The International Safe Harbor Privacy Principles or Safe Harbour Privacy Principles were principles developed between 1998 and 2000 in order to prevent private organizations within the European Union or United States which store customer data from accidentally disclosing or losing personal information. They were overturned on October 6, 2015, by the European Court of Justice (ECJ), which enabled some US companies to comply with privacy laws protecting European Union and Swiss citizens. US companies storing customer data could self-certify that they adhered to 7 principles, to comply with the EU Data Protection Directive and with Swiss requirements. The US Department of Commerce developed privacy frameworks in conjunction with both the European Union and the Federal Data Protection and Information Commissioner of Switzerland.Welcome to the U.S.-Swiss Safe Harbor accessed 1 November 2015
Within the context of a series of decisions on the adequacy of the protection of personal data transferred to other countries,Commission decisions on the adequacy of the protection of personal data in third countries accessed 1 November 2015 the European Commission made a decision in 2000 that the United States' principles did comply with the EU Directive2000/520/EC: Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce (notified under document number C(2000) 2441), accessed 1 November 2015 – the so-called Safe Harbor decision.statement of the Data Protection Working Party on the EU US Privacy Shield, additional text. However, after a customer complained that his Facebook data were insufficiently protected, the ECJ declared in October 2015 that the Safe Harbor decision was invalid, leading to further talks being held by the commission with the US authorities towards "a renewed and sound framework for transatlantic data flows".Vera Jourova, "Commissioner Jourová's remarks on Safe Harbour EU Court of Justice judgement before the Committee on Civil Liberties, Justice and Home Affairs (LIBE)", 26 October 2015
The European Commission and the United States agreed to establish a new framework for transatlantic data flows on 2 February 2016, known as the "EU–US Privacy Shield",The new transatlantic data “Privacy Shield”, accessed 25 February 2016 which was closely followed by the Swiss-US Privacy Shield Framework.
Background history In 1980, the OECD issued recommendations for protection of personal data in the form of eight principles. These were non-binding and in 1995, the European Union (EU) enacted a more binding form of governance, i.e. legislation, to protect personal data privacy in the form of the Data Protection Directive.Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
According to the Data Protection Directive, companies operating in the European Union are not permitted to send personal data to "third countries" outside the European Economic Area, unless they guarantee adequate levels of protection, "the data subject himself agrees to the transfer" or "if Binding Corporate Rules or Standard Contractual Clauses have been authorised."European Commission (15 June 2001)Commission Decision 2001/497/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries under Directive 95/46/EC15 June 2001, Official Journal L 181 of 04.07.2001. The latter means that privacy protection can be at an organizational level, where a multinational organization produces and documents its internal controls on personal data or they can be at the level of a country if its laws are considered to offer protection equal to the EU.
The Safe Harbor Privacy Principles were developed between 1998 and 2000. Key player was the Art. 29 Working Party, at that time chaired by the Italian Data Protection Authority. President Prof. Stefano Rodotà, one of the fathers of the privacy framework in Europe, helped by the Italian Data Protection Authority Secretary General Mr. Giovanni Buttarelli, lately appointed as European Data Protection Supervisor (EDPS). Safe Harbor Principles were designed to prevent private organizations within the European Union or United States which store customer data from accidentally disclosing or losing personal information. US companies could opt into a program and be certified if they adhered to seven principles and 15 frequently asked questions and answers per the Directive. In July 2000, the European Commission (EC) decided that US companies complying with the principles and registering their certification that they met the EU requirements, the so-called "safe harbor scheme", were allowed to transfer data from the EU to the US. This is referred to as the Safe Harbor decision.European Court of Justice 2000/520/EC: Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce (notified under document number C(2000) 2441) (Text with EEA relevance.) 25 August 2000, retrieved 30 October 2015
On 6 October 2015, the European Court of Justice invalidated the EC's Safe Harbor Decision, because "legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life" .
According to the European Commission, the EU–US Privacy Shield agreed on 2 February 2016 "reflects the requirements set out by the European Court of Justice in its ruling on 6 October 2015, which declared the old Safe Harbor framework invalid. The new arrangement will provide stronger obligations on companies in the US to protect the personal data of Europeans and stronger monitoring and enforcement by the US Department of Commerce and Federal Trade Commission, including through increased cooperation with European Data Protection Authorities. The new arrangement includes commitments by the US that possibilities under US law for public authorities to access personal data transferred under the new arrangement will be subject to clear conditions, limitations and oversight, preventing generalised access. Europeans will have the possibility to raise any enquiry or complaint in this context with a dedicated new Ombudsperson".EU Commission and United States agree on new framework for transatlantic data flows: EU-US Privacy Shield, issued 2 February 2016
Principles The seven principles from 2000 are: Notice – Individuals must be informed that their data is being collected and how it will be used. The organization must provide information about how individuals can contact the organization with any inquiries or complaints. Choice – Individuals must have the option to opt out of the collection and forward transfer of the data to third parties. Onward Transfer – Transfers of data to third parties may only occur to other organizations that follow adequate data protection principles. Security – Reasonable efforts must be made to prevent loss of collected information. Data Integrity – Data must be relevant and reliable for the purpose it was collected. Access – Individuals must be able to access information held about them, and correct or delete it, if it is inaccurate. Enforcement – There must be effective means of enforcing these rules.
Scope, certification and enforcement Only US organizations regulated by the Federal Trade Commission or the Department of Transportation may participate in this voluntary program. This excludes many financial institutions (such as banks, investment houses, credit unions, and savings & loans institutions), telecommunication common carriers (including internet service providers), labor associations, non-profit organizations, agricultural co-operatives, and meat processors, journalists and most insurances,U.S. Department of Commerce Welcome to the U.S.-EU & U.S.-Swiss Safe Harbor Frameworks 9 October 2015, retrieved 30 October 2015 although it may include investment banks.U.S. Department of Commerce FAQ – Investment banking and audits 29 January 2009, retrieved 30 October 2015
After opting in, an organization must have appropriate employee training and an effective dispute mechanism in place, and self re-certify every twelve months in writing that it agrees to adhere to the EU–US Safe Harbor Framework's principles, including notice, choice, access, and enforcement.U.S. Department of Commerce U.S.–EU Safe Harbor Overview, 18 December 2013, retrieved 30 October 2015 It can either perform a self-assessment to verify that it complies with the principles, or hire a third-party to perform the assessment. Companies pay an annual $100 fee for registration except for first time registration ($200).U.S. Department of Commerce Safe Harbor Fees 9 April 2015, retrieved 30 October 2015
The US government does not regulate Safe Harbor, which is self-regulated through its private sector members and the dispute resolution entities they pick. The Federal Trade Commission "manages" the system under the oversight of the US Department of Commerce.Zach Whittaker Safe Harbor: Why EU data needs 'protecting' from US law Failure Zdnet, 25 April 2011 To comply with the commitments, violators can be penalized under the Federal Trade Commission Act by administrative orders and civil penalties of up to $16,000 per day for violations. If an organization fails to comply with the framework it must promptly notify the Department of Commerce, or else it can be prosecuted under the False Statements Act.
In a 2011 case, the Federal Trade Commission obtained a consent decree from a California-based online retailer that had sold exclusively to customers in the United Kingdom. Among its many alleged deceptive practices was representing itself as having self-certified under Safe Harbor when in fact it had not. It was barred from using such deceptive practices in the future.
Criticism and evaluation EU evaluations The EU–US Safe Harbor Principles 'self certification scheme' has been criticised in regard to its compliance and enforcement in three external EU evaluations:
A 2002 review by the European Union found "a substantial number of organisations that have self-certified adherence to the Safe Harbor do not seem to be observing the expected degree of transparency as regards their overall commitment or as regards the contents of their privacy policies" and that "not all dispute resolution mechanisms have indicated publicly their intention to enforce Safe Harbor rules and not all have in place privacy practices applicable to themselves."European Commission (2002) The application of Commission Decision on the adequate protection of personal data provided by the Safe Harbour Privacy Principles 11 pages, retrieved 30 October 2015 2004 review by the European Union:European Commission (2004) The implementation of Commission Decision on the adequate protection of personal data provided by the Safe Harbour Privacy Principles 11 pages, retrieved 30 October 2015