European Court of Justice Invalidates Safe Harbor Agreement

On October 6th, the European Court of Justice declared the Safe Harbor data-transfer agreement between the United States and the European Union to be invalid. Safe Harbor established a framework for U.S. companies to transfer personal data of European citizens to the U.S. without violating European privacy rules. The Court’s ruling does not order an immediate end to Safe Harbor transfers, but gives national regulators the right and the duty to investigate such transfers and suspend them if the regulator determines they do not provide sufficient privacy protections. This enhanced role for national data protection authorities creates the potential for significant inconsistencies in the approach of EU member states to international data transfers.

U.S. Secretary of Commerce Penny Pritzker faulted the European Court’s opinion because it “creates significant uncertainty for both U.S. and EU companies and consumers, and puts at risk the thriving transatlantic digital economy.” She explained that the “decision necessitates release of the updated Safe Harbor Framework as soon as possible,” and promised that the U.S. is “prepared to work with the European Commission to address uncertainty created by the court decision.”