The European Court Of Justice Invalidates Safe Harbor

The European Court of Justice has just issued a decision (ECJ 6 October 2015 Case C-362/14, Maximillian Schrems v. Data Protection Commissioner) that invalidates the so-called US-EU "Safe Harbor" system. Suddenly, what 3,500 U.S. Companies (including some of the largest companies in the world) have been doing with personal data now potentially becomes illegal.

What is the background to this decision?

In 1995, the European Union adopted a Directive 95/46/EC aimed at providing a high level of protection of personal data throughout the European Union. According to Article 25 of said Directive, the transfer of personal outside the European Union is prohibited unless the receiving country has an adequate level of protection of personal data and the ECJ interprets this to mean "substantially equivalent" to European standards.

The European Commission was granted the authority to decide whether a particular non-EU country ensures an adequate level of protection "by reason of its domestic law or of the international commitments it has entered into." The Commission has so far recognized for example Argentina, Australia, Canada, Switzerland and New Zealand as providing adequate protection.

With respect to the United States, the European Commission entered into an Agreement called the "Safe Harbor" with the U.S. Department of Commerce based on self-certification. Under the US-EU "Safe Harbor," transfer of personal data from the EU to a US organization was lawful if the US organization receiving the data has unambiguously and publicly disclosed its commitment to comply with the "Safe Harbor Privacy Principles" as set out in the Commission Decision 2000/520/EC of 26 July 2000.

After the revelation by Edward Snowden of surveillance programs involving large-scale collection of personal data, the European Commission issued two Communications on 27 November 2013 (Communication (2013)846 "Rebuilding Trust in EU-US Data Flows" and Communication (2013)847 on the Functioning of the Safe Harbour from the Perspective of EU Citizens and Companies Established in the EU) in which it found:

that the United States authorities were able to access the personal data transferred from the Member States to the United States and process it in a way incompatible, in particular, with the purposes for which it was transferred, beyond what was strictly necessary and proportionate to the protection of national security.

The Commission also noted that "the data subjects had no...