections apply to more than just PHI covered by HIPAA, and include protections for basic personal information typically found in employee and business records. The EU has questioned the adequacy of legal privacy protections offered by the U.S, and, since 2000, many companies have relied on the Safe Harbor certification to demonstrate compliance with EU standards. But earlier today a European Court of Justice Advocate General issued an opinion calling the Safe Harbor Program into question, resulting in a very high risk that it will be invalidated by the ECJ.