International Safe Harbor Privacy Principles

From Wikipedia, the free encyclopedia
  (Redirected from US-EU Safe Harbor)
Jump to: navigation, search

The international Safe Harbor Privacy Principles or Safe Harbour Privacy Principles are principles which enable some US companies to comply with privacy laws protecting European Union and Swiss citizens. US companies storing customer data may self-certify that they adhere to 7 principles, to comply with the EU Data Protection Directive and with Swiss requirements. The US Department of Commerce developed privacy frameworks in conjunction with both the European Union and the Federal Data Protection and Information Commissioner of Switzerland.[1]

Within the context of a series of decisions on the adequacy of the protection of personal data transferred to other countries,[2] the European Commission made a decision in 2000 that the United States' principles complied with the EU Directive - the so-called "Safe Harbour Decision".[3] However, after a customer complained that his Facebook data were insufficiently protected, the European Court of Justice declared in October 2015 that the Safe Harbour Decision was invalid, leading to further talks being held by the Commission with the US authorities towards "a renewed and sound framework for transatlantic data flows".[4]

On 2nd February 2016 the Commission presented its new attempt to comply with the court's decision before the EU Data Protection Supervisors might interrupt EU/US data flows. MEP Jan-Philipp Albrecht and Max Schrems criticized the new ruling with the latter predicting the Commission might be taking a "round-trip to Luxembourg” where the court is located.[5] EU Commissioner for Consumers, Vera Jourova, expressed confidence that a deal would be reached by the end of February.[6] Many Europeans are demanding a mechanism for individual European citizens to lodge complaints over the use of their data, as well as a transparency scheme to assure that European citizens data does not fall into the hands of U.S intelligence agencies.[7] The Article 29 Working Party has taken up this demand, and stated it will hold back another month until March 2016 to decide on consequences of Commissioner Jourova's new proposal. [8] The European Commission’s Director for Fundamental Rights Paul Nemitz stated at a conference in Brussels in January how the Commission would decide on the "adequacy" of data protection. [9] The Economist newspaper predicts that "once the Commission has issued a beefed-up 'adequacy decision', it will be harder for the ECJ to strike it down." [10] Privacy activist Joe McNamee summed up the situation by noting the Commission has announced agreements prematurely, thus forfeiting its negotiating right.[11]

Background history[edit]

In 1980, the OECD issued recommendations for protection of personal data in the form of 7 principles. These were non-binding and in 1995, the European Union (EU) enacted a law to protect personal data privacy in form of the Data Protection Directive[12][citation needed]

According to the Data Protection Directive, companies operating in the European Union are not permitted to send personal data to "third countries" outside the European Economic Area, unless they guarantee adequate levels of protection, "the data subject himself agrees to the transfer" or "if Binding corporate rules or Standard Contractual Clauses have been authorised."[13] The latter means that privacy protection can be at an organizational level, where a multinational organization produces and documents its internal controls on personal data or they can be at the level of a country if its laws are considered to offer protection equal to the EU.

The Safe Harbour Privacy Principles were developed between 1998-2000. They were designed to prevent private organizations within the European Union or United States which store customer data from accidentally disclosing or losing personal information. US companies could opt into a program and be certified if they adhered to seven principles and 15 frequently asked questions and answers per the Directive.[14] In July 2000, the European Commission (EC) decided that US companies complying with the principles and registering their certification that they met the EU requirements, the so-called "safe harbour scheme", were allowed to transfer data from the EU to the US. This is referred to as the Safe Harbour Decision.[15]

On 6 October 2015, the European Court of Justice invalidated the EC's Safe Harbour Decision, because "legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life" (boldened in original text).[16]:2-3


The seven principles from 2000 are:[15]

  • Notice - Individuals must be informed that their data is being collected and about how it will be used.They must provide information about how individuals can contact the organization with any inquiries or complaints.
  • Choice - Individuals must have the option to opt out of the collection and forward transfer of the data to third parties.
  • Onward Transfer - Transfers of data to third parties may only occur to other organizations that follow adequate data protection principles.
  • Security - Reasonable efforts must be made to prevent loss of collected information.
  • Data Integrity - Data must be relevant and reliable for the purpose it was collected for.
  • Access - Individuals must be able to access information held about them, and correct or delete it if it is inaccurate.
  • Enforcement - There must be effective means of enforcing these rules.

Scope, certification and enforcement[edit]

Only U.S. organizations regulated by the Federal Trade Commission or the Department of Transportation may participate in this voluntary program. This excludes many financial institutions, (such as banks, investment houses, credit unions, and savings & loans institutions), telecommunication common carriers, including internet service providers, labor associations, non-profit organizations, agricultural co-operatives, and meat processors, journalists and most insurances.[17] although it may include investment banks per [18]

After opting in, an organization must have appropriate employee training and an effective dispute mechanism in place, and self re-certify every 12 months in writing that it agrees to adhere to the U.S.-EU Safe Harbor Framework's principles, including notice, choice, access, and enforcement.[19] It can either perform a self-assessment to verify that it complies with the principles, or hire a third-party to perform the assessment. Companies pay an annual $100 fee for registration except for first time registration ($200)[20]

The U.S. government does not regulate Safe Harbor, which is self-regulated through its private sector members and the dispute resolution entities they pick. The Federal Trade Commission "manages" the system under the oversight of the U.S. Department of Commerce.[21]to comply with the commitments can be penalized under the Federal Trade Commission Act by administrative orders and civil penalties of up to $16,000 per day for violations. If an organization fails to comply with the framework it must promptly notify the Department of Commerce, or else it can be prosecuted under the 'False Statements Act'.[19]

In a 2011 case, the Federal Trade Commission obtained a consent decree from a California-based online retailer that had sold exclusively to customers in the United Kingdom. Among its many alleged deceptive practices was representing itself as having self-certified under Safe Harbour when in fact it had not. It was barred from doing so in the future.[22]

Criticism and evaluation[edit]

EU evaluations[edit]

The EU-US Safe Harbour Principles 'self certification scheme' has been criticised in regard to their compliance and enforcement in three external EU evaluations:

  • A 2002 review by the European Union found "a substantial number of organisations that have self-certified adherence to the Safe Harbour do not seem to be observing the expected degree of transparency as regards their overall commitment or as regards the contents of their privacy policies" and that "not all dispute resolution mechanisms have indicated publicly their intention to enforce Safe Harbour rules and not all have in place privacy practices applicable to themselves."[23]
  • 2004 review by the European Union: [24]
  • In 2008, an Australian consulting company named Galexia issued a scathing review, finding "the ability of the US to protect privacy through self-regulation, backed by claimed regulator oversight was questionable'. They documented basic claims as incorrect where only 1109 out of 1597 recorded organisations listed by the US Department of Commerce on 17 October 2008 remained in the database after doubles, triples and ‘not current’ organisations were removed. Only 348 organisations met even the most basic requirements for compliance. Of these, only 54 extended their Safe Harbor membership to all data categories (manual, offline, online, human resources). 206 organisations falsely claimed to be members for years, yet there was no indication that they were subject of any US enforcement. Reviewers criticized the DOC's 'Safe Harbor Certification Mark' offered to companies to use as a "visual manifestation of the organization when it self-certifies that it will comply" as misleading, because it does not carry the words "self certify" on it. Only 900 organizations provided a link to their privacy policies, for 421 it was unavailable. Numerous policies were only 1-3 sentences long, containing "virtually no information". Many entries appeared to confuse privacy compliance with security compliance and showed a "lack of understanding about the Safe Harbor program". The companies' listing of their dispute resolution providers was confusing, and problems regarding independence and affordability were noted. Many organisations did not spell out that they would cooperate with or explain to their customers that they could choose the dispute resolution panel established by the EU Data Protection Authorities.
Galexia recommended the EU to re-negotiate the Safe Harbor arrangement, provide warnings to EU consumers and consider to comprehensively review all list entries. They recommended to the US to investigate the hundreds of organisations making false claims, revising its statements about the number of participants, to abandon the use of the Safe Harbor Certification Mark, to investigate the unauthorised and misleading use of its Departmental logo and automatically suspend an organisation’s membership if they failed to renew their Safe Harbor certification.[25]

Patriot Act's reach[edit]

In June 2011, Microsoft U.K.'s managing director Gordon Frazer said that "cloud data, regardless of where it is in the world, is not protected against the Patriot Act."[26]

The Netherlands promptly ruled out U.S. cloud suppliers from Dutch government contracts, and even considered a ban on Microsoft- and Google- provided cloud contracts. A Dutch subsidiary of the U.S. based Computer Sciences Corporation (CSC) runs the electronic health records of the Dutch national health service system and warned, that unless CSC could assure it was not subject to the Patriot Act, it would end the contract.[27]

One year later in 2012, a legal research paper supported the notion that the Patriot Act allowed U.S. law enforcement to bypass European privacy laws.[27]

Citizen complaint about Facebook data safety[edit]

In October 2015, the European Court of Justice (ECJ), responded to a referral from the High Court of Ireland in relation to a complaint from Austrian citizen Maximillian Schrems regarding Facebook's processing of his personal data from its Irish subsidiary to servers in the US. Schrems complained that "in the light of the revelations made in 2013 by Edward Snowden concerning the activities of the United States intelligence services (in particular the National Security Agency (‘the NSA’)), the law and practice of the United States do not offer sufficient protection against surveillance by the public authorities." The ECJ held the Safe Harbour Principles to be invalid, as they did not require all organizations entitled to work with EU privacy-related data to comply with it, thus providing insufficient guarantees. US federal government agencies could use personal data under US law, but were not required to opt in. The court held that companies opting in were "bound to disregard, without limitation, the protective rules laid down by that scheme where they conflict with national security, public interest and law enforcement requirements."[16]

In accordance with the EU rules for referral to the ECJ for a 'preliminary ruling', the Irish Data Protection Commissioner since then has had to "...examine Mr. Schrems' case 'with all due diligence' and [...] decide whether [...] the transfer of Facebook's European subscribers' personal data to the United States should be suspended."[16] EU regulators said that if the ECJ and United States did not negotiate a new system within three months, businesses might face action from European privacy regulators. On October 29, 2015, a new "Safe Harbour 2.0" agreement appeared close to being finalized.[28] However Commissioner Jourova expects the U.S. to act next. [29]

A major U.S. daily supra-regional newspaper played down the importance of the decision. [30] However American NGOs were quick to expand on the significance of the decision. [31]

See also[edit]


  1. ^ Welcome to the U.S.-Swiss Safe Harbor accessed 1 November 2015
  2. ^ decisions on the adequacy of the protection of personal data in third countries accessed 1 November 2015
  3. ^ [ 2000/520/EC: Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce (notified under document number C(2000) 2441) accessed 1 November 2015
  4. ^ Vera Jourova, "Commissioner Jourová's remarks on Safe Harbour EU Court of Justice judgement before the Committee on Civil Liberties, Justice and Home Affairs (LIBE)", 26 October 2015
  5. ^ Max Schrems: “EU US Privacy Shield” (Safe Harbor 1.1) “European Commission may be issuing a round-trip to Luxembourg” [1] 16:45 (2nd Feb. 2016), PDF retrieved 3rd Feb. 2016
  6. ^ "Jourová: The new EU-US bridge [INTERVIEW]". New Europe. Retrieved 2016-02-03. 
  7. ^ Lomas, Natasha. "EU-US Data Transfers Won’t Be Blocked While Privacy Shield Details Are Hammered Out, Says WP29". TechCrunch. Retrieved 2016-02-03. 
  8. ^ Statement on the consequences of the Schrems judgement [2] (2nd Feb. 2016), PDF retrieved 6th Feb. 2016
  9. ^ Bracy, Jedidiah. "New data transfer deal could come by Monday, 2015-01-28". The Privacy Advisor. Retrieved 2016-02-03. 
  10. ^ "Charlemagne: "Swords and shields". America and the European Union have reached a deal on data protection, Feb 6th 2016". The Economist. Retrieved 2016-02-08. 
  11. ^ "What’s behind the shield? Unspinning the “privacy shield” spin, Feb 2nd 2016". European Digital Rights initiative (EDRi). Retrieved 2016-02-10. 
  12. ^ Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
  13. ^ European Comission (15 June 2001)Commission Decision 2001/497/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries under Directive 95/46/EC15 June 2001, Official Journal L 181 of 04.07.2001.
  14. ^ "U.S.-EU Safe Harbor Framework Documents". US government. Archived from the original on 10 Sep 2015. 
  15. ^ a b European Court of Justice 2000/520/EC: Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce (notified under document number C(2000) 2441) (Text with EEA relevance.) 25 August 2000, retrieved 30 October 2015
  16. ^ a b c "Judgment in Case C-362/14 Maximillian Schrems v Data Protection Commissioner: The Court of Justice declares that the Commission’s US Safe Harbour Decision is invalid" (press release) (Press release). Court of Justice of the European Union. 6 October 2015. p. 3. Retrieved 7 October 2015. 
  17. ^ U.S. Department of Commerce Welcome to the U.S.-EU & U.S.-Swiss Safe Harbor Frameworks 9 October 2015, retrieved 30 October 2015
  18. ^ U.S. Department of Commerce FAQ - Investment banking and audits 29 January 2009, retrieved 30 October 2015
  19. ^ a b U.S. Department of Commerce U.S.-EU Safe Harbor Overview, 18 December 2013, retrieved 30 October 2015
  20. ^ U.S. Department of Commerce Safe Harbor Fees 9 April 2015, retrieved 30 October 2015
  21. ^ Zach Whittaker Safe Harbor: Why EU data needs 'protecting' from US law Failure Zdnet, 25 April 2011
  22. ^ Staff writer (June 9, 2011). "FTC Settlement Bans Online U.S. Electronics Retailer from Deceiving Consumers with Foreign Website Names" (Press release). Washington. Federal Trade Commission. Retrieved March 5, 2015. 
  23. ^ European Commission (2002) The application of Commission Decision on the adequate protection of personal data provided by the Safe Harbour Privacy Principles 11 pages, retrieved 30 October 2015
  24. ^ European Commission (2004) The implementation of Commission Decision on the adequate protection of personal data provided by the Safe Harbour Privacy Principles 11 pages, retrieved 30 October 2015
  25. ^ Chris Connolly (Galexia) US Safe Harbor - Fact or Fiction? Privacy Laws and Business International, issue 96, December 2008, published on, retrieved 30 October 2015
  26. ^ Zack Whittaker, Microsoft admits Patriot Act can access EU-based cloud data, June 28, 2011, retrieved 30 October 2015
  27. ^ a b Zack Whittaker, Patriot Act can "obtain" data in Europe, researchers say CBS News December 4, 2012
  28. ^ Georgina Prodhan (October 29, 2015). "U.S. sees new EU data-sharing pact within reach". Reuters. Retrieved 30 October 2015. 
  29. ^ Peter Sayer (November 6, 2015). "E.U. tells U.S. it must make next move on new Safe Harbor deal, Nov. 6, 2015". Computerworld. Retrieved 9 November 2015. 
  30. ^ New York Times editorial board (October 9, 2015). "European Ruling is Merely a Symbolic Victory for Privacy". New York Times. Retrieved 13 November 2015. 
  31. ^ NGOs (October 13, 2015). "Digital Privacy, in the U.S. and Europe". New York Times. Retrieved 13 November 2015. 

External links[edit]