Also known as: EU-US Safe Harbor · E.U. U.S. Safe Harbor · EU U.S. Safe Harbor · EU-US Safe Harbor Framework · Safe Harbor · EU-US data transfer agreement
Written by attorneys · grounded in primary & secondary sources — see below
A framework that reconciles differing privacy regimes by permitting U.S. businesses to receive personal data from the European Union after voluntarily certifying compliance with privacy principles drawn from the 1980 OECD Guidelines. The Federal Trade Commission administers the program and enforces the certifications.
Enigma Technologies maintains U.S. servers that will store customer records. Its EU subsidiary prepares to transfer personal data. The parent company files a self-certification with the FTC promising adherence to the Safe Harbor privacy principles. Once accepted, the transfer may proceed without violating European data-protection rules.
Enigma Technologies collects customer data in the United States and wants to receive records from its EU subsidiary. The company files a self-certification with the FTC promising adherence to the Safe Harbor privacy principles. Once the certification is accepted, the company may lawfully import the EU data without facing enforcement action under European data-protection rules.
Select any source to read its text and confirm it supports the definition.
A U.S. company joins by voluntarily certifying to the Federal Trade Commission that it will comply with the privacy principles derived from the 1980 OECD Guidelines. Once certified, the company may receive personal data transfers from the European Union.
Supporting sources
The Federal Trade Commission may bring an enforcement action for deceptive practices because the company has misrepresented its compliance. The certification is no longer effective and data transfers may be blocked.
Supporting sources
European privacy law generally prohibits transfers of personal data to countries lacking adequate protection. The Safe Harbor supplies a mechanism that allows transfers to the United States when companies commit to specified privacy standards.
Supporting sources