Articles

Transfers of German data to the US under the Safe Harbor regime could soon be fiction.  Following a decision of 28/29 April 2010 issued by the German data protection authorities for the private sector (the so called "Düsseldorfer Kreis"), German data controllers will now be required to perform a number of basic checks before transferring personal data to a US company which claims Safe Harbor certification.

As a minimum, data controllers must check (i) when the US company self-certified, and (ii) how the US company notifies data subjects of its data processing activities. They must then document this check and be in a position to provide evidence to the relevant data protection authority upon request.

Where there is any doubt over the US company's compliance with Safe Harbor, data exporters are recommended to use the EU model clauses or Binding Corporate Rules and inform their authority about their doubts.

The decision is a (late) reaction to the Galexia report "The US Safe Harbor / Fact or Fiction?" of 12 December 2008 which raised concerns that many aspects of the Safe Harbor framework were not working. The decision will continue to apply as long as comprehensive controls of US companies' self-certification under Safe Harbor are not guaranteed either by European or US authorities.

Following this decision, there is now a risk for German data exporters that merely rely on the apparent Safe Harbor certification of a US data importer. As the German authorities appear to prefer the use of EU model clauses or Binding Corporate Rules, they may take more interest in data exports based on Safe Harbor.

Going forward, the decision creates legal uncertainty for data exporters over when a minimum check is sufficient and when a more comprehensive check would be required.

The decision sets a trend towards greater questioning of the value of a Safe Harbor certification in Germany and casts doubt on the popularity of the regime in the future.