In early October, over 4,400 U.S. companies collectively held their breath in anticipation of a ruling from the Court of Justice of the European Union in the Schrems v. Irish Data Protection Commissioner (Case C-362/14) matter. This case would decide whether or not the data safe harbor agreement (DSHA) penned in 2000 and governing transfer and storage of personal data of EU citizens on U.S. servers was valid. It threatened to undo over a decade's worth of a data privacy framework that many companies, including multinational corporations, social media outlets and cloud providers, had relied upon when facilitating Trans-Atlantic business.

In an unprecedented decision issued Oct. 6, the EU court invalidated the DSHA, sending companies into uncharted waters as they now attempt to determine what the ruling means and what port they should now dock in to find “adequate protections” for this data that would comply with EU law.

What Was the Data Safe Harbor Agreement?

Ratified in July 2000, the DSHA allowed for the passage of personal information about EU individuals between the EU and the United States as a matter of commerce, as long as U.S. data custodians ensured adequate protection of such sensitive data. While those in the U.S. data security field often think of “personal data” as personally identifiable information (e.g., financial information) or personal health information (e.g., medical records), the EU has, historically, taken a much wider view, defining it as “any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.”

This would include such information as Google searches, Facebook posts, information on an individual's Netflix accounts, and a million other data points that many companies gather from their customers and sell.