Enforcement and Reform of the EU-US Safe Harbor Agreement

Abstract

The Safe Harbor framework is a compromise agreement between two very different approaches to data protection and, as a result, it has many limitations. One of the main criticisms has been the lack of enforcement action against Safe Harbor members. The Safe Harbor is a self-regulatory scheme, so initial disputes are managed by the members themselves, or sometimes referred to third-party dispute resolution providers. However, the US Federal Trade Commission has been given a back-stop regulatory role for the Safe Harbor, and it has become the key enforcement agency for Safe Harbor compliance and unresolved disputes. This chapter examines the enforcement of Safe Harbor across the 15 years of its operation. There are four clear phases: 2000–2008, no action. 2009–2010, limited action on false claims 2011–2012, limited action on substantive non-compliance 2013–2015, new action on both false claims and non-compliance.