Samenvatting

The transatlantic data transfer between the U.S. and the EU would have been extremely complex and expensive if the European Commission together with the U.S. Department of Commerce had not originated the Safe Harbor agreement in 2000. As recently as the beginning of 2014 the European Parliament, especially with input of the LIBE COM raised its concern about EU-U.S. data protection agreements, resulting in the call for the suspension of the Safe Harbor framework (APCO Forum, n.d.). The Safe Harbor deal enables U.S. organizations and companies to access personal data processed and stored in the EU in case they apply to "adequate" standards which mirror the ones of the EU. It was invented to build a bridge between the diverse EU - U.S. data protection approaches and to allow a continuous transatlantic data transfer. By the end of 2013, over 4.000 companies have joined the scheme, including Microsoft, Facebook and Amazon. This paper analyses the effectiveness and reliability of the scheme and tries to find out if the programme is able to ensure EU citizens' personal data effectively.

In Europe, data protection rules are based on Article 8 of the Charter of Fundamental Rights, Convention 108 and the Data Protection Directive of 1995. Directive 95/46/EC was established to further harmonize the data protection laws of its Member States and outlines the collection, storage, processing, use, and disclosure of an individual’s personal data. The “Adequacy Decision” of this Directive determines whether a third country can provide an adequate level of data protection, similar to the one of the EU. With the expertise of supervisory authorities, the EU decided that the U.S. legal regime has profound shortcomings and hence the country did not receive the “adequacy” status. The EU sees privacy and data protection as a fundamental right while the view of the U.S. includes the presumption that privacy is a commodity subject to the market.

The varied approaches of privacy and data protection standards of the EU and the U.S. combined with an ongoing debate about the reliability of the scheme and the mass surveillance activities of U.S. secret services resulted in an active discussion if the programme should be suspended or rather re-negotiated.


This paper reveals that three of the seven principles it is based on are violated on regular basis (the Principle of Notice, Choice, and Enforcement). Overall the scheme is utterly criticized because of its lack of transparency, the lack of enforcement bodies and actions and the obsolescence of the existing Data Protection Directive. Furthermore it has been identified that the actions of the U.S secret services violate the Principle of Proportionality of the EU Directive. The Federal Trade Commission on the other hand argues that "consumer privacy in the commercial sphere, and citizens' privacy in the face of government surveillance to protect national security, are two distinctly separate issues" (Brill, 2013). The think tank Future of Privacy points out that the EU should not limit or suspend the programme, because it would rather weaken EU citizens' personal privacy. They conclude that the elimination of the programme would not prevent the NSA from accessing the data of EU citizens.
In order to improve the existing programme, the report identified the following recommendations for the European Commission. The EC is, until now, the only institution which has the authorization to suspend, limit or reverse the adequacy decision and therefore also the Safe Harbor agreement.

First, the Directive has to be renewed, as the existing legislation is clearly out-of-date and does not face the challenges of the 21st century. Furthermore the definition of adequacy needs to be revised as the present definition is unclear and leads to misinterpretations. Thirdly, the EC should be informed when a company needed to apply to the exceptions of the principles in order to meet national security, public interest or law enforcement requirements. Moreover, the self-certification mechanism should be suspended, as it has been violated regularly. One next step to protect the personal data of EU citizens is more transparency as this has been criticized extensively since its foundation in 2000. Non-members should be identified instantly and certified companies should always state their privacy policies on their website. Moreover, strong enforcement bodies and actions shall be installed, as a lot of companies had made false claims about their compliance with the agreement. Those companies should be suspended immediately. Another method of improving the system is to install warning systems which will inform the EC if new government regulations have been installed in the U.S. that might affect compliance with the seven Safe Harbor Principles.

Nevertheless, the increasing debate about privacy can also be seen as a debate for a change and a time where the EU together with the U.S. can form a long-term solution in order to allow a transatlantic data transfer that "both protects privacy and promotes international economic growth" (Wolf, 2014, p.32). These recommendations may help to foster privacy principles throughout the whole world and may be a starting point of securing EU citizens’ data more effectively.