What is the European Court of Justice Safe Harbour ruling?

The European Court of Justice has ruled that a 15-year-old agreement allowing companies to transfer personal information from servers within the European Union to servers in the United States is invalid.

‘US-EU Safe Harbour’ was the name given to the agreement between the EU and the US Department of Commerce which deemed that US privacy regulation offers a level of protection essentially equivalent to the protection guaranteed within the EU.

Safe Harbor allowed companies collecting personal information from individuals in the EU to transfer that information to the US for processing.

The reason for the Safe Harbour agreement was because of the difference between EU and US attitudes towards the protection of personal information.

In the EU, privacy is seen as a fundamental right, and privacy protections are rigorous. In the US, the privacy of individuals is seen as one of a number of competing priorities, e.g. national security and law enforcement efforts, vs. the public interest of privacy.

The specific problem for organisations was EU Directive 95/46/EC, which prohibited companies operating within the European Economic Area (EEA) from transferring personal information to any country outside the EEA, unless that country offered an “essentially equivalent” level of privacy protection. The Safe Harbour agreement was designed as a commercial solution to the restrictions imposed by this EU Directive.

Now that Safe Harbour has been invalidated, the 5000+ companies which had relied on the agreement to transfer data lawfully from Europe to the US have been forced to find alternative arrangements (such as “model contract clauses”) to allow information to be transferred across the Atlantic.