Adequacy of data protection in the USA: myths and facts

On 6 October 2015, the European Court of Justice (CJEU) invalidated a decision from 2000, wherein the Commission had granted an exception from the general prohibition regarding transfers of personal data outside the European Economic Area (EEA) (CJEU C-362/14, Schrems v Data Protection Commissioner 6 October 2015). Companies in the EEA were permitted to transfer personal data to US companies that had registered under the US Safe Harbor programme (Commission Decision 2000/520/EC, OJ L 215, 25 August 2000, 7). Data protection authorities in all EEA Member States retained their authority to suspend data transfers in case of concerns regarding the level of data protection in the USA, but never exercised this power, not even after Edward Snowden’s revelations in 2013. The CJEU judgment responded to questions from an Irish court regarding the dismissal of a complaint by the Irish Data Protection Commissioner who did not share the complainant’s concerns regarding the level of data protection in the USA. After the CJEU judgment, a number of myths started to establish themselves, including the following (for more details on the sources of myths and facts, see Determann, U.S.