Privacy security

Safe Harbor is dead, long live Safe Harbor!

News broke late Tuesday that the United States and the European Union Commission have agreed upon a revised and updated version of the U.S.-EU Safe Harbor, providing a new framework for transfers of personal data from the EU to the U.S. The updated framework has been re-branded as the EU-U.S. "Privacy Shield". The framework potentially provides a mechanism to avoid a significant disruption in digital commerce.

This development came as a surprise to some, as it had appeared that an agreement would not be finalized close to the January 31, 2016 deadline set by the Article 29 Working Party, which represents Data Protection Authorities across all EU Member States. Following the European Court of Justice's decision invalidating the Safe Harbor[1], the Working Party indicated that coordinated regulatory enforcement against businesses relying on Safe Harbor to transfer personal data from the EU to the U.S. would not begin until January 31. Less surprising is that the agreement reached so far is only "in principle." While we have some indication of the key points agreed to at a high-level, the finalized framework is still some way off. Before taking effect, the new Privacy Shield will require additional steps in the U.S. to implement agreed upon regulatory and legislative changes and another EU Commission "adequacy decision"[2].