Dear Sirs,

On 6 October 2015, the Court of Justice of the European Union (CJEU) ruled that the European Commission’s decision of 26 July 2000, under which US companies holding the Safe Harbor certificate were deemed to warrant an adequate level of personal data protection (compliant with EU laws), was invalid. 

The invalidated decision enabled data transfers to Safe Harbor participants as if they were situated in the EU.

The CJEU judgment means in practice that entities based in the EU should verify their existing basis for data transfers to the USA urgently as well as ensuring in many cases that data are transferred on a basis other than participation of the American recipient in the Safe Harbor program.