U.S. Companies Not Complying with E.U. Safe Harbor Rules

Information Management Journal, Jan/Feb 2005 by Swartz, Nikki

The European Commission says American companies are not complying with the Safe Harbor Agreement that it negotiated with the United States in 2001. More than 400 U.S. companies have signed onto the Safe Harbor Agreement indicating that they would provide "adequate" safety for E.U. citizens' personally identifiable information. The working document states that U.S. companies "seem to have difficulties in correctly translating Safe Harbor principles into data-processing policies."

The E.U. privacy directive was passed in 1995 and governs the rules for companies that conduct business in the European Union and handle personally identifiable information. The agreement was negotiated between the United States and the European Union as a compromise for American companies that handle sensitive data from European citizens. The U.S. Department of Commerce is responsible for certifying U.S. company compliance.

"Most companies, according to what I interpreted from this commission staff working document, tried to avoid compliance in any possible way and exploit loopholes of the Safe Harbor," said Cedric Laurant of the Electronic Privacy Information Center (EPIC). "And although they're...compliant with the letter of Safe Harbor, they haven't complied with the spirit."

The European Commission working report says that U.S. regulatory agencies such as the Department of Commerce and the Federal Trade Commission are being lax in enforcing Safe Harbor.

The commission report does not call for ending Safe Harbor but does recommend that U.S. regulators improve their enforcement efforts.