The “Safe Harbor” judgment of the European Court of Justice (“ECJ”) – Practical impacts

The transmission of personal data to a third country outside of the EU is only permissible under European law if the third country in question guarantees an appropriate level of protection for this data. In its Safe Harbor decision, the EU Commission determined that the USA did offer an appropriate level of protection due to the “Safe Harbor” regulations.

In its judgment dated 6 October 2015, the ECJ declared this Safe Harbor decision of the EU Commission to be invalid, inter alia, since the “Safe Harbor” regulations (i) are only valid for US companies on a voluntary basis but not for agencies and (ii) would cease to have any effect in case these protective regulations are in conflict with the requirements of US national security, public interest, or the execution of US laws.

With this judgment, the USA loses its status as a country with an appropriate level of protection with immediate effect. Therefore, in individual cases, companies may conclude “EU standard contract clauses” which the EU Commission has adopted for various situations, before personal data will be transmitted into the USA. Additionally, it is advisable to observe the recommendations of the competent state data protection commissioner, if available.

Peter Homberg is lawyer and partner at Dentons in Frankfurt/Germany and heads the German Life Sciences Practice. He focuses on IP transactions, R&D agreements, M&A projects, compliance and financing.

Dentons Europe LLP, Thurn-und-Taxis-Platz 6, 60313 Frankfurt am Main, Germany E-mail:

Peter can be contacted on +49 69 45 00 12 311 or by email at peter.homberg@dentons.com