Safe Harbor

Dec 21, 20222 min read

Safe-Harbor was the first decision made by the EU Commission in 2000 that allowed EU companies to transfer personal data from a European Union country to the U.S. in compliance with EU data protection legislation: a transfer tool. Such a tool was deemed necessary as it is not permitted to transfer personal data to third countries whose data protection does not have a level of protection comparable to that in the EU. The US is such a country. At the same time, a complete standstill of data transfers between such interconnected economies was – and is – not desirable.

To this end, the EU permitted data transfers to US companies that agreed to comply with the Safe Harbor principles:

  • Notice – data subjects must be regarding the processing of their data.
  • Choice – data subjects must have the option to opt-out.
  • Onward Transfer – onward transfers of personal data are only permitted to recipients that follow adequate data protection principles.
  • Security – reasonable efforts must be made to prevent the loss of personal information.
  • Data Integrity – personal data must be relevant and reliable for the underlying purpose of processing.
  • Access – data subjects must be able to access and correct their personal data.
  • Enforcement – data subjects must be able must be given effective means of enforcing these rules.

Safe Harbor was declared invalid by the European Court of Justice (ECJ) in the Schrems I judgment.