The Data Safe Harbor Agreement

The Safe Harbor Pact was established in 2000 between the European Union (EU) and the United States (US). This allowed businesses to legally funnel info across the Atlantic. Common data storage and transfers are seen in global commerce, sending and receiving emails, and even posting on social media. US companies can “self-certify” that they meet the stricter European privacy standards.

In early October, the European Court of Justice found the US approach to domestic surveillance and absence of legislation governing certain privacy rights was not up to European standards making the Safe Harbor pact invalid. They believe the US has compromised the data of their citizens and would like for some changes to happen to ensure the US is not spying on their citizens.

The Safe Harbor Agreement 2.0

The European Union and the Unites States will be meeting on December 17^th to create a new agreement for the Safe Harbor. They plan to conclude this agreement in January 2016. As stated earlier the EU would like to see some changes in the new agreement such as:

• Privacy watchdogs to have more legal avenues to challenge firms’ handling data
• European citizens will complain directly to national authorities about data protection

What Does an Invalid Ruling of Safe Harbor Mean?

In early October the European Union has ruled the Safe Harbor Pact invalid. This affects businesses and consumers from both the European Union and United States. Over 4,000 companies rely on the Safe Harbor for their data transfers which also affects an consumers using these companies services. Some large companies whom use the Safe Harbor Agreement rules are:

• Facebook
• Google
• Microsoft
• Adobe
• WeightWatchers

Effects on Companies:

Any company that has offices both in US and EU, any outsourced work between the countries, or even any information between EU and US are affected.

Many companies relied on the Safe Harbor “Self Certify” will now have to independently verify to meet standards to transfer data.

In Europe, default EU standards from 1995 is now used to determine whether a company’s data sharing is permissible. EU operates under the Data Protection Directive, which states citizens “personal data” cannot be transferred to a country that does not offer “adequate” protection for personal data.

Since the US is not considered to offer adequate protection this adds an extra level of difficulty.

For More Information: With Safe Harbor now “Invalid,” Companies Must Change Data Practices

Effects on Consumers:

Consumer’s internet they know today will be greatly affected. Many large companies, which rely on the Safe Harbor agreement rules, provide services to consumers. The services that will be affected include:

• Global commerce
• Sending and receiving emails
• Social media

Microsoft’s Solution

Microsoft has stated they will be storing data in a German company, Deutche Telkom, for their European cloud computing customers. Microsoft will not be able to access the data without permission of either the customer or the company. This is their solution of satisfying the customers’ privacy concerns after the invalid ruling of the Safe Harbor.

For a lot of companies this solution is too expensive. The US has started offering customers and partners the opportunity to enter into ‘data processing addendums’. This is supposed to incorporate the Commission approved Standard Contractual Clauses (SCC) but is only considered a quick fix. Many companies are waiting the result of the new Safe Harbor agreement that will conclude in January 2016.