A group of leading EU data protection officials has signaled that the recent European Court of Justice (“ECJ”) decision invalidating the U.S.-EU Safe Harbor may require companies in Europe to stop transferring personal data to the United States altogether, at least without the consent of the data subjects. On October 16, the Article 29 Working Party issued a remarkable statement suggesting that legal mechanisms relied on by many companies for years as the basis for transferring personal data from the EU to the United States ? in particular, EU-approved model contract clauses or “binding corporate rules” (BCRs) ? may no longer be good enough because U.S. law is insufficiently protective of privacy. It further said that at the end of January 2016, EU data protection authorities may begin investigating data transfers to the United States predicated on such mechanisms, and could deem them unlawful.