On October 6, the European Court of Justice (ECJ) ruled that the Safe Harbor Framework fails to provide adequate protections to European Union (EU) citizens, a move that dismantles the 15-year-old framework and replaces it with much uncertainty about the practical implications of cross-border data transfer.
While the ruling had not been expected for three months, the ECJ acted swiftly to endorse the opinion issued just two weeks ago by the European High Court, who agreed with Austrian Facebook member Maximillian Shrems that Safe Harbor does not protect EU citizens from mass surveillance by US intelligence agencies.
The ECJ invalidated Safe Harbor partly because it places national security and law enforcement interests above the fundamental right to privacy, “so that United States undertakings are bound to disregard, without limitation, the protective rules laid down” by Safe Harbor. The ECJ further noted that data review by intelligence agencies is based on no objective or measurable criteria and that EU citizens have no avenue to challenge the use of data held about them.
The judgement puts increased pressure on EU Data Protection Authorities (
What This Means to backgroundchecks.com Clients and Their Candidates:
While the ECJ ruling has sent the business and privacy communities into a swirl of uncertainty, it is uniformly agreed that it unlikely that
It is important to note the ECJ judgement does allow for data transfer to countries without adequate privacy protections under certain exceptions. The most significant one for clients using international services is where “the data subject has given his consent unambiguously to the proposed transfer.” Of the 28 EU countries that have adopted legislation implementing the EU data protection directive, all but Romania have explicitly adopted this exception.
Therefore, backgroundchecks.com suggests that organizations obtain explicit, written consent from the data subject to information about the data subject being sent to the United States.
What You Should Do:
- Consider immediately adding language to the consent form that your international candidates sign to obtain their consent for their information to be transferred to the United States.
- Review any further communications from backgroundchecks.com.
- Review the ECJ Judgement, which can be found at:
- As background, review the European High Court opinion that the ECJ Judgment affirmed:
About Michael Klazema The author
Michael Klazema is Chief Marketing Technologist at EY-VODW.com and has over two decades of experience in digital consulting, online product management, and technology innovation. He is the lead author and editor for Dallas-based backgroundchecks.com with a focus on human resource and employment screening developments.