Privacy Map

European Union. Data localisation / cross-border. Commission Decision (adequacy)

EU–US Safe HarbourCommission Decision 2000/520/EC on the adequacy of the Safe Harbour privacy principles

Repealed/superseded

§1Summary

Synopsis

Decision 2000/520/EC found, under Article 25 of Directive 95/46/EC, that US organisations adhering to the Safe Harbour privacy principles and the related frequently asked questions issued by the US Department of Commerce provided adequate protection. US companies self-certified to the Department of Commerce, and EU personal data could then be transferred to them without further safeguards. The Court of Justice declared the Decision invalid on 6 October 2015 in Schrems (C-362/14).

Key themes
  • adequacy
  • transfers to the US
  • self-certification
  • seven privacy principles
Unique features

A self-certification scheme, not a US statute. Only organisations under the jurisdiction of the Federal Trade Commission or the Department of Transportation could join.

SaaS relevance

Historical only; invalidated in 2015 and replaced by the EU–US Privacy Shield, then by the EU–US Data Privacy Framework.

§2Obligations

Extraterritorial
Applied to US organisations that self-certified
Breach notification
None
DPO
No
Cross-border transfers
Allowed transfers to self-certified US organisations
Maximum penalty
None

§3Dates

Key dates
  • Adopted
  • In force
  • Ended
  • Adopted 26 July 2000; published 25 August 2000; Member States to comply within 90 days of notification; the Commission's 2013 Communication dates the 'establishment of Safe Harbour' to 2000; declared invalid by the Court of Justice on 6 October 2015 (Schrems, Case C-362/14)

§4Text and authority

Text
Authority
European Commission; US Department of Commerce and Federal Trade Commission administered the US side

§5Where it applies

Also applies in

§6Sources and verification

Sources consulted
Verification

High confidence.

date_in_force is the year only. No official source read gives the exact start: Article 5 gives Member States 90 days from notification (notification date not found), and COM(2013) 847 refers only to 'the establishment of Safe Harbour in 2000'. The Commission staff working documents of 2002 and 2004 could not be retrieved from publications.europa.eu. End date confirmed from the judgment: Schrems (C-362/14), Grand Chamber, 6 October 2015, operative part: 'Decision 2000/520 is invalid'.