Key takeaways

• The Court of Justice of the European Union today invalidated the European Commission’s decision endorsing the EU-US Safe Harbour protocol.
• Thus, one of the ways in which personal data may be transferred from countries within the EU to the United States in conformity with the EU Data Protection Directive 95/46/EG may be no longer available. There may still be other ways of effecting safe transfers available such as binding corporate rules and data transfer agreements in EU format.
• Companies that transfer data from the EU to the United States should review existing or planned transfer arrangements to determine whether they conform to safe transfer requirements under EU and Member States’ data protection laws.